METHOD FOR CONTROLLING FAIL-SAFE OF ELECTRONIC MECHANICAL BRAKE APPARATUS

Abstract

A fail-safe control method of an electromechanical brake apparatus comprising a plurality of wheel controllers, a main controller, and an auxiliary controller that control electromechanical brakes disposed on each wheel of a vehicle, the method comprising: deciding a self-status of each of the plurality of wheel controllers, the main controller, and the auxiliary controller based on pre-classified status information; sharing self-status decided by each of the plurality of wheel controllers, the main controller, and the auxiliary controller; determining a status of one another based on the shared self-status among the plurality of wheel controllers, the main controller, and the auxiliary controller; activating a pre-designated fail-safe mode based on status information of each of the plurality of wheel controllers, the main controller, and the auxiliary controller; and performing emergency braking of the vehicle based on the pre-designated fail-safe mode or maintaining the vehicle in a drivable status.

Claims

1. A method of operating an electromechanical brake apparatus for fail-safe control, the electromechanical brake apparatus comprising a plurality of wheel controllers, a main controller and an auxiliary controller which are configured to control a plurality of electromechanical brakes respectively disposed on a plurality of wheels of a vehicle, the method comprising: causing each of the plurality of wheel controllers, the main controller, and the auxiliary controller to decide, based on pre-classified status information, a self-status of each of the plurality of wheel controllers, the main controller and the auxiliary controller; causing each of the plurality of wheel controllers, the main controller and the auxiliary controller to share the self-status with the others; causing each of the plurality of wheel controllers, the main controller and the auxiliary controller to determine, based on the self-status shared by the others, a status of each of the others; activating a pre-designated fail-safe mode based on the shared status of each of the plurality of wheel controllers, the main controller and the auxiliary controller; and performing (1) emergency braking of the vehicle based on the pre-designated fail-safe mode or (2) maintaining the vehicle in a drivable status.

2. The method of claim 1, wherein the self-status of each of the plurality of wheel controllers, the main controller and the auxiliary controller is decided based on one of: a normal status in which control requirement performance of the vehicle is satisfied and function implementation is possible; a function degraded status in which the function implementation is possible under a condition in which the control requirement performance of the vehicle is reduced; and an unfunctional status in which the condition in which the control requirement performance of the vehicle is reduced is not satisfied or the function implementation is impossible.

3. The method of claim 1, wherein the self-status of each of the plurality of wheel controllers, the main controller and the auxiliary controller is shared with the others by using at least one of a first communication part connected between the plurality of wheel controllers and the main controller and a second communication part connected between the plurality of wheel controllers and the auxiliary controller.

4. The method of claim 1, wherein causing each of the plurality of wheel controllers, the main controller and the auxiliary controller to determine the status of each of the others comprises: causing each of the plurality of wheel controllers, the main controller and the auxiliary controller to define a characteristic signal that changes periodically for each of the plurality of wheel controllers, the main controller and the auxiliary controller; and causing each of the plurality of wheel controllers, the main controller and the auxiliary controller to continuously transmit the defined characteristic signal to the others while assuming that the status of at least one of the plurality of wheel controllers, the main controller and the auxiliary controller that is determined to have failed to receive the characteristic signal as an unfunctional status.

5. The method of claim 1, wherein: activating the pre-designated fail-safe mode based on the shared status of each of the plurality of wheel controllers, the main controller and the auxiliary controller comprises performing emergency driving or the emergency braking of the vehicle by a remaining one of the main controller and the auxiliary controller in a normal status in response to determining that the main controller or the auxiliary controller is in a function degraded status or an unfunctional status, and when the main controller is in the unfunctional status, the auxiliary controller controls the vehicle to perform the emergency braking based on control requirement performance lower than the emergency braking when the main controller is in the function degraded status.

6. The method of claim 1, wherein activating the pre-designated fail-safe mode based on the shared status of each of the plurality of wheel controllers, the main controller and the auxiliary controller includes performing emergency driving or the emergency braking of the vehicle using one of the plurality of wheel controllers that is in a normal status when one of the plurality of wheel controllers is determined to be in a function degraded status or an unfunctional status.

7. An electromechanical brake apparatus, comprising: a main controller configured to control driving and braking of a vehicle; an auxiliary controller configured to control the driving and braking of the vehicle when the main controller is in a function degraded status or an unfunctional status; a plurality of wheel controllers respectively connected to a plurality of electromechanical brakes respectively coupled to a plurality of wheels of the vehicle, the plurality of wheel controllers configured to generate a braking force for the vehicle using the plurality of electromechanical brakes; a first power supply unit and a second power supply unit configured to supply power to the main controller, the auxiliary controller and the plurality of wheel controllers; and a first communication part and a second communication part configured to transmit information among the main controller, the auxiliary controller and the plurality of wheel controllers, wherein each of the main controller, the auxiliary controller and the plurality of wheel controllers is configured to (1) decide, based on pre-classified status information, a self-status of each of the main controller, the auxiliary controller and the plurality of wheel controllers, and (2) share the decided self-status with the others to perform emergency braking of the vehicle or maintain the vehicle in a drivable status.

8. The apparatus of claim 7, wherein each of the main controller, the auxiliary controller and the plurality of wheel controllers is configured to (1) define a characteristic signal that changes periodically and (2) continuously transmit the defined characteristic signal to the others while a status of one of the main controller, the auxiliary controller and the plurality of wheel controllers that has failed to receive the characteristic signal is assumed as an unfunctional status.

9. The apparatus of claim 7, wherein the auxiliary controller is configured, in response to the main controller being in the unfunctional status, control the vehicle to perform the emergency braking based on control requirement performance lower than the emergency braking when the main controller is in the function degraded status or the unfunctional status.

10. The apparatus of claim 7, wherein the plurality of wheel controllers is configured to perform emergency driving or the emergency braking of the vehicle using a remaining one of the plurality of wheel controllers in a normal status when one of the plurality of wheel controllers is determined to be in the function degraded status or the unfunctional status.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 is a diagram illustrating the configuration of an electromechanical brake apparatus according to an embodiment of the present disclosure.

[0012] FIG. 2 is a table showing fail-safe modes designated based on pre-classified status information according to an embodiment of the present disclosure.

[0013] FIG. 3 is a flowchart showing a method for controlling fail-safe of an electromechanical brake apparatus according to an embodiment of the present disclosure.

DETAILED DESCRIPTION

[0014] Hereinafter, some exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In the following description, like reference numerals preferably designate like elements, although the elements are shown in different drawings. Further, in the following description of some embodiments, a detailed description of known functions and configurations incorporated therein will be omitted for the purpose of clarity and for brevity.

[0015] Additionally, various terms such as first, second, A, B, (a), (b), etc., are used solely to differentiate one component from the other but not to imply or suggest the substances, order, or sequence of the components. Throughout this specification, when a part includes or comprises a component, the part is meant to further include other components, not to exclude thereof unless specifically stated to the contrary. The terms such as unit, module, and the like refer to one or more units for processing at least one function or operation, which may be implemented by hardware, software, or a combination thereof.

[0016] FIG. 1 is a diagram illustrating the configuration of an electromechanical brake apparatus according to an embodiment of the present disclosure.

[0017] Referring to FIG. 1, the electromechanical brake apparatus according to an embodiment of the present disclosure includes all or part of a main controller 150, an auxiliary controller 160, a plurality of electromechanical brakes 111, 121, 131 and 141, a plurality of wheel controllers 112, 122, 132 and 142, a first power supply unit 170, a second power supply unit 180, a first communication part 190, and a second communication part 191.

[0018] The main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 according to an embodiment of the present disclosure may be configured as an electronic control unit.

[0019] In the following description of the present disclosure, the electronic control unit described below may be described as including part or all of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142.

[0020] The main controller 150 may decide the braking force required for each wheel 110, 120, 130, and 140 of a vehicle 100 in a normal status, and may transmit a braking command to the plurality of wheel controllers 112, 122, 132, and 142 disposed in each wheel 110, 120, 130, and 140 based on the decided braking command. Herein, the normal status means a status in which the electronic control unit satisfies the control requirement performance of the vehicle 100 and is capable of implementing a function. A function degraded status and an unfunctional status, excluding the normal status, will be described later. Herein, each wheel 110, 120, 130, and 140 of the vehicle 100 includes a left front (FL) wheel 110, a right front (FR) wheel 120, a left rear (RL) wheel 130, and a right rear (RR) wheel 140.

[0021] The auxiliary controller 160 may be configured to control emergency braking of the vehicle 100 in case the function of the main controller 150 is degraded or abnormal.

[0022] The plurality of electromechanical brakes 111, 121, 131, and 141 according to an embodiment of the present disclosure may be disposed on each wheel 110, 120, 130, and 140 of the vehicle 100. For example, the plurality of electromechanical brakes 111, 121, 131, and 141 may include a left front wheel electromechanical brake 111, a right front wheel electromechanical brake 121, a left rear wheel electromechanical brake 131, and a right rear wheel electromechanical brake 141.

[0023] The plurality of wheel controllers 112, 122, 132, and 142 according to an embodiment of the present disclosure may be connected to the plurality of electromechanical brakes 111, 121, 131, and 141, respectively. For example, the plurality of wheel controllers 112, 122, 132, and 142 may include a left front wheel controller 112, a right front wheel controller 122, a left rear wheel controller 132, and a right rear wheel controller 142.

[0024] The plurality of wheel controllers 112, 122, 132 and 142 receive a braking command from the main controller 150 or the auxiliary controller 160 and generate a braking force using the respective electromechanical brakes 111, 121, 131 and 141. The plurality of wheel controllers 112, 122, 132 and 142 may perform braking by determining the braking force required for each wheel 110, 120, 130 and 140 without receiving a braking command from the main controller 150 or the auxiliary controller 160. In other words, the plurality of wheel controllers 112, 122, 132 and 142 may independently decide a braking command.

[0025] The main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 according to an embodiment of the present disclosure may each determine a self-status. Specifically, based on the pre-classified status information, the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 may each decide their self-status. Herein, the pre-classified status information includes the aforementioned normal status, function degraded status, and unfunctional status.

[0026] The function degraded status of the electromechanical brake apparatus means a status in which the electronic control unit may implement the function under the condition that the control requirement performance of the vehicle 100 is reduced. In other words, the function degraded status means a status in which the performance of any one of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 is lower than the performance of the normal status.

[0027] The unfunctional status of the electromechanical brake apparatus means a status in which the electronic control unit does not satisfy the condition that reduces the control requirement performance of the vehicle 100 or the function implementation is impossible.

[0028] The pre-classified status information of the electromechanical brake apparatus according to another embodiment of the present disclosure may also be classified by subdividing the function degraded status. For example, the subdivided function degraded status may include a first function degraded status and a second function degraded status. The subdivided function degraded status may prevent some possible functions from not being performed by simplifying and classifying the status information of the electronic control unit. In other words, the status of the electronic control unit may be subdivided and classified so that some functions of the electronic control unit are degraded and the remaining functions may be operated normally.

[0029] Each of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 according to an embodiment of the present disclosure may share the determined self-status information with the others via the first communication part 190 or the second communication part 191. This is to check for failures between different controllers, not internal failures of each electronic control unit. Specifically, the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 may define a characteristic signal that changes periodically and continuously transmit the defined characteristic signal to other controllers. This is because the status of one or more controllers that are determined to have failed to receive the characteristic signal may be assumed as an unfunctional status. Herein, the characteristic signal may be a fault detection signal for detecting a fault status of each electronic control unit.

[0030] For example, when one of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 is unfunctional, it may be identified when one thereof in which a fault has occurred may not transmit the characteristic signal to other controllers. Accordingly, it is desirable to process self-status information identified from the remaining normal statues with a higher priority than fault status information transmitted from one of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 that is not functioning.

[0031] The main controller 150 and the auxiliary controller 160 illustrated in FIG. 1 are illustrated as being configured as an integral part of a single module, but are not limited thereto. The main controller 150 and the auxiliary controller 160 may be configured in different modules and may be configured to be connected to each other.

[0032] The first power supply unit 170 and the second power supply unit 180 may supply power to the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142. For example, the first power supply unit 170 may configure a power line to supply power to the main controller 150, the left front wheel controller 112, and the right rear wheel controller 142. The second power supply unit 180 may configure a power line to supply power to the auxiliary controller 160, the right rear wheel controller 142, and the left rear wheel controller 132.

[0033] The first power supply unit 170 and the second power supply unit 180 according to an embodiment of the present disclosure may be connected to the plurality of wheel controllers 112, 122, 132, and 142 in an X-split structure. For example, in the event of a failure in either of the first power supply unit 170 and the second power supply unit 180, the structure is to secure an emergency braking force of the electromechanical brake for at least one of the front wheels 110 and 120 and at least one of the rear wheels 130 and 140. However, the configuration of the power lines of the first power supply unit 170 and the second power supply unit 180 is not limited thereto.

[0034] The first communication part 190 and the second communication part 191 are configured to transmit and receive information among the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142. For example, in the event of an abnormality in either of the first communication part 190 and the second communication part 191, the remaining one without the abnormality may be used to transmit and receive information within the vehicle 100. Herein, the first communication part 190 and the second communication part 191 are communications designed to communicate with each other between electronic control units within the vehicle 100. The first communication part 190 and the second communication part 191 may be, for example, a controller area network (CAN) or a Local CAN.

[0035] FIG. 2 is a table showing fail-safe modes designated based on pre-classified status information according to an embodiment of the present disclosure.

[0036] Referring to FIGS. 1 and 2, the method for controlling the fail-safe of the electromechanical brake apparatus according to an embodiment of the present disclosure may maintain a drivable status or perform emergency braking based on a pre-classified fail-safe mode.

[0037] The pre-classified fail-safe mode according to an embodiment of the present disclosure may be decided based on status information of each of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142. Each of the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 may be classified into one of a normal status (Normal in FIG. 2), a function degraded status (Degraded in FIG. 2), and an unfunctional status (Abnormal in FIG. 2).

[0038] The main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 may each independently determine the self-status. When the main controller 150, the auxiliary controller 160, and the plurality of wheel controllers 112, 122, 132, and 142 each determine the self-status, the self-status is determined based on a normal status, a function degraded status, and a unfunctional status without transmitting specific failure information.

[0039] Referring to the table in FIG. 2, the pre-designated fail-safe mode according to an embodiment of the present disclosure includes all or part of a first safe mode (Safe Model in FIG. 2) to a twelfth safe mode (Safe Mode12 in FIG. 2).

[0040] The first safe mode determines that the status of the main controller 150 is a function degraded status, and the auxiliary controller 160 takes over the control. When the first safe mode is activated, the auxiliary controller 160 may activate a limp-home mode to control the vehicle 100 to continue driving.

[0041] The second safe mode determines that the status of the main controller 150 is a unfunctional status, and the auxiliary controller 160 takes over the control. The auxiliary controller 160 may activate the limp-home mode to control the vehicle 100 to maintain a continuously drivable status.

[0042] The third safe mode determines that the status of the auxiliary controller 160 is a function degraded status, and the main controller 150 controls the driving of the vehicle 100. When the third safe mode is activated, the main controller 150 may activate the limp-home mode to control the vehicle 100 to continue driving.

[0043] The fourth safe mode determines that the auxiliary controller 160 is in an unfunctional status, and the main controller (150) controls the driving of the vehicle 100. The main controller 150 may activate the limp-home mode to control the vehicle 100 to maintain a continuously drivable status.

[0044] The first to fourth safe modes according to an embodiment initiate a fail-safe strategy of the vehicle 100 when either the main controller 150 or the auxiliary controller 160 is in a function degraded status or an unfunctional status. The first safe mode to the fourth safe mode may control the driving of the vehicle 100 by one of the main controller 150 or the auxiliary controller 160 in a normal status, which is in charge of control, determining a braking command and transmitting the determined braking command to the plurality of wheel controllers 112, 122, 132, and 142. Accordingly, the first safe mode to the fourth safe mode may continuously control the driving of the vehicle 100 by activating the limp-home mode.

[0045] For example, assuming a situation where the fourth safe mode is additionally activated in the vehicle 100 that is driving based on the second safe mode, a situation occurs in which the plurality of wheel controllers 112, 122, 132, and 142 may not receive braking commands from both the main controller 150 and the auxiliary controller 160. In this connection, even when both the second safe mode and the fourth safe mode are activated, the vehicle 100 may perform emergency braking of the vehicle 100 using the plurality of wheel controllers 112, 122, 132, and 142. This is because each of the plurality of wheel controllers 112, 122, 132, and 142 may generate an emergency braking force based on a preset braking force. Accordingly, since the second safe mode may generate an emergency braking force even when the fourth safe mode in which the auxiliary controller 160 is in an unfunctional status is activated, the limp-home mode may be activated to continue driving the vehicle 100.

[0046] This is not limited to the second safe mode, and may be equally applied when the fourth safe mode is activated. For example, assuming a situation in which the second safe mode is additionally activated in the vehicle 100 driving based on the fourth safe mode, in this connection, a preset braking force may also be generated from the plurality of wheel controllers 112, 122, 132, and 142. Since the fourth safe mode may generate an emergency braking force even when the second safe mode in which the main controller 150 is in an unfunctional status is activated, the limp-home mode may be activated to continue driving the vehicle 100.

[0047] In explaining an embodiment of the present disclosure, activating the limp-home mode to control the driving of the vehicle 100 means controlling the driving of the vehicle 100 with a lower control requirement performance than the control requirement performance in a normal status. Herein, the lower control requirement performance means limiting the speed of the vehicle 100 in a normal status or limiting the drivable operating time of the vehicle 100. However, the control requirement performance is not limited thereto, and may include various driving variables related to the driving of the vehicle 100.

[0048] The fifth to twelfth safe modes according to an embodiment disclose a fail-safe method based on a function degraded status or an unfunctional status of each of the plurality of wheel controllers 112, 122, 132, and 142.

[0049] The fifth, seventh, ninth, and eleventh safe modes according to an embodiment disclose a fail-safe method of the vehicle 100 when the left front wheel controller 112, the right front wheel controller 122, the left rear wheel controller 132, and the right rear wheel controller 142 are each in a function degraded status.

[0050] The fifth safe mode determines that the left front wheel controller 112 among the plurality of wheel controllers 112, 122, 132, and 142 is in a function degraded status, and activates the limp-home mode to continuously control the driving of the vehicle 100.

[0051] For example, when the left front wheel controller 112 is in a function degraded status, the left front wheel electromechanical brake 111 may not satisfy the braking force required from the main controller 150 or the auxiliary controller 160. Accordingly, the main controller 150 or the auxiliary controller 160 recalculates the braking force required for the vehicle 100 and transmits a braking command to the right front wheel controller 122, the left rear wheel controller 132, and the right rear wheel controller 142 that are determined to be in a normal status. Simultaneously, the main controller 150 or the auxiliary controller 160 may transmit a braking command to the left front wheel controller 112 whose function is degraded, and the left front wheel controller 1120 may generate a braking force lower than the previously required braking force. Accordingly, the fifth safe mode may continuously control the driving of the vehicle 100 by activating the limp-home mode.

[0052] The seventh safe mode, the ninth safe mode, and the eleventh safe mode according to an embodiment may be implemented in the same manner as the fifth safe mode described above. For example, the seventh safe mode, the nineth safe mode, and the eleventh safe mode may continuously control the driving of the vehicle 100 by activating the limp-home mode based on a lower requirement performance than a braking force in a normal status by using one of the functionally degraded wheel controllers and the remaining ones in a normal status among the plurality of wheel controllers 112, 122, 132, and 142, even when the right front wheel controller 122, the left rear wheel controller 132, and the right rear wheel controller 142 are determined to be in a function degraded status.

[0053] The sixth safe mode, the eighth safe mode, the tenth safe mode and the twelfth safe mode according to an embodiment disclose a fail-safe method of the vehicle 100 when each of the left front wheel controller 112, the right front wheel controller 122, the left rear wheel controller 132 and the right rear wheel controller 142 is in an unfunctional status.

[0054] The sixth safe mode determines that the left front wheel controller 112 among the plurality of wheel controllers 112, 122, 132 and 142 is in an unfunctional status, and only emergency braking of the vehicle 100 is possible using the right front wheel controller 122, the left rear wheel controller 132 and the right rear wheel controller 142.

[0055] For example, when the sixth safe mode is activated and the tenth safe mode is additionally activated, the left front wheel electromechanical brake 111 and the left rear wheel electromechanical brake 131 may not generate a braking force, and only the right front wheel electromechanical brake 121 and the right rear wheel electromechanical brake 141 may generate a braking force. In this connection, since the vehicle 100 may generate only a one-sided (right-side) braking force, a dangerous situation may occur in which the vehicle 100 deviates from the lane differently from the steering of a driver during emergency braking. Accordingly, it is preferable that the sixth safe mode or the tenth safe mode perform emergency braking of the vehicle 100 without activating the limp-home mode.

[0056] However, even when both the sixth safe mode and the tenth safe mode are activated and only one-sided braking of the vehicle 100 is possible, the limp-home mode may be activated to continuously control the driving of the vehicle 100 when cooperative control of the braking system and the steering system according to an embodiment is possible.

[0057] This is not limited to the sixth safe mode and the tenth safe mode, and may be equally applied even when the eighth safe mode and the twelfth safe mode are each activated.

[0058] For example, assuming a situation in which the twelfth safe mode is additionally activated in the vehicle 100 driving based on the eighth safe mode, in this connection, the vehicle 100 may generate only an one-sided (left-sided) braking force using the left front wheel electromechanical brake 111 and the left rear wheel electromechanical brake 131, which may result in a dangerous situation in which the vehicle 100 deviates from the lane in emergency braking, unlike the steering of a driver. Accordingly, it is preferable that the eighth safe mode or the twelfth safe mode perform emergency braking of the vehicle 100 without activating the limp-home mode. However, even in a situation in which only one-sided braking of the vehicle 100 is possible due to the eighth safe mode and the twelfth safe mode being activated, when cooperative control of the braking system and the steering system according to an embodiment is possible, the driving of the vehicle 100 may be continuously controlled by activating the limp-home mode.

[0059] FIG. 3 is a flowchart showing a method for controlling fail-safe of an electromechanical brake apparatus according to an embodiment of the present disclosure.

[0060] Referring to FIGS. 1 to 3, based on the pre-classified status information, the plurality of wheel controllers 112, 122, 132, and 142, the main controller 150, and the auxiliary controller 160 decide the respective self-status (S300).

[0061] Each of the plurality of wheel controllers 112, 122, 132, and 142, the main controller 150, and the auxiliary controller 160 share the respectively decided self-status information with the others (S310). Part or all of the first communication part 190 connected to the plurality of wheel controllers 112, 122, 132 and 142 from the main controller 150 and the second communication part 191 connected to the plurality of wheel controllers 112, 122, 132 and 142 from the auxiliary controller 160 may be used to share the self-status information with each other.

[0062] Based on the shared self-status information among the plurality of wheel controllers 112, 122, 132 and 142, the main controller 150, and the auxiliary controller 160, each of the plurality of wheel controllers 112, 122, 132 and 142, the main controller 150, and the auxiliary controller 160 may determine the statuses of the others (S320). The plurality of wheel controllers 112, 122, 132 and 142, the main controller 150 and the auxiliary controller 160 may each define a characteristic signal that changes periodically and continuously transmit the defined characteristic signal with each other. The status of one or more controllers that are determined to have failed to receive the characteristic signal may be assumed as an unfunctional status.

[0063] Based on the status information of each of the plurality of wheel controllers 112, 122, 132, and 142, the main controller 150, and the auxiliary controller 160, a pre-designated fail-safe mode is activated (S330). When either the main controller 150 or the auxiliary controller 160 is determined to be in a function degraded status or an unfunctional status, the remaining one of the main controller 150 or the auxiliary controller 160 in a normal status may continue driving based on the emergency braking or limp-home mode of the vehicle 100. For example, when the main controller 150 is in an unfunctional status, the auxiliary controller 160 may control the driving of the vehicle 100 based on the low control requirement performance of the main controller 150.

[0064] When any one of the plurality of wheel controllers 112, 122, 132 and 142 is determined to be in a function degraded status or an unfunctional status, the remaining ones in a normal status among the plurality of wheel controllers 112, 122, 132 and 142 may receive an emergency braking command and control the driving of the vehicle 100.

[0065] The emergency braking or driving of the vehicle 100 is performed based on a pre-designated fail-safe mode (S340).

[0066] Each element of the apparatus or method in accordance with the present invention may be implemented in hardware or software, or a combination of hardware and software. The functions of the respective elements may be implemented in software, and a microprocessor may be implemented to execute the software functions corresponding to the respective elements.

[0067] Various embodiments of systems and techniques described herein can be realized with digital electronic circuits, integrated circuits, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), computer hardware, firmware, software, and/or combinations thereof. The various embodiments can include implementation with one or more computer programs that are executable on a programmable system. The programmable system includes at least one programmable processor, which may be a special purpose processor or a general purpose processor, coupled to receive and transmit data and instructions from and to a storage system, at least one input device, and at least one output device. Computer programs (also known as programs, software, software applications, or code) include instructions for a programmable processor and are stored in a computer-readable recording medium.

[0068] The computer-readable recording medium may include all types of storage devices on which computer-readable data can be stored. The computer-readable recording medium may be a non-volatile or non-transitory medium such as a read-only memory (ROM), a random access memory (RAM), a compact disc ROM (CD-ROM), magnetic tape, a floppy disk, or an optical data storage device. In addition, the computer-readable recording medium may further include a transitory medium such as a data transmission medium. Furthermore, the computer-readable recording medium may be distributed over computer systems connected through a network, and computer-readable program code can be stored and executed in a distributive manner.

[0069] Although operations are illustrated in the flowcharts/timing charts in this specification as being sequentially performed, this is merely an exemplary description of the technical idea of one embodiment of the present disclosure. In other words, those skilled in the art to which one embodiment of the present disclosure belongs may appreciate that various modifications and changes can be made without departing from essential features of an embodiment of the present disclosure, that is, the sequence illustrated in the flowcharts/timing charts can be changed and one or more operations of the operations can be performed in parallel. Thus, flowcharts/timing charts are not limited to the temporal order.

[0070] Although exemplary embodiments of the present disclosure have been described for illustrative purposes, those skilled in the art will appreciate that various modifications, additions, and substitutions are possible, without departing from the idea and scope of the claimed invention. Therefore, exemplary embodiments of the present disclosure have been described for the sake of brevity and clarity. The scope of the technical idea of the present embodiments is not limited by the illustrations. Accordingly, one of ordinary skill would understand that the scope of the claimed invention is not to be limited by the above explicitly described embodiments but by the claims and equivalents thereof.