METHOD FOR OPERATING A BRAKING SYSTEM OF A VEHICLE, AND BRAKING SYSTEM

Abstract

A method for operating a braking system of a vehicle, wherein the braking system comprises a primary hydraulic braking system and a brake actuation unit hydraulically decoupled from the primary braking system. The brake actuation unit comprises at least two sensor arrangements which are configured to detect, independently of one another, actuation information of the brake actuation unit describing a brake request. The method comprises determination of a first actuation information by a first of the sensor arrangements, determination of a second actuation information by a second of the sensor arrangements, checking whether the respective determined actuation information is valid, and if the actuation information is valid, checking whether the determined items of actuation information are mutually plausible, and implementation of the brake request according to the actuation information and/or issue of a warning and/or performance of a predefined braking maneuver by the braking system depending on the validity and plausibility of the actuation information.

Claims

1. A method for operating a braking system of a vehicle, wherein the braking system comprises a primary hydraulic braking system and a brake actuation unit hydraulically decoupled from the primary braking system, wherein the brake actuation unit comprises at least two sensor arrangements which are configured to detect, independently of one another, actuation information of the brake actuation unit describing a brake request, the method comprising: determining a first actuation information by a first of the sensor arrangements; determining a second actuation information by a second of the sensor arrangements; checking whether the respective determined actuation information is valid; if the actuation information is valid, checking whether the determined items of actuation information are mutually plausible; and implementing the brake request according to the actuation information and/or issue of a warning and/or performance of a predefined braking maneuver by the braking system depending on the validity and plausibility of the actuation information.

2. The method as claimed in claim 1, characterized in that the braking system comprises a secondary hydraulic braking system, wherein the first sensor arrangement is connected to the primary braking system and the second sensor arrangement is connected to the secondary braking system for data transmission and/or signal transmission.

3. The method as claimed in claim 2, characterized in that the secondary braking system is configured so as, on failure of the primary braking system, to decelerate the vehicle according to a brake request determined from the second actuation information.

4. The method as claimed in claim 3, characterized in that the primary braking system and the secondary braking system are connected together for data transmission, and are configured to exchange with one another actuation information received from the sensor arrangements.

5. The method as claimed in claim 4, characterized in that the primary braking system or the secondary braking system comprises a third sensor arrangement for determining the braking moment produced by the primary braking system, wherein the secondary braking system is configured to read the sensor information determined by the third sensor arrangement.

6. The method as claimed in claim 5, characterized in that on an interruption of communication with the primary braking system, the secondary braking system checks whether the sensor information matches a brake request determined from the second actuation information, wherein in the case that the sensor information does not match the brake request determined from the second actuation information, the secondary braking system implements the brake request derived from the second actuation information.

7. The method as claimed in claim 1, characterized in that if both items of actuation information are valid and plausible, the brake request is derived only from the first actuation information.

8. The method as claimed in claim 1, characterized in that the brake request is determined from the first and the second actuation information, wherein a weighting of the first and second actuation information, on determination of the brake request, depends on the intensity of the brake request.

9. The method as claimed in claim 1, characterized in that the validity of an actuation information is determined from a sensor-specific characteristic curve function.

10. The method as claimed in claim 1, characterized in that the plausibility of the actuation information is determined in that it is checked whether a brake request derived from the first actuation information lies within an established tolerance around a brake request derived from the second actuation information.

11. The method as claimed in claim 1, characterized in that the tolerance depends on measurement tolerances of the sensor arrangements and/or sensor-specific characteristic curve functions.

12. The method as claimed in claim 1, characterized in that the first sensor arrangement derives an actuation information from a first physical measurement parameter, and the second sensor arrangement derives an actuation information from a second physical measurement parameter, wherein the first physical measurement parameter differs from the second physical measurement parameter.

13. A braking system for a vehicle with a primary hydraulic braking system and a brake actuation unit hydraulically decoupled from the primary braking system, wherein the brake actuation unit comprises at least two sensor arrangements which are configured to detect, independently of one another, actuation information of the brake actuation unit describing a brake request, wherein the primary braking system and the brake actuation unit are configured to perform the method as claimed in claim 1 or any of claims 7 to 12.

14. The braking system as claimed in claim 13, characterized in that the braking system comprises a secondary hydraulic braking system, wherein the first sensor arrangement is connected to the primary braking system and the second sensor arrangement is connected to the secondary braking system for data transmission, and wherein the primary braking system and/or the secondary braking system is configured to perform the method as claimed in any of claims 1 to 12.

15. The braking system as claimed in claim 14, characterized in that the primary braking system comprises a third sensor arrangement for determining the braking moment produced by the primary braking system, wherein the secondary braking system is configured to read the sensor information determined by the third sensor arrangement.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Preferred embodiments are explained in more detail below on the basis of the drawings, in which:

[0043] FIG. 1 is a schematic illustration of a braking system;

[0044] FIGS. 2A, 2B, and 2C are schematic illustrations of a brake actuation unit with various sensor arrangements,

[0045] FIG. 3 is a schematic illustration of the connection between the primary braking system and secondary braking system, and

[0046] FIG. 4 is a function diagram to illustrate the information structure.

DETAILED DESCRIPTION OF THE EMBODIMENTS

[0047] In the text which follows, features that are similar or identical are denoted by the same reference signs.

[0048] In one embodiment, the object formulated initially is achieved by the combination of a redundant braking system with a brake actuating unit, preferably configured as an electronic brake pedal, for detection of a driver's request.

[0049] This architecture is also suitable for modular vehicle concepts in which the chassis and superstructure can be combined in various ways and are only connected by electrical interfaces.

[0050] A redundant on-board network is advantageous for use of this architecture, i.e. an independent electrical power supply to the main and back-up braking systems (primary and secondary braking systems) and the respective connected sensors or sensor arrangements for detecting the driver's request or detecting an actuation information of the brake actuation unit describing a brake request. The brake actuation unit is hydraulically/mechanically decoupled from the primary braking system and secondary braking system. This is explained below in detail with reference to FIG. 1.

[0051] FIG. 1 shows an exemplary embodiment of the proposed architecture of a braking system 100 based on a redundant architecture with a primary braking system 102 (PBS) and a secondary braking system 104 (SBS), wherein the secondary braking system 104 is arranged downstream of the primary braking system 102. The braking systems PBS and SBS may be both (electro-) hydraulic braking systems or also electromechanical braking systems. The two braking systems 102 and 104 each have assigned electronic control units (PBS ECU 106 and SBS ECU 108), and are each supplied with power via separate power supplies (B1 or Power Supply 1 110, B2 or Power Supply 2 112). For reasons of clarity, the connections between the power supplies 110 and 112 and the supplied elements of the braking system 100 are not shown. Rather, the respective letters B1 and B2 indicate which elements are supplied from which power supply 110 (B1) or 112 (B2).

[0052] The primary braking system 102 is directly connected to the wheel brakes 116 and 118 of a rear axle of the vehicle. The connection between the primary braking system 102 and the wheel brakes 120 and 122 of the front axle of the vehicle is provided indirectly via the secondary braking system 104. It is preferably provided that a brake pressure provided by the primary braking system 102 for the wheel brakes 120 and 122, in normal operation of the braking system 100, is conducted unchanged through the secondary braking system 104 to the wheel brakes 120 and 122. Only in the event of a fault in the braking system 100, as will be explained below, does the secondary braking system 104 take over the provision of pressure for the wheel brakes 120 and 122 of the front axle.

[0053] The wheel brakes 116 and 118 of the rear axle are furthermore each equipped with an integrated parking brake (IPB), wherein both parking brakes can each be controlled by both control units 108 and 106.

[0054] Furthermore, there is a communication connection 124 between the control unit 106 of the primary brake circuit 102 and the control unit 108 of the secondary brake circuit 104, for example via a correspondingly configured data bus.

[0055] The primary braking system 102 with the control unit 106 is preferably physically separated from the secondary braking system 104 with the control unit 108.

[0056] In order to detect a brake request by a vehicle driver, the braking system 100 comprises the brake actuation unit 114. The brake actuation unit 114, preferably configured as an electronic brake pedal (E pedal), comprises a pedal interface, preferably a pedal force simulator, and at least two independent sensors for detecting pedal actuation, i.e. detecting the driver's brake request. Exemplary actuation arrangements are shown in FIGS. 2 and 3. As well as a brake request triggered by the vehicle driver, a brake request may also be triggered by a driving function, such as for example autopilot (“virtual driver”). Such brake requests are transmitted by the corresponding interface directly to the two control units 106 and 108.

[0057] Different variants of brake actuation units 114 will now be described below with reference to FIGS. 2A-C. A common feature of the brake actuation units 114 is that they each have at least a first sensor arrangement 126 and a second sensor arrangement 128 which are configured to detect, independently of one another, a brake request on the basis of an actuation of a brake pedal 130 and to determine a corresponding actuation information. The two sensor arrangements 126 and 128 of the brake actuation units 114 are preferably each inherently safe, i.e. a faulty signal is recognized. The precise safety requirements can be derived from a risk analysis in the actual application, but in general the starting point should be an ASIL D requirement according to ISO 26262. This in turn means that the two sensors or sensor arrangements 126 and 128 must each contain redundant signal paths. Furthermore, the brake actuation units 114 each have a pedal force simulator 134 which is configured, on actuation of the brake pedal 130, to apply a force to the brake pedal 130 which is directed against the actuation of the brake pedal 130 and imitates a conventional hydraulic braking system in its force-travel behavior.

[0058] In order to avoid common mode faults, e.g. simultaneous failure of both sensor arrangements 126 and 128 because of the same electromagnetic radiation, preferably diverse measurement principles are applied.

[0059] Here, FIG. 2A shows an exemplary embodiment of a brake actuation unit 114 with redundant travel and angle sensors. For example, the travel sensor (s) is considered the primary (first) sensor arrangement 126, and the angle sensor (α) the secondary (second) sensor arrangement 128.

[0060] A redundant sensor or redundant sensor arrangement in the context of this invention means an arrangement in which either the signal detection or the signal transmission, or both the signal detection and the signal transmission, are carried out multiple times, at least however twice.

[0061] Alternatively, as shown in FIG. 2B, a secondary driver's request signal or corresponding actuation information may also be derived from the pedal force (F) by means of a corresponding sensor arrangement 126′. Force measurement may be advantageous for functional reasons, since usually a better resolution is achieved for high values of the driver's request (“steep curve branch”). Force sensors are not commonly used in the automotive sector, but one possibility of indirect measurement lies in the detection of a hydraulic pressure, wherein the E-pedal assembly then comprises hydraulic components (“wet simulator”), which may be undesirable. Advantageously, only dry components are used in the vehicle superstructure, and hydraulics are used only in the chassis. A corresponding design of a brake actuation unit 114 with a pressure sensor 132 is shown in FIG. 2C. Here, the pressure sensor 132 is configured as an additional sensor arrangement to the angle sensor 128″ and the travel sensor 126′.

[0062] The operating concept or method described below for operating the above-described braking system 100 is generic in approach, i.e. not based a specific technical design of the sensors. However, the architectural assumption is made that a primary (first) sensor arrangement 126 (e.g. piston rod travel sensor) is connected to the primary braking system 102 (PBS), and a secondary sensor arrangement 128 (e.g. pedal angle sensor) is connected to the secondary braking system 104 (SBS).

[0063] Furthermore, the presence of a communication interface 124 (PBS-SBS COM) between the primary braking system 102 (PBS) and the secondary braking system 104 (SBS), and an independent electrical power supply 110 and 112 to all primary and secondary assemblies, are assumed. FIG. 4 illustrates the basic generic architectural approach.

[0064] Based on this architecture, both driver's request sensor signals (actuation information) are available in the electronic control units 106 and 108 (SBS ECU, PBS ECU) of both braking systems 102 and 104. This applies both to the signal values for the first actuation information PDBRS 200 (Primary Driver Brake Request Signal), the second actuation information SDBRS 202 (Secondary Driver Brake Request Signal) and also their validity flags (validity markers) PDBRS_Valid, SDBRS_Valid, which are determined in a first processing step 204 or 206.

[0065] These validity flags assume the value “True” if the respective signal on the processing control unit was detected as valid, otherwise the value “False”.

[0066] Thus, a respective primary driver brake request PDBR (first brake request) and a secondary driver brake request SDBR (second brake request) can be formed in the processing logic of the two control units 106 and 108.

[0067] This calculation takes place in step 208 or 210 by use of a primary (sensor-specific) characteristic curve function PF on the primary driver brake request signal, and a secondary (sensor-specific) characteristic curve function SF on the secondary driver brake request signal, i.e.

PDBR=PF(PDBRS)

SDBR=SF(SDBRS)

[0068] Insofar as both signals are valid, i.e.

PDBRS_Valid==True && SDBRS_Valid==True,

in step 212, an additional plausibility check is applied which checks whether the deviation between the primary and secondary driver brake requests lies within the expected tolerances.

[0069] This additional monitoring level may ensure that unexpected error modes, which occur despite the security of the necessary integrity level (ASIL requirements), are picked up.

[0070] The table below defines how the resulting driver's brake request is advantageously formed depending on the validity of the individual signals and the result of the plausibility monitoring.

TABLE-US-00001 PDBR <-> SDBR # PDBRS_Valid SDBRS_Valid Plausible DBR Result Comments 1 yes yes yes DBR = Normal operation PDBR 2 yes no n/a DBR = Brake warning light PDBR on. Redundancy no 3 no yes n/a DBR = longer exists. SDBR Risk avoidance at vehicle level recommended 4 yes yes no DBR = 2.44 m/s.sup.2 Brake warning light on. Critical fault. 5 no no n/a DBR = 2.44 m/s.sup.2 Vehicle should be stopped immediately.

[0071] In fault-free normal operation, case #1 of the table, both signals are valid and also mutually plausible. The deviation between the calculated primary and secondary brake requests is thus less than a threshold value which arises from the tolerances of the sensors and the different functions PF, SF.

[0072] In normal operation, the resulting brake request is then derived e.g. only from the primary sensor in step 214.

[0073] If functional reasons, e.g. a better resolution of the secondary signal for high values of the brake request, support its use, alternatively a blending between the primary and secondary driver brake request may be implemented in step 214.

[0074] As soon as one of the sensor signals is invalid, cases #2 and #3 of the table, the resulting driver's brake request is preferably calculated from the remaining valid signal in step 214. In these cases, there is no further redundancy level available within the braking system, so the driver is preferably informed via a brake warning light.

[0075] It is then the driver's responsibility to decide whether to continue or to end driving with a red warning light. It may however also be part of the overall safety concept at vehicle level to minimize the risks of further travel by measures such as [0076] limiting the maximum vehicle speed [0077] limiting the maximum acceleration capacity [0078] activating an increased engine drag torque or generator braking moment on release of the driving pedal.

[0079] Case #4 addresses the unexpected situation that a plausibility discrepancy is established between the primary and secondary driver brake requests, even though both sensor arrangements 126 and 128 give a valid signal. In this case, preferably a default driver request is generated and the vehicle is brought to a standstill with a predefined braking force.

[0080] In order at the same time not to infringe safety targets against under-braking and over-braking, for this preferably braking is carried out at 2.44 m/s.sup.2.

[0081] The same strategy may also be applied in case of doubt, case #5, i.e. if both driver request sensors fail (successively).

[0082] The block diagram shown in FIG. 4 indicates an exemplary implementation of an operating concept for forming the driver's request on the electronic control units of the primary and secondary braking systems. The processing logic here is the same for both systems, but should however preferably be implemented differently in order to fulfil the requirement for software diversity.

[0083] The interruption of communication between the primary and secondary brake control units can be regarded as a special case.

[0084] If the primary control unit 106 (PBS ECU) detects the loss of communication with the secondary control unit 108 (SBS ECU), this corresponds to case #2 of the table, i.e. the second actuation information on the primary control unit 106 is invalid. The primary brake control unit 106 will however continue to detect the primary driver brake request from the first actuation information and implement this.

[0085] If the secondary control unit 108 detects the loss of communication with the primary control unit 106, two scenarios are possible: [0086] a) there is an interruption in communication, but the primary braking system 102 is intact and continues to implement the driver's brake request. [0087] b) the primary braking system 102 has failed.

[0088] In order to distinguish between these two scenarios, the secondary braking system 104 preferably monitors the primary braking system 102.

[0089] Here, the secondary braking system 104 preferably uses internal sensors to detect the braking moment actually applied (third sensor arrangement). For example, this third sensor arrangement is a pressure sensor of the primary braking system 102 or secondary braking system 104.

[0090] The braking moment actually applied is compared with the secondary driver brake request calculated within the secondary braking system 104. If it is found that the brake request is not implemented or only implemented insufficiently, i.e. scenario b) is present, preferably the secondary braking system 104 is active and carries out the calculated brake request.

[0091] Preferably, a system approach and operating concept which have no hydraulic fallback level are proposed for a system using the brake-by-wire principle.

[0092] Thus advantageously, application cases of automated driving are supported, wherein even in the event of a fault, the decoupling of the brake pedal 130 is maintained.

[0093] Advantageously, vehicle concepts with modular suspension/superstructure design are simplified by the omission of mechanical interfaces.