Method for controlling a motor vehicle brake system with high safety requirements

Abstract

The invention relates to a method for controlling a motor vehicle brake system with high safety requirements. The invention also relates to an electronically commutated electric motor which is configured to carry out the method of the invention, and to a brake system for a motor vehicle which comprises such an electric motor.

Description

Technical Field

[0001] This invention relates to a method for controlling a motor vehicle braking system with high safety requirements. The invention also relates to an electronically commutated motor of the braking system configured to perform the method of the invention, and a braking system for a motor vehicle comprising such a motor. Background Technology

[0002] In modern motor vehicles, electronically commutated motors are used in various ways, such as as permanent magnet synchronous motors (PMSMs). The motor may consist of a stator and a rotor, with the rotor supported in the stator. Such motors are typically powered by an onboard energy storage device that provides DC voltage. A multiphase (typically three-phase) output current can be generated by a converter / inverter (e.g., a B6 bridge), which can be fed to the stator windings of the motor to generate a rotating magnetic field that causes the rotor to rotate. The rotor can be constructed accordingly as a permanent magnet. The phases of the three-phase AC power generated by the converter and the associated rotating magnetic field are also referred to herein as motor phases.

[0003] For control and regulation, field-oriented current regulation, also known as vector control, can be used. This type of current regulation requires the current rotor position, which is typically acquired by a suitable sensor used to determine that position. To this end, the current is transformed into the rotor's rotating reference frame using the current rotor position, resulting in a field-weakening d-axis current and a torque-generating q-axis current, which can be easily regulated.

[0004] To determine the current rotor position, a rotary position measurement system exists, which allows the determination of the rotor's orientation or position within the stator. To measure the rotor position signal, a corresponding rotor position sensor can be used. The contact system used in these rotor position sensors is typically based on uninterrupted electrical contact to ensure safe operation of the regulator. However, when using rotor position sensors, the following situations may occur: the required contact system may develop a state of electrical contact under special loads such as high temperatures, or due to mechanical stress, dynamic effects, or aging in the components. In this state, short-term resistance fluctuations or even contact interruptions cannot be completely eliminated. Consequently, at least in some cases, the sensor signal used to determine the rotor position may no longer be present, or the sensor signal may be distorted.

[0005] However, in order to regulate the motor, especially regarding its driving torque and the resulting speed or position, it is essential to know the precise rotor position or rotor orientation so that the output current of each phase can be controlled accordingly, or the motor phase can be powered at the appropriate time.

[0006] When rotor position information is not available from a rotor position sensor, the known operating modes of the motor are: either preset rotational stator magnetic field or rotational magnetic field control in a so-called rotating magnetic field operation mode, or position signal derived from the calculated back electromotive force voltage of the motor using a field-oriented motor adjustment method. This method is called the back electromotive force (BEMF) method, which examines the induced voltage signal generated by the back electromotive force. Because the BEMF method has limitations in angle calculation at low speeds, it is usually combined with a preset control rotating magnetic field operation mode.

[0007] However, a drawback is that controlled rotating magnetic field operation is only applicable to this type of motor to a certain extent. This is especially true under dynamically changing loads, as there is a risk that the rotor may fail to follow the applied rotating magnetic field, resulting in "loss of synchronization." Various influencing parameters, such as undervoltage pulses or sudden load changes, can also cause the motor to "lose synchronization." When the stator magnetic field is applied without knowing the rotor speed, the rotor may also fail to consistently follow the rotating magnetic field.

[0008] However, in safety-related applications of this type of motor, it may be required that the control system can switch the motor to emergency operation or safety mode even if the sensor signal is no longer available. For example, when this type of motor is used in the field of electro-hydraulic or electromechanical wheel brakes for motor vehicles, it may be required that the wheel brake maintain its function or switch to backup level ("RFE") in the event that the rotor position or orientation cannot be determined due to sensor signal failure or loss.

[0009] In this context, for example in a braking system, motor step loss could render braking operations unresponsive to the driver's braking intentions, a situation that should be avoided as much as possible. Therefore, existing measures stipulate significant restrictions on permissible driver requests to create stable external conditions and set a maximum permissible request, enabling the rotor to reliably follow the rotating magnetic field and thus meet established safety requirements. However, the braking system performance and availability achievable in this manner may be severely limited by the need to consider all "worst-case" tolerances and the resulting limitations.

[0010] Therefore, it is desirable to provide a control method for electronically commutated motors that at least mitigates the aforementioned disadvantages, or ideally eliminates them.

[0011] The inventor undertook this task. Summary of the Invention

[0012] This task is surprisingly and simply solved by the method, linear actuator, and motor vehicle braking system for controlling a motor vehicle braking system as described in any of the independent claims. Preferred embodiments and improvements of the invention can be derived from the dependent claims.

[0013] Therefore, in a first aspect, the present invention includes a method for controlling a motor vehicle braking system, the braking system comprising at least one hydraulic brake control circuit and at least one electronically commutated motor having a rotor and a stator, the method comprising the following steps, preferably in the order shown below: - The motor is controlled by a control unit in normal operating mode, wherein the current rotor position is determined by a rotor position sensor. - Check the functionality of the rotor position sensor. - In the event that a sensor malfunction is detected in the rotor position sensor ○ Check whether the first inspection condition is met. ○ If the first inspection condition is met, the control of the braking system is switched from the normal operation mode to the safe operation mode, and the braking system is controlled by the control device in the safe operation mode. ○ Check whether the second check condition is met in safe operating mode. ○ If the second inspection condition is met, the control device continues to control the braking system in safe operating mode. ○ If the second inspection condition cannot be met or is not met, the control of the braking system will be switched to backup operation mode, and ○ The braking system is controlled by the control device in backup operation mode.

[0014] The braking system of the present invention may include at least one electro-hydraulic vehicle braking device equipped with at least one hydraulic brake control circuit. The hydraulic brake control circuit may include wheel brakes that are hydraulically controlled and operated. In addition, the braking system may integrate an electromechanical vehicle braking device having electromechanically operable wheel brakes, such as disc brakes configured for electromechanical operation. Here, according to a preferred embodiment of the invention, the hydraulic operation of the wheel brakes may be achieved with driver intervention, at least in the backup stage (“RFE”). Therefore, according to an embodiment of the invention, in normal operation corresponding to the conventional operating mode, the wheel brakes belonging to the hydraulic brake control circuit may operate electromechanically or electro-hydraulically, while in the backup stage they operate hydraulically.

[0015] According to a preferred embodiment of the invention, an electro-hydraulic vehicle braking device may include an electric pressure supply device serving as a pump assembly, wherein pressure can be established by a motor. Preferably, the electric pressure supply device includes an electronically commutated motor equipped with a three-phase, electronically commutated, permanent magnet excited, and brushless motor, which can be driven by a magnetic rotating field regulated by a current generated by three-phase alternating current. Here, the current generating the motor torque can also be calculated based on the output motor torque. The motor particularly includes a permanently magnet excited rotor and an electromagnetically excited stator. Here, the rotor is a rotatably supported element of the motor, which is driven to rotate by the stator magnetic field. Such a motor is also known as a so-called permanent magnet synchronous motor.

[0016] In the normal operating mode of the braking system, pressure is established via a motor. In the backup stage, referred to in this invention as the backup operating mode, pressure can be established without electrical assistance by hydraulically connecting the brake pedal to the wheel brakes, and by the driver or the driver's foot pressure; this is also known as driver intervention. In the event of an electrical system failure, the braking system is directly switched to the hydraulic backup stage, in which the braking system can continue to operate without electrical assistance.

[0017] To improve the availability and potential performance of the braking system, this invention proposes introducing an alternative operating mode in which the braking system can operate. In this operating mode, referred to as the safe operating mode in this invention, further electrical assistance can be provided to achieve motor pressure build-up, but specific limits or constraints can be set in this safe operating mode. Once these preset limits are reached or exceeded, the control of the braking system can be switched to a backup level or backup operating mode.

[0018] Here, the control of the braking system in normal operating mode can be specified, with the motor controlled by a control device to, for example, establish braking pressure, wherein the current rotor position is determined in a known manner by a rotor position sensor.

[0019] The control unit can receive electrical control signals representing the driver's braking intention or braking requests issued by the control unit or central vehicle calculator.

[0020] According to a preferred embodiment of the invention, the functionality of the rotor position sensor may be checked during normal operation of the braking system, for example, by a corresponding functional unit in the control device. This may involve checking whether a rotor position sensor signal is missing, or whether the rotor position sensor signal is erroneous and / or exceeds a preset limit (i.e., outside the preset limit range). Furthermore, it may be checked whether at least one signal from the rotor position sensor is unreliable, or whether the signals are unreliable to each other, for example, by monitoring the radius of the measured sine or cosine signals. Additionally, it may be checked whether the signal transmission is error-free or contains errors, for example, by checking the checksum during digital signal transmission. The lack of functionality of the rotor position sensor may be termed a sensor malfunction.

[0021] In the absence of observed sensor malfunction, the braking system can continue to be controlled without restriction in normal operating mode.

[0022] According to a preferred embodiment of the present invention, when a sensor malfunction is detected, it can be checked whether at least one first check condition is met. Here, the first check condition may include one or more checks. If the first check condition includes only one check, it can be understood that the first check condition is met when that check is met. If there are multiple checks within the scope of the first check condition, it can be understood that the first check condition is met when at least one or preferably all checks are met. For example, this can also be implemented by a functional unit of a control device.

[0023] If a sensor malfunction is detected, the first step is to check for system states related to the braking system itself or the motor. These system states oppose / prevent switching the control to the corresponding restricted or safe operating mode of the motor.

[0024] According to a preferred embodiment of the present invention, the first inspection condition may include inspection closure. The check determines whether there is sufficient brake fluid volume in the hydraulic brake control circuit to establish the reduced maximum braking pressure. If sufficient brake fluid volume is present, the check is considered satisfied; otherwise, it is considered unsatisfactory.

[0025] According to one embodiment of the invention, it can be further checked whether system protection is guaranteed, or whether the system is in a state where switching to a safe operating mode is not advisable, because other system responses should be executed to achieve system protection. For example, to protect the motor, switching to a safe operating mode may be disadvantageous when performing reference operation for zero-point identification and / or when the motor is moving backward at high speed to a stop. If system protection is guaranteed, the check can be considered satisfied; otherwise, it is considered unsatisfied.

[0026] Therefore, according to a preferred embodiment of the present invention, when both of the above checks are met, the first check condition can be assessed as satisfied. When the first check condition is satisfied, the control of the braking system can be switched from the normal operating mode to the safe operating mode, and the braking system can be controlled by the control device in the safe operating mode. If the first check condition is not met or operation in the safe operating mode is not permitted, the control of the braking system can be directly switched to the backup operating mode, and the control device can control the braking system in the backup operating mode.

[0027] According to one embodiment of the invention, the safe operating mode may include sensorless operation, also known as set-control rotating magnetic field operation. This means that the motor of the braking system can continue to be controlled, for example, to generate pressure, but without sensors. In other words, the control device can apply a rotating magnetic field, and the motor rotor can follow this rotating magnetic field. Here, this rotating magnetic field can be generated by a limited phase current. For this purpose, the read current value can be used.

[0028] To maintain the safe operating mode for as long as possible, according to a preferred embodiment of the present invention, the safe operating mode is implemented as a restricted conventional operating mode. This means that, compared with the conventional operating mode, the safe operating mode can support fewer functions and / or fewer processes (or control methods) and / or a narrower operating window.

[0029] Therefore, according to a preferred embodiment of the present invention, at least one of the following constraints may be imposed on the operation of the motor in a safe operating mode.

[0030] - The rotational speed is limited to / constrained by a preset rotational speed limit. - The torque is limited to / constrained by a preset torque limit. - Acceleration is limited to / constrained by a preset acceleration limit. - Efficiency is reduced.

[0031] According to a preferred embodiment of the present invention, the control of the braking system can also be constrained. Therefore, it can be specified that at least one of the following constraints is applied to the control of the braking system in a safe operating mode: - The braking pressure is reduced to a preset braking pressure limit. - The pressure gradient is reduced to a preset pressure gradient limit. - The pressure gradient rise is reduced to a preset pressure gradient (rise) limit.

[0032] Here, the constraint is set in a way that does not violate any safety-related requirements.

[0033] The aforementioned limits may be stored in the memory of the control device, and represent limits or maximum values ​​to be observed. For example, when a driver's braking request causes the motor speed, which is preset to a speed limit to establish braking pressure, to exceed the speed limit, the control device may reduce the target speed to the predetermined speed limit. This may result in reduced efficiency.

[0034] To ensure that the driver's expectations continue to be met even in the safe operating mode, according to a preferred embodiment of the invention, the operation of the braking system in the safe operating mode is monitored by appropriate means. This aims to eliminate possible malfunctions in the braking system. Therefore, upon detecting an impending or actual malfunction in the braking system, control can be switched to another safe and available backup level. Subsequently, the control device can continue to control the braking system in the backup operating mode.

[0035] According to a preferred embodiment of the present invention, a safe operating mode can be maintained as long as the desired deceleration is achieved or the safety-related requirements are met.

[0036] Therefore, according to another preferred embodiment of the present invention, a second check condition is checked in the safe operating mode to see if it is met. If the second check condition is met, the control device can continue to control the braking system in the safe operating mode, that is, control in the safe operating mode can be maintained.

[0037] If the second inspection condition cannot be met, according to a preferred embodiment of the present invention, the control of the braking system can be switched to a backup operation mode so as to reliably eliminate the faulty operation of the braking system.

[0038] Here, the second check condition may include one or more checks. If the second check condition contains only one check, it can be understood that the second check condition is satisfied if that check is satisfied. If there are multiple checks within the scope of the second check condition, it can be understood that the second check condition is satisfied when at least one, more, or all of the checks are satisfied.

[0039] According to a preferred embodiment of the invention, the second inspection condition may particularly include checking whether the required braking pressure or the braking pressure reduced according to constraints can be provided. In this case, the braking pressure refers to the pressure associated with the clamping force that presses the friction pads of the wheel brake against the mating friction element to generate a predetermined braking torque. The mating friction element may, for example, include the brake disc of a wheel brake configured as a disc brake, against which the friction pads can be pressed to apply the braking torque.

[0040] When a braking intention is made, this may cause the motor to act as a pressure generator in the hydraulic braking circuit, producing the corresponding pressure to provide the appropriate braking torque. Due to constraints on the control or the motor, the following situation may occur: the braking intention cannot be achieved in safe operating mode because the corresponding pressure cannot be established due to motor limitations. In this case, the required braking pressure cannot be provided, and the braking system may be switched to backup operating mode. Therefore, this check in the second check condition can be considered unmet.

[0041] The second inspection condition may include additional inspections. Such inspections in the second inspection condition may be used alternatively or supplementally. They may include: The required braking pressure is compared with the corresponding braking pressure in the hydraulic system or the clamping force of the friction lining. If the pressure in the hydraulic system (e.g., obtainable using a pressure sensor or pressure measuring device) at least meets the driver's braking intention, the safe operating mode can continue. The clamping force of the friction lining can be obtained, for example, using a force sensor.

[0042] Another check could be aimed at verifying whether the time required to reach the required braking pressure or the required clamping force is within a preset time limit.

[0043] Another type of check can be aimed at verifying whether the current wheel deceleration of at least one wheel matches the required vehicle deceleration. This check can be applied, for example, to electromechanical wheel brakes when the hydraulic system is not used in safe operating mode and therefore no sensors are provided for measuring the pressure of the hydraulic system.

[0044] In addition, the synchronicity of the motor can be checked. For this purpose, sensor information can be evaluated and checked for any indication that the rotor is not following the rotating magnetic field.

[0045] For the above checks, it is assumed that the required braking pressure, clamping force, or wheel deceleration all originate from the driver. However, in an improved embodiment of the invention, it is also specified that such braking requests may originate from a higher-level vehicle function, such as a vehicle calculator. Therefore, according to an improved embodiment of the invention, the braking system may be equipped with another independently operable brake, such as a separate electromechanical parking brake (EPB).

[0046] In the backup operating mode, the pressure build-up of the braking system does not require an electric motor, and can be achieved solely through the hydraulic system. It is assumed that in this backup stage, driver intervention in the braking system is achieved by connecting the hydraulic system to the pedal used to recognize the driver's braking intention.

[0047] Therefore, the present invention enables the driver's moderate braking intention to be comfortably achieved even under the constrained boundary conditions of a safe operating mode. If a braking request, such as the driver's braking intention or a braking request issued by a higher-level control unit or a central vehicle calculator, exceeds the current or constrained performance of the vehicle's braking system under preset boundary conditions, it will automatically enter a less comfortable backup level, in which the driver's braking intention or braking request can still be safely executed.

[0048] Therefore, the present invention enables the electronically commutated motor of the braking system to continue operating with safe and sufficient performance for pressure build-up, even in the event of failure of at least one or all rotor position sensor signals, initially in a safe operating mode that is only slightly or correspondingly limited, until a control switch to a backup or standby operating mode is achieved because a specific system state of the braking system or motor no longer allows continued operation in that safe operating mode.

[0049] Here, the method of the present invention can also advantageously take into account the influence parameters that may change during the operation of the motor vehicle braking system in order to select a control method. These influence parameters may include, for example: - Temperature changes due to increased friction - Restricted battery usage requested by the higher-level vehicle system. - Current limit requested by the superior vehicle system. - Undervoltage - Vibration or external influences.

[0050] According to a preferred embodiment of the invention, during the operation of the braking system, checks on the functionality of the rotor position sensor and checks on the first and / or second check conditions are performed at extremely short time intervals to ensure the shortest possible response time.

[0051] Rotor position sensors can be based on optical, inductive, capacitive, or magnetic measurement principles.

[0052] In another aspect, the present invention also includes a motor vehicle braking system configured to perform the method described above.

[0053] Further details of the invention will be derived from the description of the illustrated embodiments and the appended claims. Attached Figure Description

[0054] Figure 1 A flowchart of the method according to the present invention is shown. Detailed Implementation

[0055] In a first aspect, the invention includes a method for controlling a motor vehicle braking system, the braking system comprising at least one hydraulic braking circuit and at least one electronically commutated motor having a rotor and a stator.

[0056] The flowchart of this method is as follows Figure 1 As shown. Here, the method has the following steps: - In step S1, the motor is controlled by the control device in normal operating mode, wherein the current rotor position is determined by the rotor position sensor. - In step S2, the functionality of the rotor position sensor is checked. - In the event of a sensor malfunction detected in the rotor position sensor, ○ In step S3, check whether the first check condition is met. If the first inspection condition is met, in step S4, the control of the braking system is switched from the normal operation mode to the safe operation mode, and the control device controls the braking system in the safe operation mode. In step S5, under safe operating mode, it is checked whether the second check condition is met. If the second inspection condition is met, according to step S4, the control device continues to control the braking system in safe operating mode. ○ If the second check condition cannot be met or is not met: In step S6, the control of the braking system is switched to backup operation mode, and According to step S6, the control device controls the braking system in the backup operation mode.

[0057] According to one embodiment of the present invention, the braking system includes an electro-hydraulic vehicle braking device equipped with at least one hydraulic braking circuit. The hydraulic braking control circuit includes wheel brakes that are hydraulically controllable and hydraulically operable. Here, according to one embodiment, the hydraulic operation of the wheel brakes is achieved by driver intervention, at least in the backup stage (“RFE”). The wheel brakes of the hydraulic braking control circuit can be operated electromechanically or electro-hydraulically in normal operating mode, and hydraulically in the backup stage.

[0058] According to one embodiment, an electro-hydraulic vehicle braking device includes an electric pressure supply device serving as a pump assembly, wherein pressure can be established via a motor. Here, the electric pressure supply device includes an electronically commutated motor equipped with a three-phase, electronically commutated, permanent magnet-excited brushless motor, which can be driven by a current-regulated magnetic rotating field generated by three-phase alternating current. The motor specifically includes a permanently magnet-excited rotor and an electromagnetically excited stator.

[0059] According to one embodiment, in the normal operating mode of the braking system, pressure can be established via a motor. In the backup stage, pressure can be established without electrical assistance by hydraulic connection between the brake pedal and the wheel brakes, and by the driver or the driver's foot pressure.

[0060] Here, according to step S1, the control of the braking system in normal operating mode can be specified such that the motor is controlled by the control device to establish braking pressure, wherein the current rotor position is determined in a known manner by a rotor position sensor. The control device can therefore receive electrical control signals representing the driver's braking intention or a braking request issued by the control unit or central vehicle computer.

[0061] According to one embodiment, during normal operation of the braking system, the functionality of the rotor position sensor is checked in step S2 by a corresponding functional unit in the control device. According to one embodiment, this checks whether a rotor position sensor signal is missing, or whether the rotor position sensor signal is erroneous and / or exceeds a preset limit. According to one embodiment, it further checks whether at least one signal from the rotor position sensor is unreliable, or whether all signals are determined to be unreliable through mutual verification. For this purpose, a known radius monitoring method is used for the measured sine or cosine signal. Furthermore, it can be checked (e.g., by checksum during digital signal transmission) whether the signal transmission is error-free or contains errors. A malfunction of the rotor position sensor is referred to as a sensor fault. According to one embodiment, a sensor fault is handled by setting the signal R2 = false in the control device. If no sensor fault exists (R2 = true), then according to one embodiment, subsequent control is performed in the normal operating mode.

[0062] After a sensor fault (R2 = false) is detected, step S3 checks whether at least one first check condition is met.

[0063] According to one embodiment, the first inspection condition includes one or more inspections.

[0064] According to one embodiment, the first check examines whether there is sufficient brake fluid volume in the closed hydraulic braking circuit to establish the reduced maximum braking pressure. If there is sufficient brake fluid volume, the check is considered satisfied (R3 = true); otherwise, it is considered unsatisfactory (R3 = false).

[0065] According to one embodiment, the effectiveness of the braking system's protection functions is checked, or whether the braking system is in a state unsuitable for switching to a safe operating mode, because other system responses should be executed to protect the braking system. According to one embodiment, if a reference run for zero-point identification is underway and / or the motor is moving towards the rear stop at a high speed, the safe operating mode is considered unreasonable (R3 = false).

[0066] The safe operation mode in step S4 refers to sensorless operation, also known as set-control rotational field operation. The motor of the braking system can continue to be controlled, for example, to generate pressure, but without the need for sensors. The safe operation mode is implemented as a restricted conventional operation mode.

[0067] Here, for the control of the motor, at least one of the following constraints is implemented for the operation of the motor in the safe operating mode: - The rotational speed is limited to / constrained by a preset rotational speed limit. - The torque is limited to / constrained by a preset torque limit. - Acceleration is limited to / constrained by a preset acceleration limit. - Efficiency is reduced.

[0068] In addition, the control of the braking system is also subject to constraints, including at least one of the following constraints: - The braking pressure is reduced to the predetermined braking pressure limit. - The pressure gradient is reduced to a predetermined pressure gradient limit. - The pressure gradient rise is reduced to a preset pressure gradient (rise) limit.

[0069] According to one embodiment, in step S5, a second check condition is checked in the safe operation mode. If the second check condition is met (R5 = true), the control device continues to control the braking system in the safe operation mode. If the second check condition cannot be met (R5 = false), according to one embodiment, the control of the braking system is switched to a backup operation mode to reliably eliminate the possibility of a malfunction in the braking system.

[0070] The second inspection condition includes one or more inspections.

[0071] Here, according to one embodiment, the second check condition includes checking whether the required braking pressure or the braking pressure reduced according to the limitation can be provided. If the required braking pressure cannot be provided (R5 = false), the system enters the backup mode, step S6.

[0072] According to one embodiment, the second check condition includes comparing the required braking pressure with the corresponding braking pressure in the hydraulic system or the clamping force of the friction pads. If the pressure in the hydraulic system (e.g., obtainable via a pressure sensor or pressure measuring device) is at least equal to / not less than the driver's braking intention, the safe operating mode (R5 = true) can continue to be maintained.

[0073] Another possible check is to verify that the time required to reach the required braking pressure or clamping force is within the preset time limit. If satisfied, the safe operating mode (R5 = true) can continue.

[0074] Another possible check aims to verify whether the current wheel deceleration of at least one wheel matches the required vehicle deceleration. This check can be used, for example, in cases involving electromechanically operable wheel brakes when the hydraulic system is not used in safe operating mode and therefore there are no sensors for measuring hydraulic system pressure. If they match, the safe operating mode (R5 = true) can continue.

[0075] Another possible check aims to verify the synchronism of the electronically commutated motor. For this purpose, sensor information can be evaluated and checked for any indication that the rotor is not following the rotating magnetic field. If it is detected that the rotor is no longer following the rotating magnetic field (R5 = false), the safe operating mode can be terminated and the system can switch to the backup operating mode in step S6.

[0076] The backup operating mode mentioned in step S6 refers to an operating mode in which the pressure build-up of the braking system does not require the assistance of a motor, and can be achieved solely through the hydraulic system. Here, according to one embodiment, the driver can intervene in the braking system by connecting the hydraulic system to a pedal used to recognize the driver's braking intention.

[0077] Here, during the operation of the braking system, the functionality of the rotor position sensor and / or the first and / or second check conditions are checked at extremely short time intervals.

[0078] Another embodiment of the present invention stipulates that the query in step S3 is skipped, and the check is performed only in step S5.

[0079] Therefore, according to this embodiment of the present invention, the method includes the following steps: - In step S1, the motor is controlled by the control device in the normal operating mode, wherein the current rotor position is determined by the rotor position sensor.

[0080] - In step S2, the functionality of the rotor position sensor is checked. - In the event of a sensor malfunction detected in the rotor position sensor, In step S4, the control of the braking system is switched from the normal operating mode to the safe operating mode, and the control device controls the braking system in the safe operating mode. In safe operating mode, step S3 checks whether the first check condition is met, and step S5 checks whether the second check condition is met. If the first and / or second inspection conditions are met, according to step S4, the control device continues to control the braking system in safe operating mode. ○ If the first and / or second check conditions cannot be met or are not met: In step S6, the control of the braking system is switched to backup operation mode, and According to step S6, the control device controls the braking system in the backup operation mode.

[0081] Therefore, after the control device switches to the safe operation mode, steps S3 and S5 are executed in the same method steps.

[0082] Here, the inspection conditions are preferably kept unchanged.

[0083] This simplifies query execution. The drawback is that this method might unnecessarily switch to a safe operating mode. However, given the short time period of a few milliseconds, this drawback is considered acceptable.

[0084] Rotor position sensors are based on optical, inductive, capacitive, or magnetic measurement principles.

[0085] The present invention also relates to a motor vehicle braking system configured to perform the method described above.

Claims

1. A method for controlling a motor vehicle braking system, the braking system comprising an electro-hydraulic vehicle braking device and at least one electronically commutated motor having a rotor and a stator, the method comprising the following steps, preferably performed in the following order: - The motor is controlled by a control unit in normal operating mode, wherein the current rotor position is determined by a rotor position sensor. - Check the functionality of the rotor position sensor. - In the event that a sensor malfunction is detected in the rotor position sensor ○ Check whether the first inspection condition is met. ○ If the first inspection condition is met, the control of the braking system is switched from the normal operation mode to the safe operation mode, and the braking system is controlled by the control device in the safe operation mode. ○ Check whether the second check condition is met in safe operating mode. ○ If the second inspection condition is met, the control device continues to control the braking system in safe operating mode. ○ If the second inspection condition cannot be met or is not met, the control of the braking system will be switched to backup operation mode, and ○ The braking system is controlled by the control device in backup operation mode.

2. The method according to claim 1, characterized in that, In normal operating mode, the motor is controlled based on electrical control signals, which represent the driver's braking intention or braking requests issued by the superior control unit or the central vehicle calculator.

3. The method according to any one of the preceding claims, characterized in that, The functional checks of the rotor position sensor include at least one of the following checks: - Check if the rotor position sensor signal is missing. - Check the rotor position sensor signal for errors and / or exceeding preset limits. - Check whether at least one signal from the rotor position sensor is unreliable, or whether the signals are unreliable to each other. - Check whether the signal transmission is error-free or contains errors.

4. The method according to any one of the preceding claims, characterized in that, The first inspection criteria include at least one of the following inspections: - Check if there is sufficient brake fluid volume in the closed hydraulic brake control circuit. - Check whether the system protection is guaranteed.

5. The method according to any one of the preceding claims, characterized in that, The safe operating mode includes sensorless rotating magnetic field operation, in which the motor of the braking system can still be controlled.

6. The method according to any one of the preceding claims, characterized in that, The safe operating mode includes a restricted normal operating mode, in which at least one of the following constraints is applied to the operation of the motor: - The rotational speed is limited to a preset speed limit. - The torque is limited to a preset torque limit. - Acceleration is limited to a preset acceleration limit. - Efficiency is reduced.

7. The method according to any one of the preceding claims, characterized in that, The safe operating mode includes a restricted normal operating mode, under which at least one of the following constraints is applied to the control of the braking system: - The braking pressure is reduced to a preset braking pressure limit. - The pressure gradient is reduced to a preset pressure gradient limit. - The rise in pressure gradient is reduced to a preset pressure gradient limit.

8. The method according to any one of the preceding claims, characterized in that, The second inspection condition includes at least one of the following inspections: - Check if the required braking pressure can be provided. - Compare the required braking pressure with the corresponding braking pressure or clamping force. - The time required to reach the required braking pressure or the required clamping force. - Compare the current wheel deceleration of at least one wheel with the required vehicle deceleration. - Check whether the rotating magnetic field between the motor's rotor and stator is synchronized.

9. The method according to any one of the preceding claims, characterized in that, Backup operating modes include operating modes in which pressure is built up without the aid of an electric motor, specifically pressure is built up solely through the hydraulic system using the driver's braking force.

10. The method according to any one of the preceding claims, characterized in that, In backup mode, the hydraulic system is connected to the brake pedal used to detect the driver's braking intention.

11. The method according to any one of the preceding claims, characterized in that, During the operation of the braking system, the functionality of the rotor position sensor and / or the first and / or second check conditions are checked at extremely short time intervals.

12. The method according to any one of the preceding claims, characterized in that, Rotor position sensors are based on optical, inductive, capacitive, or magnetic measurement principles.

13. A motor vehicle braking system configured to perform the method according to any one of the preceding claims.

Images