PUBLISHER: ResearchInChina | PRODUCT CODE: 1623326
PUBLISHER: ResearchInChina | PRODUCT CODE: 1623326
Redundant system strategy research: develop towards integrated redundant design
ADAS redundant system definition framework
For autonomous vehicles, safety is the primary premise. Only when ADAS is fully redundant can real safety be ensured. Currently, the redundant design of most OEMs, Tier 1 suppliers and L4 autonomous driving companies is mainly software and hardware backup:
Software: algorithm redundancy, for example, GAC Group's latest ADiGO PILOT intelligent driving system adopts the AEB function algorithm, the vision + radar fusion algorithm and the vision algorithm real-time redundant verification strategy to maximize the reliability of AEB.
Hardware: reflected in different functional positions. The perception end, decision end, execution end, power supply end, etc. all adopt dual-redundant or multi-redundant design to ensure that when one of the systems fails, another system with the same function can work normally.
Execution redundancy: Fully redundant design of braking and steering systems
Execution redundancy and decision redundancy are the core parts, directly determining whether the vehicle can make correct response at a critical moment. Execution redundancy is often placed in braking and steering systems, and is generally designed as two independent systems with same functions. Decision redundancy is on the brain side. In vehicle EEA, the central computing platform is equipped with two sets of core computing units, and the redundant architecture design concept is adopted at vehicle architecture level, function definition level, system level, etc.
From the perspective of braking redundancy, its characteristics and trends are as follows:
At present, the key product is electro-hydraulic brake system (EHB), and the common redundancy schemes are the mechanical redundancy + electronic redundancy dual fail-safe mode, and adding auxiliary brake modules;
Brake-by-wire system is the future trend, because the electromechanical brake system (EMB) completely abandons brake fluid, hydraulic pipelines and other components of traditional braking systems, and generates braking force by electric motor drive, which improves the response speed, simplifies the structural layout, and enables inherent redundancy capabilities. However, it has extremely high reliability requirements and is difficult to mass-produce and install on vehicles in the short term.
In terms of steering redundancy, its characteristics and trends are as follows:
Currently the electric power steering system (EPS) mainly adopts the dual EPS steering redundancy scheme with two motors, two power supplies and two windings, which is equivalent to two sets of completely independent EPS hardware, which are independent of and backed up by each other, and the overall cost is relatively high;
The steering system is developing from electric power mode to wired-control mode. Steer-by-wire (SBW) system is composed of three main parts, i.e., steering wheel assembly, steering actuator assembly and ECU, as well as auxiliary systems such as automatic fail-safe system and power supply. It offers benefits of quick response, flexible installation method, light weight and high collision safety. SBW system therefore needs to have redundant backup of core components.
Redundant design of steer-by-wire system of NIO NT 3.0 Platform
The steer-by-wire system is used for transmission and control of electrical signals between the steering wheel and wheels. The angle and resistance torque of the steering wheel can be freely designed, with lower delay, more precise control, higher transmission efficiency and more flexible layout.
Fully redundant design with dual power supply, dual communication, dual hardware and dual software. Although there are no mechanical steering columns to connect the steering wheel and wheels, its reliability is 2.2 times higher than common electric power steering systems.
In December 2024, NIO ET9, the first model based on NT 3.0 Platform, acquired the mass production license for steer-by-wire technology from the Ministry of Industry and Information Technology, becoming China's first model carrying steer-by-wire technology.
Integrated redundant design for central computing architecture
With the in-depth application of intelligent connection and autonomous driving technologies, vehicle braking and steering systems are heading in the direction of integration. The central EEA and integrated chassis launched by some OEMs and suppliers combine the braking system, steering system, drive system, etc., and adopt an integrated and fully redundant design concept.
CATL Integrated Intelligent Chassis (CIIC) of CATL (Shanghai) Intelligent Technology Co., Ltd.
CIIC (CATL Integrated Intelligent Chassis) launched by CATL (Shanghai) Intelligent Technology Co., Ltd. is a highly intelligent skateboard chassis, with core features of "upper and lower decoupling, high integration, and openness".
CIIC highly integrates vehicle drive system, brake system, steering system, suspension system, etc. into the physical underbody, and the platform design enables scalable software and hardware;
CIIC-M (middle platform) adopts fully wired-control technology, eliminating the mechanical connection between the brake pedal and ECU, and completely decoupling the upper and lower bodies; meanwhile, it adds software redundancy strategy, safety monitoring, and fault handling mechanism to ensure system safety and robustness.
BYD e4 Platform
BYD's e4 Platform cancels the steering column and brake caliper, and uses the driving-braking-steering three-in-one technology to achieve steering and braking, thereby realizing vehicle-level safety redundancy capabilities.
Equipped with four 220-240kW large motors, it achieves the maximum braking deceleration of 1g and braking through precise motor torque and speed control, coupled with power blade batteries, new silicon carbide motor controller and advanced thermal management technology;
Differential steering technology is used to steer the vehicle. The left and right wheels receive different torques to deflect and thus complete the steering. The minimum turning diameter is 12 meters, and in the 18m pylon course slalom test, the maximum speed is 60km/h.
The e4 Platform features a distributed drive form with four independently driven motors, and it enables basic driving capabilities even if only one motor is working. In addition, the e4 Platform's innovative technology can provide braking and steering dual redundant backup based on existing braking and steering.
Control redundancy: Multi-ECU redundancy is still the mainstream solution, and will develop towards single-chip redundancy in the future
The control system must meet fail-operational requirements to achieve L3 and above autonomous driving functions, that is, after a sensor fails, the vehicle can still perform corresponding functions and complete driving safely. To this end, controlling system will use two or three ECUs, and implant some redundant safety measures on some sensors, or achieve control redundancy by adding chips in the domain controller.
Multi-ECU Redundancy Scheme - Dual Computing Platforms of BYD Xuanji Intelligent Architecture
As the main computing platform, Tianxuan cross-domain computing platform integrates the power domain, body domain and chassis domain, and adopts a multi-PCB design scheme for cooperative control of power domain, body domain and chassis domain;
A backup computing platform Tianji is added as backup redundancy. It is connected to the front and rear control domains via dual Gigabit Ethernet for case of need.
Single-chip redundant layout - based on Renesas multi-domain fusion SoC R-Car X5
R-Car X5, Renesas Electronics' the latest generation of automotive multi-domain fusion SoC (using ARM Cortex-A720AE core, meeting ASIL-B to ASIL-D functional safety requirements; 32-core design, CPU computing power up to 1000kDMIPS), supports the safety isolation of multiple domains with different functional safety level requirements, and adopts hardware-based "Freedom From Interference (FFI)" technology. This hardware design achieves the isolation of critical safety functions (such as brake-by-wire) from non-critical functions, and critical functions that are considered to be related to safety can be assigned to their own independent and redundant domain. Each domain has its own independent CPU core, memory, and interface, thereby preventing potential catastrophic failures in the vehicle when hardware or software in different domains fails.