Field of the invention

[001] The present invention relates to autonomous drive by wire vehicles and robots, and in particular emergency braking by activation of braking by wire.

Background

[002] Like most of the existing technology in autonomous driving vehicle, the safety system on an autonomous vehicle will perform emergency braking once a critical failure or error is detected. And in the worst-case scenario, the power to the motor and control systems will be cut off to prevent the motor from driving the vehicle any further. However, this does not actively stop a moving vehicle in the emergency. Instead, the vehicle will then roll until friction consumes all the momentum. If the vehicle is on a decline, the vehicle will be accelerated toward the downhill due to the gravity. A similar situation, but in reverse, could occur when on an incline.

[003] This is not a critical issue for most of the known autonomous vehicles as there will be always options for human on board to perform emergency action through existing mechanical or electrical linkage to the actuation. However, for an unmanned/unsupervised autonomous security vehicle, there will be neither any human interface preserved on vehicle anymore, nor any human operator around the vehicle to perform such action.

[004] The presented invention has been developed so as to attempt to address this problem.

[005] In this specification, reference to any prior art in the specification is not and should not be taken as an acknowledgement or any form of suggestion that this prior art forms part of the common general knowledge in Australia or any other jurisdiction or that this prior art could reasonably expected to be combined by a person skilled in the art.

Summary of the Invention

[006] To address this issue, there is provided an integrated redundant backup solution to the power supply of actuation system particularly for a brake-by-wire system, which ensures a full emergency braking will be performed when there is a failure in main power supply. The backup power will be more than enough to bring the brake into its full braking position. A gear mechanism can lock the position in place to prevent any rolling after running out the backup power. The vehicle can be deployed in a dynamic environment with potential for human interaction. This solution minimises impact of failure associated to one of the most critical components on the vehicle, being the batteries.

[007] According to a first aspect there is provided an autonomous vehicle comprising: a main power source; an independent backup power source; a brake which applies a braking force for stopping the vehicle when a brake signal is received by the brake, the brake operating by an electrical actuator being supplied with electrical power from either of the main power source or the backup power source; and a decision system which decides when to send the brake signal to the brake, the decision system decides to send the brake signal when a mission of the vehicle requires braking of the vehicle and the decision system decides to send the brake signal when the main power source drops below a trigger amount or there is a failure in the main power source.

[008] In an embodiment, the backup power source supplies electrical power to the electrical actuator when the decision system sends the brake signal to the brake because the main power source drops below the trigger amount.

[009] In an embodiment, the decision system also decides to send the brake signal when one or more emergency stop conditions are met. In an embodiment, the backup power source supplies electrical power to the electrical actuator when the decision system sends the brake signal to the brake because one or more of the emergency stop conditions are met.

[0010] In an embodiment, the decision system comprises: a) a first sub-system for deciding when to brake according to mission requirements and which activates the brake when required with the main power source; and b) an independent second sub-system for deciding when to brake when the main power source drops below the trigger amount or there is the failure in the main power source and which activates the brake when required with the backup power source. This means that the power requirement of the second sub-system can be less that the first sub-system. [0011] In an embodiment the second sub-system is configured to only deal with the cases in which it needs to decide to brake. This means that the design of the second sub-system can be simpler and can also reduce the points of failure.

[0012] In an embodiment, the main power source comprises a reverse current protection circuit.

[0013] In an embodiment, the backup power source comprises a reverse current protection circuit.

[0014] In an embodiment, the main power source inclusive of its reverse current protection circuit and the backup power source inclusive of its reverse current protection circuit are connected to the electrical actuator of the brake.

[0015] In an embodiment, the main power source comprises a voltage level monitor circuit. In an embodiment the decision system decides that the main power source drops below the trigger amount when the voltage level monitor circuit experiences a sudden drop in voltage of more than a predetermined amount.

[0016] In an embodiment, the backup power source comprises a voltage level monitor circuit. In an embodiment the decision system decides that there is an emergency stop condition when the voltage level monitor circuit of the backup power source drops a threshold voltage, which in an embodiment is a predetermined amount.

[0017] In an embodiment, the vehicle comprises a roll prevention mechanism that prevents un-powered rolling movement of the vehicle from stationary should power from the backup power source eventually fail. In an embodiment, the roll prevention mechanism comprises a gear mechanism with a gear ratio from a drive motor to a wheel that requires too much torque from the wheel to overcome mechanical resistance in the motor (including friction in the motor) to allow rotation of the motor.

[0018] In an embodiment the brake comprises a brake cable activated by an actuator and which is connected to a brake system that applies the braking force to a wheel. In an embodiment the brake system comprises a drum brake or a disc brake.

[0019] According to a second aspect there is provided a method of activation of an emergency brake on an autonomous vehicle comprising: providing a main power source; providing an independent backup power source; providing a brake which applies a braking force for stopping the vehicle when a brake signal is received by the brake, the brake operating by an electrical actuator being supplied with electrical power from either of the main power source or the backup power source; and providing a decision system which decides when to send the brake signal to the brake, the decision system decides to send the brake signal when a mission of the vehicle requires braking of the vehicle and the decision system decides to send the brake signal when the main power source drops below a trigger amount; experiencing the main power source dropping below the trigger amount; deciding to send the brake signal to the brake.

[0020] In an embodiment the brake is actuated by use of the backup power source.

[0021] According to a third aspect there is provided a method of activation of an emergency brake on an autonomous vehicle comprising: monitoring a main power source for it to drop below a trigger amount; activating a brake of the vehicle when the main power source dropped below the trigger amount, wherein the brake is actuated by use of an independent backup power source.

[0022] In an embodiment, the brake is actuated by sending a brake signal to the brake, the brake signal also being send to the brake when a mission of the vehicle requires the vehicle to brake.

[0023] In this specification, the term ‘comprises’ and its variants are not intended to exclude the presence of other integers, components or steps.

[0024] The present invention will now be more fully described with reference to the accompanying Examples and drawings. It should be understood, however, that the description following is illustrative only and should not be taken in any way as a restriction on the generality of the invention described above.

Brief Description of Drawings

[0025] In order to provide a better understanding of the present invention preferred embodiments will now be described with reference to the accompanying drawings, in which: [0026] Figure 1 is a block diagram of a system of an embodiment of the present invention; and

[0027] Figure 2 is a flow diagram of a method of an embodiment of the present invention.

Detailed Description of Embodiments of the Invention

[0028] Referring to Figure 1 , there is shown a braking system 10 for a drive by wire autonomous vehicle (which itself is a brake by wire system) with integrated redundant backup braking.

[0029] The main braking components of the system 10 comprise a main power source 12, which typically will also be the primary power source of the vehicle, a decision system 20 comprising an electronic stopping circuit 20 and a brake comprising a brake actuator 22. The decision system 20 decides when the vehicle should stop according to when a mission of the vehicle requires braking of the vehicle. When that decision is made, the electronic stopping circuit 22 powers the actuator 24 with the main power source 12 to apply a braking force.

[0030] The decision system 20 may comprise a high-level autonomous vehicle controller, or it may receive lower level commands from an autonomous vehicle controller. The decision system 20 may decide on the rate of braking, which causes the electronic stopping circuit 22 to control the braking force applied by the actuator 24 to the brake.

[0031] Additionally, there is a voltage level monitor 14 which monitors the voltage output from the main power source 12. Typically, the main power source 12 is a bank of rechargeable batteries that should during normal operation supply a substantially constant level of voltage output, even in high current demand situations. If the main power source is not able to provide the substantially constant level of voltage output then this is an indication that the charge in the batteries is near exhaustion, at least for operational purposes or there is some fault causing this situation.

[0032] A main power source health status monitoring means 16 may be implemented by software which monitors the voltage from the voltage level monitor 14. This can determine how the battery is aging, its recharge capacity as it ages and when the battery might need replacement. The decision system 20 monitors the battery health status.

[0033] There may also be a charging circuit 18 for recharging the main power source 12. This may comprise a generator for converting kinetic energy from movement in the vehicle to electrical energy for energy recovery and conservation purposes, including as a main brake of the vehicle, where the brake actuator 24 is only used when energy recovery does not provide sufficient or ongoing braking force.

[0034] The main power source 12 may be provided with reverse protection circuit 30 to prevent reverse current flow in an unwanted situation.

[0035] The backup braking system integrates with the main braking components of the system 10. The backup braking system comprises an independent backup power source 40 and the decision system 20 also circuitry/logic that decided to send a signal to the electronic stopping circuit 22 to cause the actuator 24 to apply a braking force in an emergency condition. In an embodiment, the decision system 20 comprises decision sub-system A may be a high level control processor for deciding when to brake according to mission requirements and which activates the brake when required with the main power source; and decision sub-system B, which may be a low level logic control circuit for deciding when to brake when the main power source drops below the trigger amount or there is the failure in the main power source and which activates the brake when required with the backup power source. Decision sub-system A is independent from decision sub-system B. Decision subsystem B can operate even if the main power is lost and decision sub-system A is powered off. This means that the power draw requirement of sub-system B can be less that subsystem A and indeed sub-system B may only be powered by the backup power. In an embodiment, sub-system B is configured to only deal with the cases in which it needs to decide to brake. This means that the design of the second sub-system can be simpler and can also reduce the points of failure.

[0036] Primarily that emergency condition is when the main power source is failing, or has a fault (which may be indicated as a fast drop in its voltage). In that case the decision system 20 uses the backup power source 40 to actuate the actuator 24 to stop the vehicle. This will override the mission. Preferably the braking force applied is as much as necessary to safety stop the vehicle in as short a time as possible, or more simply it may be the maximum force.

[0037] The backup power source 40 must be capable of supplying sufficient energy as high inrush current to drive the brake actuator upon failure of the main power source 12. The backup power source 40 comprises a reverse protection circuit 46 which prevents reverse current flow to the backup power source in an unwanted situation.

[0038] Additionally, there is a backup power source voltage level monitor 42 which monitors the voltage output from the backup power source 40. Typically, the backup power source 40 is a capacitor or battery(ies) that can provide sufficient power to handle an emergency situation. The backup power source 40 may be kept charged by the charging circuit 18. However, if the backup power source 40 voltage level drops or does not charge as required/expected, this may be regarded as an emergency situation and the vehicle may be caused to stop. This may be monitored by a backup power source health status monitoring means 44, which may be implemented by software or hardware which monitors the voltage from the voltage level monitor 42. The backup power is sufficient to bring the brake into its full braking position.

[0039] In a preferred embodiment, a gear mechanism prevents the vehicle from moving further once it has come to a stop.

[0040] In an embodiment, the decision system 20 is also configured to decide to activate the brake in one or more other emergency stop conditions.

[0041] The reverse current protection module 30 prevents high inrush current flow back from the backup power source 40 into main power source 12 when its voltage level drops.

[0042] Referring to Figure 2, there is shown a method 100 of activation of an emergency brake on an autonomous vehicle which starts at step 102 when the autonomous vehicle is started. There is a check 104 to ensure both the main power source 12 and the backup power source 40 are sufficiently charged. If not, path 120 is followed and the vehicle enters a shutdown mode 122.

[0043] If both are sufficiently charged, path 106 is followed. The system boots into an idle mode at 108. The system then starts operation 110 to follow its mission. A check 112 is then performed by the decision system 20 to determine whether the main power source is higher than a threshold level (not dropped to or below the threshold level). If the main power source 12 is above the threshold level, then operation continues at 114 and the operation of the vehicle continues (back to 110).

[0044] However, If the main power source 12 is (at or) below the threshold level then the emergency stop process is commenced 118 using the backup power source 40 to actuate the brake as described above, and then the vehicle is shut down at 112.

[0045] The present invention requires no human control interface on vehicle or human supervision to aid on a system failure (either locally or remotely). This invention focuses on redundancy at subsystem level of a fully autonomous drive-by-wire system, in particular for the brake-by-wire system, rather than provide redundancy as secondary vehicle battery for entire on-vehicle system, which is way more cost efficient while still providing same level of safety.

[0046] Modifications and variations as will be apparent to the skilled addressee are intended to fall within the scope of the present invention.