WO2022022254A1

WO2022022254A1 - Brake redundancy method, system and self-driving vehicle

Info

Publication number: WO2022022254A1
Application number: PCT/CN2021/105183
Authority: WO
Inventors: 鲁兰; 徐华林; 官浩; 张立亮; 隋清海; 郝占武; 刘志鹏
Original assignee: 中国第一汽车股份有限公司
Priority date: 2020-07-29
Filing date: 2021-07-08
Publication date: 2022-02-03
Also published as: CN111873974A; CN111873974B

Abstract

A brake redundancy method and system, and a self-driving vehicle, comprising: when a current working condition of the vehicle satisfies a preset braking condition, a self-driving main controller sends, successively through a CAN bus, a gateway and a chassis main CAN bus, a first braking request to a main brake controller and a backup brake controller of the vehicle; when receiving the first braking request, the main brake controller brakes the vehicle according to the first braking request; and when receiving the first braking request, the backup brake controller determines a first braking instruction corresponding to the first braking request and executes the first braking instruction if the main brake controller is determined to be ineffective. According to the control method, the probability of braking delays can be reduced, vehicle safety is thus improved, and the incidence of traffic accidents of the self-driving vehicle is reduced.

Description

Brake redundancy control method, system and autonomous vehicle

This application claims the priority of the Chinese patent application with application number 202010744861.6 filed with the China Patent Office on July 29, 2020, the entire contents of which are incorporated herein by reference.

technical field

The present application relates to the technical field of automatic driving, for example, to a brake redundancy control method, system and automatic driving vehicle.

Background technique

With the development of autonomous driving technology, more and more vehicles are equipped with L3 level and above autonomous driving systems, and autonomous driving puts forward new requirements for traditional braking systems. However, the brake control system in the current self-driving vehicle is a non-redundant control system, and the safety of the self-driving vehicle is low. When the components in the brake control system fail, it will cause the vehicle to brake untimely. situations that endanger the lives of the driver and others.

SUMMARY OF THE INVENTION

Embodiments of the present application provide a brake redundancy control method, system, and automatic driving vehicle, so as to improve the driving safety of the automatic driving vehicle.

In an embodiment, an embodiment of the present application provides a brake redundancy control method, which is applied to a brake redundancy control system, wherein the brake redundancy control system includes an automatic driving main controller, a main brake Controller, backup brake controller, gateway, automatic driving controller area network (Controller Area Network, CAN) bus and chassis main CAN bus, the method includes:

In response to the current working conditions of the vehicle meeting the preset braking conditions, the automatic driving master controller sends the first braking control to the master brake controller and the backup brake controller via the automatic driving CAN bus, the gateway and the chassis master CAN bus in sequence. motion request;

the master brake controller, in response to receiving the first braking request, controls the vehicle to brake according to the first braking request;

In response to receiving the first braking request, the backup brake controller determines whether the main brake controller is in a failed state; in response to determining that the main brake controller is in a failed state, determines the first brake controller. A first braking command corresponding to a braking request, and the first braking command is executed.

In one embodiment, an embodiment of the present application provides a brake redundancy control system, including: an automatic driving master controller, a master brake controller, a backup brake controller, a gateway, an automatic driving CAN bus and a chassis master controller. CAN bus, where,

The automatic driving main controller is connected to the gateway through the automatic driving CAN bus, and is configured to send a message to the gateway through the automatic driving CAN bus under the condition that the current working condition of the vehicle satisfies the preset braking conditions. send a first braking request;

The gateway is respectively connected to the main brake controller and the backup brake controller through the chassis main CAN bus, and is configured to forward the first braking request to the a main brake controller and the backup brake controller;

the master brake controller, configured to control the vehicle to brake according to the first brake request when the first brake request is received;

The backup brake controller is configured to determine that the master brake controller is in an invalid state when the first braking request is received; in response to determining that the master brake controller is in an invalid state, determine The first braking command corresponds to the first braking request, and the first braking command is executed.

In an embodiment, an embodiment of the present application further provides an automatic driving vehicle, and the automatic driving vehicle includes the brake redundancy control system described in the embodiment of the present application.

Description of drawings

1 is a schematic flowchart of a brake redundancy control method provided in Embodiment 1 of the present application;

2 is a schematic diagram of a connection mode of a wheel brake cylinder provided in Embodiment 1 of the application;

FIG. 3 is a schematic diagram of the connection mode of another brake wheel cylinder provided in the first embodiment of the application;

FIG. 4 is a schematic flowchart of a brake redundancy control method according to Embodiment 2 of the present application;

FIG. 5 is a schematic structural diagram of a brake redundancy control system provided in Embodiment 3 of the present application;

FIG. 6 is a schematic structural diagram of another brake redundancy control system provided in Embodiment 3 of the present application.

detailed description

The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. For the convenience of description, the accompanying drawings only show some but not all of the contents related to the present application. Furthermore, the embodiments in this application and features in the embodiments may be combined with each other without conflict.

Example 1

Embodiment 1 of the present application provides a brake redundancy control method. The method can be executed by a brake redundancy control system, and is suitable for the situation of braking control of an autonomous vehicle (ie, a vehicle with an autonomous driving function). In one embodiment, when the redundant brake control system is in a single-point failure state, the braking control of the autonomous vehicle is performed during the period from the single-point failure of the self-braking redundant control system to the time when the driver takes over the vehicle. . The brake redundancy control system can be provided with an automatic driving master controller, an automatic driving controller area network (Controller Area Network, CAN) bus, a gateway, a chassis master CAN bus, a master brake controller and a backup brake controller , the main automatic driving controller is connected with the gateway through the automatic driving CAN bus, and the gateway is respectively connected with the main brake controller and the backup brake controller through the chassis main CAN bus.

FIG. 1 is a schematic flowchart of a brake redundancy control method provided in Embodiment 1 of the present application. As shown in FIG. 1 , the brake redundancy control method includes:

S101. When the current working condition of the vehicle satisfies the preset braking conditions, the main automatic driving controller transmits to the main brake controller and the backup brake controller of the vehicle via the automatic driving CAN bus, the gateway and the chassis main CAN bus in sequence. The controller sends the first braking request, and executes S102 or S103.

Among them, the main automatic driving controller is the controller that mainly controls the automatic driving of the vehicle (including the braking control during the automatic driving process) when it is not in a failed state; the braking conditions of the vehicle can be set by the developer in the setting The automatic driving control logic of the vehicle is set according to the needs. For example, the vehicle condition of the vehicle can be set to be less than or equal to the distance from the obstacle and/or the vehicle speed is greater than or equal to the preset speed, etc. The current working condition of the vehicle can be understood is the driving parameter of the vehicle corresponding to its braking conditions, such as the distance between the vehicle and the obstacle and/or the current speed of the vehicle at the current moment, etc.; the first braking request can be understood as the automatic driving master controller via the connection with the automatic driving CAN bus The braking request issued by the first interface of the The braking command of , as an example, is described.

In one embodiment, the brake redundancy control system is provided with two brake controllers, namely the main brake controller and the backup brake control. When the automatic driving main controller is not in a failed state, it periodically detects The current working condition of the vehicle, when the current working condition of the vehicle meets the preset braking conditions, a first braking request carrying the first braking command is generated, and the first braking request is sent via the automatic driving CAN bus gateway; the gateway receives the first braking request sent by the main automatic driving controller, and forwards the first braking request to the main braking controller and the backup braking controller via the chassis main CAN bus. The first braking command may be understood as the braking command carried in the first braking request.

S102. When receiving the first braking request, the master brake controller controls the vehicle to perform braking according to the first braking request, and ends the operation.

Among them, the main brake controller is the brake controller that mainly controls the braking of the vehicle when it is not in a failed state. For example, when the two brake controllers configured in the brake redundant control system have the same computing capability When the two brake controllers are configured in the redundant brake control system with the same computing ability and the execution When the abilities are different, the brake controller with stronger execution ability can be selected as the main brake controller, and another brake controller with weak execution ability can be determined as the backup brake controller; when the brake redundant control system When the computing capabilities of the two brake controllers configured in the system are different, the brake controller with stronger computing ability can be selected as the main brake controller, and the other brake controller with weak computing ability can be determined as the backup. brake controller.

In this embodiment, when the main brake controller can work normally, that is, when it is not in an invalid state, the main brake controller preferentially performs braking control on the vehicle according to the first braking request sent by the automatic driving main controller. Among them, whether the main brake controller itself is in a failed state can be detected through detection. For example, other monitoring systems in the vehicle can detect whether the main brake controller is faulty, and when there is a fault, the work of the main brake controller can be changed. The status flag is modified to the invalid state. Correspondingly, the main brake controller determines that it is in the invalid state when it is marked as the invalid state; it can also be detected by the main brake controller whether it is in the invalid state, such as the main brake controller. When it can receive information sent by other devices (such as the first braking request), that is, when it receives information sent by other devices, it can determine that it is not in a failed state. The following takes this detection method as an example. Be explained.

In one embodiment, when the master brake controller receives the first braking request sent by the automatic driving master controller, it means that the master brake controller is not in an invalid state, and the master brake controller can control the vehicle by the master brake controller. Perform brake control. Therefore, when the master brake controller receives the first braking request, it can directly control the vehicle to brake according to the first braking request. Execute the first braking command or control the backup braking controller to execute the first braking command, depending on the execution capability of the main braking controller and the backup braking controller. When the capabilities are not the same, the first braking command carried in the first braking request can be obtained by parsing the master braking controller, and executed by the master braking controller and the backup braking controller with stronger execution capability. For the first braking command, when the execution capabilities of the two are the same, a braking controller can be arbitrarily selected to execute the first braking command.

In one embodiment, the execution capability of the backup braking control is better than that of the primary braking controller, and the controlling the vehicle to perform braking according to the first braking request includes: determining the first braking control. determine whether the backup brake controller is in an invalid state, if so, execute the first braking command; if not, send the first braking command through the chassis main CAN bus. A braking command is sent to the backup braking controller, so that the backup braking controller executes the first braking command.

Among them, the main brake controller and the backup brake controller can determine whether the other party is in a failed state by periodically sending state detection information (such as heartbeat information) to the other party, and the main brake controller periodically sends the backup system to the backup system. Taking the status detection information sent by the brake controller as an example, the main brake controller can periodically send status detection information to the backup brake controller. Accordingly, the backup brake controller receives the status detection information sent by the main brake controller. After the information, the detection response information is sent to the main brake controller, so that if the main brake controller receives the detection response information sent by the backup brake controller within a preset time period, it can be determined that the backup brake controller has not In the failure state, if the detection response information sent by the backup brake controller is not received within the preset time period, it can be determined that the backup brake controller is in the failure state. It can be understood that, in this embodiment, the backup brake controller may periodically send state detection information to the main brake controller.

In one embodiment, when receiving the first braking request, the master brake controller analyzes the first braking request, obtains the first braking command carried in the first braking request, and judges that the current braking Whether the detection response information sent by the backup brake controller is received within the preset time period before the time; if the detection response information sent by the backup brake controller is received within the preset time period before the current time, the backup system is determined. The brake controller is not in a failed state, and sends the first brake command obtained by analysis to the backup brake controller. Correspondingly, the backup brake controller executes the first brake command sent by the main brake controller. The vehicle performs braking control; if it is determined that the backup brake controller is in an invalid state, the main brake controller directly executes the first braking command, thereby performing braking control on the vehicle.

S103. When receiving the first braking request, the backup braking controller determines that the primary braking controller is in an invalid state, determining a first braking command corresponding to the first braking request , and execute the first braking command.

In this embodiment, when the main brake controller is in a failed state, the backup brake controller may perform braking control on the vehicle according to the received first braking request.

In one embodiment, when the backup brake controller receives the first braking request (this means that the backup brake controller can work normally), it determines whether the main brake controller is not in a failed state, such as: Determine whether the state detection information sent by the main brake controller is received within the preset time period before the current time; if the state detection information sent by the main brake controller is received within the preset time period before the current time, determine If the master brake controller is not in a failed state and can perform braking control on the vehicle, that is, the master brake controller can execute S102, the backup controller may not perform the operation of parsing the first brake request; If the state detection information sent by the main brake controller has not been received within the previous preset time period, it can be determined that the main brake controller is in an invalid state and cannot perform braking control on the vehicle, and the backup controller can The request is parsed, the first braking command carried in the first braking request is obtained, and the first braking command is executed.

In one embodiment, the executing the first brake command may include: adjusting the hydraulic pressure of the corresponding brake wheel cylinders to reduce the speed of the vehicle; wherein the first master brake controller of the master brake controller The brake oil port is connected with at least two first brake wheel cylinders, and the second main brake oil port of the main brake controller is connected with at least two second brake wheel cylinders; the backup brake controller The first backup brake oil port of the backup brake controller is connected to the first main brake oil port or the first brake wheel cylinder, and the second backup brake oil port of the backup brake controller is connected to the second main brake oil port. The brake oil port or the second brake wheel cylinder is connected, as shown in Figure 2 and Figure 3 (in the figure, two first wheel brake cylinders and two second wheel brake cylinders are used as an example, in the figure Only hydraulic lines are shown, no communication lines).

Therefore, when the main brake controller (or the backup brake controller) executes the first braking command, the first main brake oil port and/or the second main brake oil port (or the first backup brake oil port and/or the second backup brake oil port) to adjust the hydraulic pressure of the corresponding brake wheel cylinder in the vehicle, increase the oil volume of the oil cavity between the pistons in the corresponding brake wheel cylinder, and then increase the relationship between the brake caliper and the brake disc. The force between them slows down the vehicle.

According to the braking redundancy control method provided in the first embodiment of the present application, when the current working condition of the vehicle meets the preset braking conditions, the main automatic driving control sends the signal to the vehicle's main CAN bus, the gateway and the chassis main CAN bus in sequence. The main brake controller and the backup brake controller send a first braking request; when the main brake controller receives the first braking request, it controls the vehicle to brake according to the first braking request; the backup braking When the controller receives the first braking request, if the main braking controller is in an invalid state, it determines the first braking command corresponding to the first braking request, and executes the first braking command. In this embodiment, by adopting the above technical solution, when the main brake controller does not fail, the main brake controller performs braking control on the vehicle, and when the main brake controller fails, the backup brake controller brakes the vehicle Control can reduce the probability of untimely braking of the vehicle, thereby improving the safety of the vehicle and the safety of the driver and other people's lives, and reducing the incidence of traffic accidents when the vehicle is driving automatically.

Embodiment 2

FIG. 4 is a schematic flowchart of a braking redundancy control method according to Embodiment 2 of the present application. In one embodiment, the braking redundancy control method further includes: the automatic driving main controller is in the current state of the vehicle. When the working conditions meet the preset braking conditions, the second braking request is sent to the main brake controller and the backup brake controller through the chassis backup CAN bus; During the second braking request, if it is determined that there is a failed component in the target component, the vehicle is controlled to brake according to the second braking request, wherein the target component includes the automatic driving CAN bus, the gateway and the chassis main CAN bus; when the backup brake controller receives the second brake request, if it determines that there is a failed component in the target component and the main brake controller is in a failed state, Then, a second braking command corresponding to the second braking request is determined, and the second braking command is executed.

In an embodiment, the braking redundancy control method further includes: when the current working condition of the vehicle meets a preset braking condition, the automatic driving auxiliary controller sequentially passes through the automatic driving CAN bus, the gateway and the The chassis main CAN bus sends a third brake request to the main brake controller and the backup brake controller; when the main brake controller receives the third brake request, if It is determined that the automatic driving main controller is in an invalid state, and the vehicle is controlled to brake according to the third braking request; when the backup braking controller receives the third braking request, if it determines If both the automatic driving main controller and the main brake controller are in an invalid state, a third braking command corresponding to the third braking request is determined, and the third braking command is executed.

In one embodiment, the brake redundancy control method further includes: when the current working condition of the vehicle meets a preset braking condition, the automatic driving auxiliary controller sends the brake to the main brake through the chassis backup CAN bus. The controller and the backup braking controller send a fourth braking request; when the master braking controller receives the fourth braking request, if it is determined that there is a failed part in the target part and the automatic If the driving master controller is in an invalid state, it will control the vehicle to perform braking according to the fourth braking request; when the backup braking controller receives the fourth braking request, if it determines that the target component is If there is a failed component and both the automatic driving main controller and the main brake controller are in a failed state, then determine the fourth braking command corresponding to the fourth braking request, and execute the fourth braking instruction.

Correspondingly, as shown in FIG. 4 , the braking redundancy control method provided in this embodiment includes:

S201. When the current working condition of the vehicle satisfies the preset braking conditions, the main automatic driving controller transmits to the main brake controller and the backup brake controller of the vehicle via the automatic driving CAN bus, the gateway and the main chassis CAN bus in sequence. The controller sends a first braking request, and sends a second braking request to the main brake controller and the backup brake controller through the chassis backup CAN bus; the automatic driving auxiliary controller sequentially passes through the automatic driving CAN bus, the gateway and the chassis main CAN bus, send a third braking request to the main brake controller and the backup brake controller, and send a third braking request to the main brake through the chassis backup CAN bus The controller and the backup braking controller send a fourth braking request, and perform one of steps S202-S209.

In this embodiment, the brake redundancy control system can also be provided with an auxiliary automatic driving controller and a chassis backup CAN bus, and the automatic driving main controller can also communicate with the main brake controller and the backup controller respectively through the chassis backup CAN bus. The automatic driving auxiliary controller can be connected to the network management through the automatic driving CAN bus, and is respectively connected to the main brake controller and the backup brake controller through the chassis backup CAN bus.

In one embodiment, the master brake controller periodically detects whether the current working condition of the vehicle satisfies the preset braking condition, and when detecting that the current working condition of the vehicle satisfies the preset braking condition, generates a The first braking request of the first braking command and the second braking request carrying the second braking command send the first braking request to the main brake via the automatic driving controller, the gateway and the chassis main CAN bus in turn The controller and the backup brake controller, and send the second brake request to the master brake controller and the backup brake controller via the chassis backup CAN bus; and, the automatic driving auxiliary controller periodically detects the current operation of the vehicle. check whether the preset braking conditions are met, and when it is detected that the current working condition of the vehicle meets the preset braking conditions, a third braking request with a third braking command and a fourth braking command are generated The fourth brake request is sent to the main brake controller and the backup brake controller via the automatic driving controller, the gateway and the chassis main CAN bus in turn, and the fourth brake request is sent to the main brake controller and the backup brake controller via the chassis backup CAN bus. The brake request is sent to the main brake controller and the backup brake controller.

Wherein, the first braking request, the second braking request, the third braking request and the fourth braking request may be requests that can achieve the same braking effect, and the main braking controller or the backup braking controller executes the first braking request. One of the four requests of a braking request, a second braking request, a third braking request and a fourth braking request can realize the braking control of the vehicle. Execution priority from high to low can be: the priority of the first braking request - the second braking request - the third braking request - the fourth braking request, that is, the main brake controller or the backup brake controller When a plurality of braking requests among the above-mentioned four braking requests are received and the braking of the vehicle is controlled by the brake controller, only the received braking request with the highest priority is executed.

S202. When receiving the first braking request, the master brake controller controls the vehicle to perform braking according to the first braking request, and ends the operation.

S203. When receiving the first braking request, the backup braking controller determines that the primary braking controller is in an invalid state, determining a first braking command corresponding to the first braking request , and execute the first braking command to end the operation.

S204. When the master brake controller receives the second brake request, if it is determined that there is a failed component in the target component, it controls the vehicle to brake according to the second brake request, and ends the operation, Wherein, the target component includes the automatic driving CAN bus, the gateway and the chassis main CAN bus.

In one embodiment, when the master brake controller receives the second braking request sent by the automatic driving master controller, it means that none of the automatic driving master controller, the chassis backup CAN bus, and the master brake controller are in a state. Failed state. At this time, the master brake controller can judge whether the automatic driving CAN bus, gateway and chassis master CAN bus are not in a failed state. If so, it means that the master brake controller can receive the execution priority sent by the automatic driving master controller. Higher first braking request, that is, the main brake controller can perform braking control on the vehicle by executing S202, so at this time the main brake controller can not process the second braking request; if not, it means that the main brake controller If the brake controller cannot receive the first brake request sent by the automatic driving master controller, the second brake request received at this time is the brake request with the highest priority that the master brake controller can currently receive. The main brake controller can perform braking control on the vehicle according to the second braking request.

Exemplarily, when braking the vehicle according to the second braking request, the master brake controller may analyze the second braking request to obtain the second braking command carried in the second braking request, and then When the backup brake controller is in an invalid state, the second brake command is directly executed; when neither the backup brake controller nor the chassis main CAN bus is in a failed state, the second brake command is sent through the chassis main CAN bus To the backup brake controller, the second brake command is executed by the backup brake controller; when the backup brake controller is not in a failed state and the chassis main CAN bus is in a failed state, the second braking command is executed through the chassis backup CAN bus. The braking command is sent to the backup braking controller, and the second braking command is executed by the backup braking controller.

S205. When the backup brake controller receives the second brake request, if it is determined that there is a failed component in the target component and the main brake controller is in a failed state, determine the second brake controller The second braking command corresponding to the motion request is executed, and the second braking command is executed to end the operation.

In one embodiment, when the backup brake controller receives the second braking request sent by the automatic driving master controller, it means that none of the automatic driving master controller, the chassis backup CAN bus and the backup brake controller are in the Failed state. At this time, the backup brake controller can determine whether the main brake controller is not in a failed state. If the main brake controller is not in a failed state, it means that the main brake controller can at least receive the information sent by the automatic driving main controller. The second brake request, that is, the main brake controller can perform braking control on the vehicle, so the backup brake controller may not process the second brake request at this time; if the main brake controller is in a failed state, it can further Determine whether the automatic driving CAN bus, gateway and chassis main CAN bus are not in a failed state. If so, it means that the backup brake controller can receive the first braking request with a higher execution priority sent by the automatic driving main controller. That is, the backup brake controller can perform braking control on the vehicle by executing S203, so the backup brake controller may not process the second braking request at this time; The first braking request sent by the controller, the second braking request received at this time is the braking request with the highest priority that the backup braking controller can currently receive, so at this time the backup braking controller can The second braking request performs braking control on the vehicle. For example, by analyzing the second braking request, the second braking command carried in the second braking request is obtained, and the second braking command is executed.

S206. When the master brake controller receives the third braking request, if it is determined that the automatic driving master controller is in an invalid state, it controls the vehicle to brake according to the third braking request , to end the operation.

In one embodiment, when the master brake controller receives the third braking request sent by the automatic driving auxiliary controller, it means that the automatic driving auxiliary controller, the automatic driving CAN bus, the gateway, the chassis main CAN bus and the main None of the brake controllers are disabled. At this time, the master brake controller can determine whether the automatic driving master controller is not in a failed state. If so, it means that the master brake controller can receive the first brake with a higher execution priority sent by the automatic driving master controller. request, that is, the master brake controller can perform braking control on the vehicle by executing S202, so the master brake controller can not process the third braking request at this time; if not, the manual master brake controller cannot receive automatic The first braking request and the second braking request sent by the driving master controller, the third braking request received at this time is the braking request with the highest priority that the master braking controller can currently receive, so at this time The master brake controller may perform braking control of the vehicle according to the third braking request.

Exemplarily, when braking the vehicle according to the third braking request, the master brake controller may parse the third braking request to obtain the third braking command carried in the third braking request, and execute the braking command in the third braking request. When the backup brake controller is in an invalid state, the third brake command is directly executed; when the backup brake controller is not in a failed state, the third brake command is sent to the backup brake controller through the chassis main CAN bus. , the third braking command is executed by the backup braking controller.

S207. When the backup brake controller receives the third brake request, if it is determined that both the automatic driving main controller and the main brake controller are in an invalid state, determine the third brake controller The third braking command corresponding to the motion request is executed, and the third braking command is executed to end the operation.

In one embodiment, when the backup brake controller receives the third braking request sent by the auxiliary automatic driving controller, it means that the auxiliary braking controller for automatic driving, the CAN bus for automatic driving, the gateway, the main CAN bus for the chassis and the backup None of the brake controllers are disabled. At this time, the backup brake controller can determine whether the main brake controller is not in a failed state. If the main brake controller is not in a failed state, it means that the main brake controller can at least receive the information sent by the auxiliary automatic driving controller. The third brake request, that is, the main brake controller can perform braking control on the vehicle, so the backup brake controller may not process the third brake request at this time; if the main brake controller is in a failed state, the backup brake controller The brake controller can further determine whether the main automatic driving controller is not in a failed state. If so, it means that the backup brake controller can receive the first brake request with a higher execution priority sent by the main automatic driving controller, that is, the backup brake controller. The brake controller can perform brake control on the vehicle by executing S203, so the backup brake controller may not process the third brake request at this time; if not, it means that the backup brake controller cannot receive the automatic driving master controller The first braking request and the second braking request sent, the third braking request received at this time is the braking request with the highest priority that the backup braking controller can currently receive, so at this time the backup braking control The controller can perform braking control on the vehicle according to the third braking request, such as analyzing the third braking request, obtain the third braking command carried in the third braking request, and execute the third braking command.

S208. When the master brake controller receives the fourth braking request, if it is determined that there is a failed part in the target part and the automatic driving master controller is in a failed state, then according to the fourth braking request A braking request is made to control the vehicle to brake, and the operation is ended.

In one embodiment, when the master brake controller receives the fourth braking request sent by the automatic driving auxiliary controller, it means that none of the automatic driving auxiliary controller, the chassis backup CAN bus, and the master brake controller are in a state. Failed state. At this time, the master brake controller can first determine whether the automatic driving CAN bus, gateway and chassis master CAN bus are not in a failed state. If so, it means that the master brake controller can at least receive the execution sent by the automatic driving auxiliary controller. The third braking request has a higher priority, so the master brake controller may not process the fourth braking request at this time; if not, it can be further judged whether the automatic driving master controller The controller is not in the invalid state, it means that the master brake controller can receive the second brake request with higher execution priority sent by the automatic driving master controller, that is, the master brake controller can brake the vehicle by executing S204. Therefore, the master brake controller can also not process the fourth braking request at this time; if the automatic driving master controller is in the invalid state, it means that the master brake controller cannot receive the first brake request sent by the automatic driving master controller. The braking request, the second braking request and the third braking request sent by the auxiliary automatic driving controller, the fourth braking request received at this time is the braking request with the highest priority that the main braking controller can currently receive. Therefore, at this time, the main brake controller can perform braking control on the vehicle according to the fourth braking request.

Exemplarily, when braking the vehicle according to the fourth braking request, the master brake controller may analyze the fourth braking request to obtain the fourth braking instruction carried in the fourth braking request, and then When the backup brake controller is in an invalid state, the fourth brake command is directly executed; when neither the backup brake controller nor the chassis main CAN bus is in a failed state, the fourth brake command is sent through the chassis main CAN bus To the backup brake controller, the backup brake controller executes the fourth braking command; when the backup brake controller is not in a failed state and the chassis main CAN bus is in a failed state, the fourth braking command is executed through the chassis backup CAN bus. The braking command is sent to the backup braking controller, and the backup braking controller executes the fourth braking command.

S209. When the backup brake controller receives the fourth brake request, if it is determined that there is a failed component in the target component and both the automatic driving main controller and the main brake controller are in failure state, the fourth braking command corresponding to the fourth braking request is determined, the fourth braking command is executed, and the operation is ended.

In one embodiment, when the backup brake controller receives the fourth braking request sent by the automatic driving auxiliary controller, it means that none of the automatic driving auxiliary controller, the chassis backup CAN bus, and the backup brake controller are in a state. Failed state. At this time, the backup brake controller can determine whether the main brake controller is not in a failed state. If the main brake controller is not in a failed state, it means that the main brake controller can at least receive the information sent by the auxiliary automatic driving controller. The fourth brake request, that is, the main brake controller can brake the vehicle, so the backup brake controller can not process the fourth brake request at this time; if the main brake controller is in a failed state, it can continue Determine whether the main automatic driving controller is not in a failed state. If the main automatic driving controller is not in a failed state, it means that the backup brake controller can at least receive the second braking system with a higher execution priority sent by the main automatic driving controller. Therefore, at this time, the backup brake controller can also not process the fourth brake request; if the automatic driving master controller is in a failed state, it can be further judged whether the automatic driving CAN bus, gateway and chassis master CAN bus are not in a state of failure. Failure status, if yes, it means that the backup brake controller can receive the third brake request with higher execution priority sent by the automatic driving auxiliary controller, that is, the backup brake controller can perform brake control on the vehicle by executing S207 , so the backup brake controller can still not process the fourth brake request at this time; if not, the manual backup brake controller cannot receive the first brake request and the second brake request sent by the automatic driving master controller and the third braking request sent by the automatic driving auxiliary controller, the fourth braking request received at this time is the braking request with the highest priority that the backup braking controller can currently receive, so the backup braking control The controller may perform braking control on the vehicle according to the fourth braking request, for example, by analyzing the fourth braking request, obtain the fourth braking command carried in the fourth braking request, and execute the fourth braking command.

In this embodiment, when the vehicle is in the automatic driving mode, whether it is in a system-wide state (that is, a state in which there is no failed component in the brake redundant control system), or a state where a single point of failure occurs (that is, a redundant brake control system) In the state where there is only one failed component in the control system), even if the driver does not take over the control of the vehicle in time, the safe state of the vehicle can still be guaranteed.

For example, in the system-wide state, the master brake controller can control the vehicle to brake based on the first braking request sent by the automatic driving master controller. In the single-point failure state, when the main automatic driving controller fails, the main brake controller can control the vehicle to brake based on the third braking request sent by the auxiliary automatic driving controller; when the auxiliary automatic driving controller, the backup brake When the braking controller or chassis backup CAN bus fails, the master brake controller can control the vehicle to brake based on the first braking request sent by the automatic driving master controller; when the automatic driving CAN bus, gateway or chassis master CAN bus fails , the main brake controller can control the vehicle to brake based on the second braking request sent by the main automatic driving controller; when the main brake controller fails, the backup brake controller can be based on the first braking request sent by the main automatic driving controller. The brake request controls the braking of the vehicle.

The braking redundancy control method provided in the second embodiment of the present application, when the vehicle is in the automatic driving mode, not only can control the vehicle to brake in time when braking is required in the whole system state and the single-point failure state, but also can In the case of partial multi-point failure, the vehicle can be braked in time, which further improves the safety of the vehicle and the safety of the driver and others, and reduces the incidence of traffic accidents.

Embodiment 3

The third embodiment of the present application provides a brake redundancy control system. The system can control the braking of autonomous vehicles by implementing the braking redundancy control method, and is suitable for braking control of autonomous vehicles, especially when the braking redundancy control system is in a single-point failure state. , when the self-braking redundant control system has a single point of failure and the driver takes over the vehicle to take over the braking control of the autonomous vehicle. FIG. 5 is a schematic flowchart of a brake redundancy control system provided in Embodiment 3 of the application. As shown in FIG. 5 , the brake redundancy control system includes: an automatic driving master controller 51 and a master brake controller 52 , backup brake controller 53, gateway 54, automatic driving CAN bus 55 and chassis main CAN bus 56, wherein,

The automatic driving main controller 51 is connected to the gateway 54 through the automatic driving CAN bus 55, and is configured to send a signal to the gateway 54 through the automatic driving CAN bus 55 when the current working condition of the vehicle satisfies the preset braking conditions. The gateway 54 sends the first braking request;

The gateway 54 is respectively connected with the main brake controller 52 and the backup brake controller 53 through the chassis main CAN bus 56 , and is configured to connect the first brake controller 53 through the chassis main CAN bus 56 . The request is forwarded to the main brake controller 52 and the backup brake controller 53;

The main brake controller 52 is configured to control the vehicle to brake according to the first brake request when receiving the first brake request;

The backup brake controller 53 is configured to, when receiving the first brake request, determine the first brake controller 52 corresponding to the first brake request if it is determined that the master brake controller 52 is in an invalid state. and execute the first braking command.

In the brake redundancy control device provided in the third embodiment of the present application, the automatic driving main controller is connected to the gateway through the automatic CAN bus, and the gateway is respectively connected to the main brake controller and the backup brake controller through the chassis main CAN bus. When the current working condition of the vehicle meets the preset braking conditions, the driving master control sends the first control signal to the vehicle's master brake controller and backup brake controller via the automatic driving CAN bus, gateway and chassis master CAN bus in sequence. When receiving the first braking request, the main brake controller controls the vehicle to brake according to the first braking request; when the backup braking controller receives the first braking request, If the main brake controller is in a failed state, the first braking command corresponding to the first braking request is determined, and the first braking command is executed. In this embodiment, by adopting the above technical solution, when the main brake controller does not fail, the main brake controller performs braking control on the vehicle, and when the main brake controller fails, the backup brake controller brakes the vehicle Control can reduce the probability of untimely braking of the vehicle, thereby improving the safety of the vehicle and the safety of the driver and other people's lives, and reducing the incidence of traffic accidents when the vehicle is driving automatically.

In the above solution, the controlling the vehicle to perform braking according to the first braking request includes: determining a first braking command corresponding to the first braking request; determining whether the backup braking controller is is in an invalid state, if yes, execute the first braking command; if not, send the first braking command to the backup brake controller through the chassis main CAN bus, so that the backup A braking controller executes the first braking command.

In an embodiment, please refer to FIG. 6 , the brake redundancy control system may further include: a chassis backup CAN bus 57 , wherein the automatic driving main controller 51 also communicates with the chassis backup CAN bus 57 through the chassis backup CAN bus 57 , respectively. The main brake controller 52 is connected to the backup brake controller 53, and is configured to send the main brake to the main brake through the chassis backup CAN bus 57 when the current working condition of the vehicle satisfies the preset braking conditions. The controller 52 and the backup brake controller 53 send a second brake request; the master brake controller 52 is also configured to, when receiving the second brake request, determine that there is a failure in the target component component, then control the vehicle to brake according to the second braking request, wherein the target component includes the automatic driving CAN bus 55, the gateway 54 and the chassis main CAN bus 56; the backup The brake controller 53 is further configured to, when receiving the second brake request, determine that the second brake controller 52 is in a failed state if it is determined that there is a failed component in the target component and the main brake controller 52 is in a failed state. The second braking command corresponding to the braking request is executed, and the second braking command is executed.

In one embodiment, please continue to refer to FIG. 6 , the brake redundancy control system may further include: an automatic driving auxiliary controller 58 , wherein the automatic driving auxiliary controller 58 communicates with the automatic driving CAN bus 55 through the automatic driving CAN bus 55 . The gateway 54 is connected, and is set to send a third braking request to the gateway 54 through the automatic driving CAN bus 55 when the current working condition of the vehicle meets the preset braking conditions; the gateway 54 is also set In order to forward the third braking request to the main brake controller 52 and the backup brake controller 53 through the chassis main CAN bus 56; the main brake controller 52 is also set to When receiving the third braking request, if it is determined that the automatic driving main controller 51 is in an invalid state, the vehicle is controlled to brake according to the third braking request; the backup braking controller 53 , and is also set to, when receiving the third braking request, if it is determined that both the automatic driving master controller 51 and the master braking controller 52 are in an invalid state, then determine that the third braking request corresponds to the third braking command, and execute the third braking command.

In the above solution, please continue to refer to FIG. 6, the automatic driving auxiliary controller 58 is also connected with the main brake controller 52 and the backup brake controller 53 through the chassis backup CAN bus 57, and is set to When the current working condition of the vehicle satisfies the preset braking conditions, a fourth braking request is sent to the main brake controller 52 and the backup brake controller 53 through the chassis backup CAN bus 57; the The master brake controller 52 is further configured to, when receiving the fourth braking request, determine that there is a failed part in the target part and the automatic driving master controller 51 is in a failed state, according to the fourth braking request. The fourth braking request controls the vehicle to perform braking; the backup braking controller 53 is further configured to, when receiving the fourth braking request, if it is determined that there is a failed part in the target part and the automatic If both the main driving controller 51 and the main braking controller 52 are in a disabled state, the fourth braking command corresponding to the fourth braking request is determined, and the fourth braking command is executed.

In one embodiment, the redundant brake control system may further include at least two first wheel brake cylinders and at least two second wheel brake cylinders, wherein the first master brake control unit of the master brake controller The brake oil port is connected to the first brake wheel cylinder, the second main brake oil port of the main brake controller is connected to the second brake wheel cylinder; the second brake oil port of the backup brake controller is connected to the second brake wheel cylinder; A backup brake oil port is connected to the first main brake oil port or the first brake wheel cylinder, and the second backup brake oil port of the backup brake controller is connected to the second main brake oil port The oil port or the second brake wheel cylinder is connected.

The brake redundancy control system provided in the third embodiment of the present application can execute the brake redundancy control method provided in any embodiment of the present application, and has functional modules and effects corresponding to executing the brake redundancy control method. For technical details not described in detail in this embodiment, reference may be made to the brake redundancy control method provided by any embodiment of the present application.

Embodiment 4

The fourth embodiment of the present application provides an automatic driving vehicle. The vehicle can be braked through the configured brake redundancy control system, which automatically drives the master controller, the master brake controller, the backup brake controller, the gateway, the automatic driving CAN bus and the chassis main CAN bus, where,

The automatic driving main controller is connected to the gateway through the automatic driving CAN bus, and is set to send the first number of messages to the gateway through the automatic driving CAN bus when the current working condition of the vehicle satisfies the preset braking conditions. a braking request;

The master brake controller is configured to control the vehicle to brake according to the first brake request when receiving the first brake request;

The backup brake controller is configured to, when receiving the first brake request, determine the first brake command corresponding to the first brake request if it is determined that the master brake controller is in a failed state , and execute the first braking command.

The automatic driving vehicle provided in the fourth embodiment of the present application is controlled by the automatic driving master in the braking redundant control system, when the current working condition of the vehicle meets the preset braking conditions, and the automatic driving CAN bus, the gateway and the chassis master are successively controlled. The CAN bus, sends the first braking request to the main brake controller and the backup brake controller of the vehicle; when the main brake controller in the brake redundancy control system receives the first braking request, according to the The first brake request controls the vehicle to brake; when the backup brake controller in the brake redundancy control system receives the first brake request, if the main brake controller is in a failed state, it determines the first brake controller. A first braking command corresponding to a braking request, and the first braking command is executed. In this embodiment, by adopting the above technical solution, when the main brake controller does not fail, the main brake controller performs braking control on the vehicle, and when the main brake controller fails, the backup brake controller brakes the vehicle Control can reduce the probability of untimely braking of the vehicle, thereby improving the safety of the vehicle and the safety of the driver and other people's lives, and reducing the incidence of traffic accidents when the vehicle is driving automatically.

Claims

A brake redundant control method is applied to a brake redundant control system, wherein the brake redundant control system includes an automatic driving main controller, a main brake controller, a backup brake controller, a gateway, an automatic Driving the controller area network CAN bus and the chassis main CAN bus, the method includes:

In response to the current working conditions of the vehicle meeting the preset braking conditions, the automatic driving master controller reports to the master brake controller sequentially via the automatic driving CAN bus, the gateway and the chassis master CAN bus. sending a first braking request with the backup braking controller;

the master brake controller, in response to receiving the first braking request, controls the vehicle to brake according to the first braking request;

In response to receiving the first braking request, the backup brake controller determines whether the main brake controller is in a failed state; in response to determining that the main brake controller is in a failed state, determines the first brake controller. A first braking command corresponding to a braking request, and the first braking command is executed.
The method according to claim 1, wherein, in the case where the execution capability of the backup brake controller is better than that of the main brake controller, the control of the braking the vehicle, including:

determining a first braking command corresponding to the first braking request;

Determine whether the backup brake controller is in a failed state, and execute the first braking instruction in response to the backup brake controller being in a failed state; in response to the backup brake controller not being in a failed state, pass The chassis main CAN bus sends the first braking command to the backup braking controller, so that the backup braking controller executes the first braking command.
The method of claim 1, wherein the brake redundancy control system includes a chassis backup CAN bus, the method further comprising:

In response to the current working condition of the vehicle meeting the preset braking conditions, the automatic driving master controller sends the information to the master brake controller and the backup brake controller through the chassis backup CAN bus. the second braking request;

In response to receiving the second braking request, the master brake controller determines whether there is a failed part in the target part; in response to determining that there is a failed part in the target part, controls the vehicle according to the second braking request braking, wherein the target component includes the autonomous driving CAN bus, the gateway and the chassis main CAN bus;

In response to receiving the second braking request, the backup brake controller determines whether there is a failed component in the target component and whether the primary brake controller is in a failed state; in response to determining that the target component is in a failed state If there is a failed component and the master brake controller is in a failed state, a second braking command corresponding to the second braking request is determined, and the second braking command is executed.
The method of claim 3, wherein the brake redundancy control system includes an automatic driving assistance controller, the method further comprising:

In response to the current working conditions of the vehicle meeting the preset braking conditions, the automatic driving auxiliary controller sends the information to the master via the automatic driving CAN bus, the gateway and the chassis master CAN bus in sequence. the brake controller and the backup brake controller send a third brake request;

In response to receiving the third braking request, the master brake controller determines that the automatic driving master controller is in an invalid state; in response to determining that the automatic driving master controller is in an invalid state, according to the third a braking request controls the vehicle to brake;

In response to receiving the third braking request, the backup brake controller determines whether both the automatic driving master controller and the master brake controller are in a failed state; in response to determining that the automatic driving master controller Both the brake and the main brake controller are in a failed state, determine a third braking command corresponding to the third braking request, and execute the third braking command.
The method of claim 4, further comprising:

In response to the current operating conditions of the vehicle meeting the preset braking conditions, the automatic driving auxiliary controller sends the information to the main brake controller and the backup brake controller through the chassis backup CAN bus. the fourth braking request;

In response to receiving the fourth braking request, the master brake controller determines whether there is a failed part in the target part and whether the automatic driving master controller is in a failed state; in response to determining that there is a failure in the target part There is a failed component and the automatic driving main controller is in a failed state, and the vehicle is controlled to brake according to the fourth braking request;

In response to receiving the fourth braking request, the backup brake controller determines whether there is a failed component in the target component and whether both the automatic driving main controller and the main brake controller are in a failed state ; in response to determining that a failed component exists in the target component and both the automatic driving master controller and the master brake controller are in a failed state, determining a fourth braking command corresponding to the fourth braking request, and The fourth braking command is executed.
The method according to any one of claims 1-5, wherein, when the master brake controller executes the first braking command, the executing the first braking command comprises:

adjusting the hydraulic pressure of wheel cylinders corresponding to at least one of the first and second main brake oil ports of the main brake controller to reduce the speed of the vehicle;

When the backup braking controller executes the first braking command, the executing the first braking command includes:

adjusting the hydraulic pressure of the wheel cylinder corresponding to at least one of the first backup brake oil port and the second backup brake oil port of the backup brake controller to reduce the speed of the vehicle;

Wherein, the first main brake oil port of the main brake controller is connected to at least two first brake wheel cylinders, and the second main brake oil port of the main brake controller is connected to at least two second wheel cylinders. The first backup brake oil port of the backup brake controller is connected to the first main brake oil port or the first brake wheel cylinder, and the backup brake controller has a The second backup brake oil port is connected to the second main brake oil port or the second brake wheel cylinder.
A brake redundant control system includes an automatic driving master controller, a master brake controller, a backup brake controller, a gateway, an automatic driving controller local area network CAN bus and a chassis master CAN bus, wherein,

The automatic driving main controller is connected to the gateway through the automatic driving CAN bus, and is configured to send a message to the gateway through the automatic driving CAN bus under the condition that the current working condition of the vehicle satisfies the preset braking conditions. send a first braking request;

The gateway is respectively connected to the main brake controller and the backup brake controller through the chassis main CAN bus, and is configured to forward the first braking request to the a main brake controller and the backup brake controller;

the master brake controller, configured to control the vehicle to brake according to the first brake request when the first brake request is received;

The backup brake controller is configured to determine that the master brake controller is in an invalid state when the first braking request is received; in response to determining that the master brake controller is in an invalid state, determine The first braking command corresponds to the first braking request, and the first braking command is executed.
The system of claim 7, further comprising a chassis backup CAN bus, wherein,

The automatic driving main controller is also connected to the main brake controller and the backup brake controller through the chassis backup CAN bus, respectively, and is set to satisfy the preset conditions when the current working condition of the vehicle is satisfied. In the case of braking conditions, send a second braking request to the main brake controller and the backup brake controller through the chassis backup CAN bus;

The master brake controller is further configured to, in the case of receiving the second braking request, determine whether there is a failed part in the target part; in response to determining that there is a failed part in the target part, according to the second system to control the vehicle to brake, and the target component includes the automatic driving CAN bus, the gateway and the chassis main CAN bus;

The backup brake controller is further configured to, in the case of receiving the second brake request, determine whether there is a failed component in the target component and whether the main brake controller is in a failed state; in response to It is determined that there is a failed component in the target component and the main brake controller is in a failed state, a second braking command corresponding to the second braking request is determined, and the second braking command is executed.
The system of claim 7, further comprising at least two first wheel brake cylinders and at least two second wheel brake cylinders, wherein,

The first main brake oil port of the main brake controller is connected to the first brake wheel cylinder, and the second main brake oil port of the main brake controller is connected to the second brake wheel cylinder connected;

The first backup brake oil port of the backup brake controller is connected to the first main brake oil port or the first brake wheel cylinder, and the second backup brake oil port of the backup brake controller The port is connected to the second main brake oil port or the second brake wheel cylinder.
An automatic driving vehicle comprising the brake redundancy control system of any one of claims 7-9.