Protective device for decoupling electrical control circuits in a redundant autonomous driving system

Abstract

Protective device for decoupling electrical control circuits when at least one electro-pneumatic actuator (1) is used jointly by a plurality of independently powered control unit devices in a redundant system for autonomous driving, wherein the at least one electro-pneumatic actuator (1) has a common connection (4.1) via which the at least one electro-pneumatic actuator (1) can be coupled and switched with a common connection (4.1) of at least one other electro-pneumatic actuator (1), and at least one dedicated connection (4.2, 4.3) via which the at least one electro-pneumatic actuator (1) can be individually energized, the majority of control device assemblies comprise at least a first control device assembly comprising a first electronic control unit (3) and a first number of switching devices (4, 5, 6, 7, 8, 16) corresponding to the common connection (4.1) and the number of dedicated connections (4.2, 4.3) of all electro-pneumatic actuators (1), and at least a second control device assembly comprising a second electronic control unit (3.2) and a second number of switching devices (4, 5, 6, 7, 8, 16) corresponding to the common connection (4.1) and the number of dedicated connections (4.2, 4.3) of all electro-pneumatic actuators (1), and which at least a first and second control unit are arranged to switch a current into or not into the at least one electro-pneumatic actuator (1) via the switching devices (4, 5, 6, 7, 8, 16), and at least one current flow blocking device (18, 19; 20; 21) is provided, which is configured to prevent, when one of the first and second control device units switches a current into the at least one electro-pneumatic actuator (1), a current flow resulting from this switch-on to the electronic control unit (3, 3.2) of another of the first and second control device units, wherein - the current flow blocking device (18, 19) is designed as a diode (18; 19) arranged at a terminal of each of the switching devices (4, 5, 6, 7, 8, 16) and the diode (18, 19) is arranged inside the first and second electronic control units (3, 3.2) or outside the first and second electronic control units (3, 3.2) between the at least one electro-pneumatic actuator (1) and each of the switching devices (4, 5, 6, 7, 8, 16), or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a diode (19) is arranged as the current blocking device, or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a diode (18) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device.

Description

[0001] The invention relates to a protective device for decoupling electrical control circuits when at least one electro-pneumatic actuator is used jointly by a plurality of independently voltage-supplied control unit devices, according to claim 1, and to a brake system in which such a protective device is installed, according to claim 6.

[0002] In highly automated or autonomous vehicles, such as commercial vehicles, driver assistance systems control the vehicle and monitor its surroundings instead of a human driver. This is particularly true for vehicles that perform autonomous driving functions without a driver ready to intervene at any time (assistance functions from level 3 of a total of six levels 1 to 6; in level 3, which refers to highly automated driving, an underlying system takes over longitudinal and lateral control in a specific use case, recognizes system limits, and prompts a driver to take over with sufficient time.The driver no longer needs to constantly monitor the vehicle or system, but must potentially be able to take control. Brake systems, even in the event of a fault in an electrical control circuit or actuator circuit, must still be able to actuate pressure control valves (PCVs) to ensure that electrically controlled functions, such as ABS, ESP, steering brakes, and the like, can continue to operate. However, in the event of a fault, such as a component failure, the driver may be unable to intervene, or at least unable to do so quickly enough, to regain control of the vehicle.

[0003] For safety reasons, critical electronic systems are therefore designed with redundancy. For example, redundancy of a power supply is ensured via several, for example two, independent voltage sources, which usually share a common ground, and / or several, for example two, independent electrical control circuits for brake control with a common ground (vehicle ground) are arranged in vehicles.

[0004] In a compressed air brake system, this particularly concerns the brake system's electronics (i.e., the control units) as well as the control of electro-pneumatic actuators such as solenoid valves or pressure control valves. While in a known system the electronics are redundantly designed using two separate control units, for many electro-pneumatic valves it is sufficient to connect a valve to two redundant brake system control units and to control such valves from one or the other control unit depending on the situation.

[0005] From DE 10 2008 009 043 B3 a redundant braking system is known, with electro-pneumatic actuators and a plurality of control unit devices, at least a first control unit device having a first electronic control unit and at least a second control unit device having a second electronic control unit, wherein the at least one first and second control unit device are arranged to control or not control a current into the at least one electro-pneumatic actuator.

[0006] DE 101 50 379 A1 discloses that two supply lines simultaneously supply a consumer with electricity, and that the corresponding subnetworks are decoupled by means such as diodes arranged in the consumer. Furthermore, the consumer is defined therein as electromechanical brakes, in whose electronic controls diodes decouple the supply lines on one side.

[0007] DE 36 24 455 A1 describes how control units are additionally connected to the power supply line of the other control unit via a cross-connection line, and the respective power supply lines are decoupled on one side by means of diodes. In the event of an interruption in the power supply to one of the control units, the cross-connection line ensures that it is supplied with power from the power supply of the other control unit via the cross-connection line.

[0008] DE 10 2005 062 907 B3 discloses that in a braking system with redundant control of the brake actuators, even without an electrical power supply and without an electrical brake request signal in the event of a fault in one control circuit, a brake pressure can be applied by introducing signals from another, intact control circuit via an additional electropneumatic valve.

[0009] Fig. Figure 1 schematically and in part shows an exemplary setup of a braking system or braking scheme, partially known from DE 10 2008 009 043 B3, with a first electronic control unit or ECU 3, which belongs to a so-called "standard" EBS system and can form a main brake control unit, and a second electronic control unit or ECU 3.2, which can form a backup brake control unit and, for example, controls an iFBM (foot brake module with integrated magnet) as a backup system. In this example, the two ECUs 3 and 3.2 are each connected to a first and a second power supply 22.1 and 22.2, respectively, and can communicate with each other and with other vehicle systems via a data bus 23.

[0010] If multiple independent control circuits are present for brake control, it must be ensured that a fault in one of the control circuits does not adversely affect another control circuit. In particular, a single fault must not lead to the simultaneous failure of all, for example, both, control circuits; that is, both control circuits must not be rendered completely inoperative by a single fault.

[0011] Fig. Figure 2 shows an arrangement of a pressure control valve, partially known from DE 197 01 200 A1, with common and dedicated connections and controllable switches for their control and / or energizing. According to Fig. 2. A pressure control valve 1 electrically consists of a first and a second solenoid valve, i.e., two solenoid valves, 2, which have a common port 4.1 and each their own port 4.2, 4.3. The controlling electronic control unit 3 has a switch 4, 16 for switching the common ports of all solenoid valves and a dedicated switch 5, 6, 7, 8 for each solenoid valve to energize them individually.

[0012] Fig. Figure 3 shows a more detailed overview of the pressure control valves, some of which are known from DE 197 01 200 A1, and common and dedicated connections as well as controllable switches for their control or energizing according to Fig. 2. According to Fig. 3 The switches can preferably be implemented as electronic output stages 15, 16, which are controlled by a logic unit 17 of the electronic control unit 3. A distinction is generally made between output stages that connect the supply lines of the solenoid valves to a positive potential (+) (highside) and output stages that connect the return lines of the solenoid valves to a negative potential (-) or ground potential (lowside). The output stage that switches one of the two paths for several solenoid valves simultaneously can be a highside or a lowside output stage (common ground). For the sake of simplicity, a negative or lowside connection is assumed in the following. A bidirectional switching capability is required to ensure that the solenoid valves can be switched off even in the event of a short circuit 10 in one of the supply lines, a short circuit to the supply 9 or ground, or a short circuit 12 through a short circuit, i.e., a short circuit to ground.to prevent an unintentional energization of a solenoid valve in the event of, for example, a short circuit and thus destruction of the final stage between, for example, the emitter and collector due to overtemperature.

[0013] In order to detect other faults in time, in particular a short circuit 11 between a supply and a return line, a short circuit 13 between a return line and the supply and a short circuit 14 between the return line and ground, as well as a cable break, electrical values ​​(voltages at the terminals, excessive currents) are usually monitored permanently and test pulses are applied to the magnets from time to time and the electrical reaction to them is evaluated.

[0014] If a pressure control valve is controlled by two or more electronic control units, then when one of the electronic control units sends test pulses to a magnet, the permanent monitoring in another electronic control unit would be triggered and falsely detect a fault.

[0015] Furthermore, if two electrical circuits share a common ground (-), a ground offset between two controlling electronic control units can lead to the destruction of one or both of the electronic control units.

[0016] Furthermore, a defective electronic control unit can be unintentionally supplied "backwards" if, for example, it has been disconnected from its supply voltage due to a fault, or if there is a short circuit in the supply to ground of the defective electronic control unit, a current flowing from an intact electronic control unit to the solenoid valve can be short-circuited, since the parasitic diode of the high-side output stage of the defective electronic control unit allows the current from the intact electronic control unit to pass through when this second electronic control unit switches on the solenoid valve.This could lead to unwanted and potentially dangerous activities of the first, defective electronic control unit and / or prevent the solenoid valve of the relevant pressure control valve from switching, or, due to the excessive current flow, also destroy the second electronic control unit and thereby eliminate the required redundancy.

[0017] If a power stage for the individual control or current supply of a solenoid valve were to be connected in an electronic control unit, it would not be sufficient for only this electronic control unit to switch off the corresponding opposite-polarity, common power stage, because in this case the current would flow through the opposite-polarity, common power stage of the other electronic control unit and unintentionally activate the solenoid valve.

[0018] Based on the aforementioned problem, the present invention aims to prevent fault currents between power supplies via the control units, particularly in a system with redundant control units that share electro-pneumatic actuators, while adhering to safety requirements. Furthermore, the invention is intended to ensure that a fault in one control circuit does not affect another control circuit in such a system. Finally, a vehicle braking system incorporating such a protective device is also to be provided.

[0019] This problem is solved according to the invention by the features of claims 1 and 6. Disclosure of the invention

[0020] The invention is based on the general idea of ​​a decoupling protective device for electrical control circuits when electro-pneumatic actuators are used jointly by independently powered control units in redundant systems for autonomous driving.

[0021] In the arrangement according to the invention, the protective device includes a predetermined number of current blocking devices, which are connected in the positive and / or ground path in the form of diodes and / or functionally equivalent elements or components and which make it possible to prevent fault currents, equalizing currents and other undesirable currents between voltage supplies via control devices, even without galvanic isolation and while complying with safety requirements.

[0022] The protective device according to the invention for decoupling electrical control circuits when at least one electro-pneumatic actuator is used jointly by a plurality of independently powered control unit devices in a redundant system for autonomous driving provides that the at least one electro-pneumatic actuator has a common connection via which the at least one electro-pneumatic actuator can be coupled and switched with a common connection of at least another electro-pneumatic actuator, and at least one dedicated connection via which the at least one electro-pneumatic actuator can be individually powered, and that the plurality of control unit devices has at least one first control unit device,The device comprises a first electronic control unit and a first number of switching devices corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators, and at least a second control unit comprising a second electronic control unit and a second number of switching devices corresponding to the common connection and the number of dedicated connections of all electro-pneumatic actuators, and the at least one first and second control unit are configured to switch a current into the at least one electro-pneumatic actuator or to prevent it from doing so. At least one current-flow blocking device is configured to switch a current into the at least one electro-pneumatic actuator whenever one of the first and second control unit units switches it.to prevent a current flow resulting from this input to the electronic control unit of another of the first and second control unit devices.

[0023] According to a first alternative of the invention, the current flow blocking device is designed as a diode arranged at a terminal of each of the switching devices. The diode is arranged either within the first and second electronic control units or outside the first and second electronic control units and between the at least one electro-pneumatic actuator and each of the switching devices.

[0024] According to a second alternative according to the invention, a reverse-polarized and actively switched output stage is arranged as the current blocking device on the supply potential side in a common current path section between the switching devices and the first and the second electronic control unit, and a diode is arranged as the current blocking device on the ground potential side in a common current path section between the switching devices and the first and the second electronic control unit.

[0025] According to a third alternative according to the invention, a reverse-polarized and actively switched output stage is arranged as the current blocking device on the supply potential side in a common current path section between the switching devices and the first and the second electronic control unit, and a reverse-polarized and actively switched output stage is arranged as the current blocking device on the ground potential side in a common current path section between the switching devices and the first and the second electronic control unit.

[0026] The features according to the invention, as described above, particularly advantageously prevent a voltage offset or a ground offset from leading to an unwanted current flow between control units and / or electronic control units in a redundantly designed system, such as a braking system for autonomous driving. This in turn advantageously prevents one or all of the electronic control units from being destroyed due to the unwanted current flow, and prevents a defective electronic control unit from being unintentionally supplied "backwards" if, for example, it is disconnected from its supply voltage due to a fault, or prevents the current from being short-circuited from an intact electronic control unit to a solenoid valve if a defective electronic control unit has a short circuit of its supply to ground.Overall, it is advantageous that the redundancy required for the autonomous system can be maintained even in the event of a fault or in the case of unsuitable voltage and / or mass conditions using the features according to the invention.

[0027] The measures listed in the dependent claims enable advantageous further developments and improvements of the invention specified in the independent claims.

[0028] Preferably, the first and second control unit assemblies comprise a main brake control unit with the first electronic control unit and a backup brake control unit with the second electronic control unit, and the at least one electrical actuator comprises a solenoid valve or a pressure control module containing solenoid valves, wherein the first and second control unit assemblies are arranged to access coils of the solenoid valves and the pressure control modules together, wherein the coils are configured to be controlled via the switching devices, and wherein the switching devices include semiconductor switches configured to be supplied via a common power supply and ground path.

[0029] It is also preferred that the switching devices are configured as electronic output stages arranged to be controlled by a logic unit of the first or second electronic control unit, wherein an output stage is an output stage that connects the supply lines of an electrical actuator to a positive potential, or an output stage that connects the return lines of the electrical actuator to a negative potential or ground potential.

[0030] According to further training, several diodes can be arranged in a diode circuit arrangement forming a T-piece, which functions equivalently to a single diode.

[0031] Furthermore, it may be preferable and advantageous in the device that the first and second electronic control units are configured to block the switching devices of both a positive and a negative line when no electrical actuator is to be energized; in fault-free operation in accordance with predetermined criteria, only one of the first and second electronic control units takes over the control of the at least one electrical actuator; an electronic control unit of the first and second electronic control units in a passive state is configured not to actively energize an electrical actuator for testing purposes;and the electronic control unit in the passive state is configured to switch to an active state in the event of a fault in an active control unit of the first and the second electronic control units, which prevents further operation of the active control unit, and to take over the control of the electrical actuator as the new active electronic control unit instead of the faulty electronic control unit; wherein the electronic control unit in the passive state is configured to monitor voltage levels on its lines to the at least one electrical actuator, to validate this monitoring with information transmitted to it from the active electronic control unit regarding an instantaneous control of the at least one electrical actuator, and to monitor the safe locking of the current-blocking device.

[0032] The invention relates not only to the protective device for electrical control circuits described above for the shared use of at least one electrical actuator by a plurality of independently powered control units in redundant autonomous driving systems, but also to a braking system in which the device can be installed, preferably being electro-pneumatically actuated. The braking system can be a braking system of a passenger car or a commercial vehicle (tractor unit and / or trailer), and can in particular be electro-pneumatically actuated. The invention thus extends to all types of vehicles, in particular also to passenger cars, commercial vehicles, or heavy commercial vehicles.

[0033] The control unit can be formed by a separate control unit or by an existing electronic control unit, in particular by a vehicle control unit, a brake control unit of the braking system or by the control unit of an electro-pneumatic brake control module.

[0034] Advantageous further developments of the invention are described in the claims, the description, and the drawings. The advantages of features and combinations of features mentioned in the introduction to the description are merely examples and can have an effect alternatively or cumulatively, without the advantages necessarily having to be achieved by embodiments of the invention.

[0035] Identical or similarly functioning components and assemblies are designated with the same reference numbers in different embodiments. drawing

[0036] Exemplary embodiments of the invention are shown in the drawing and explained in more detail in the following description. It should be noted that the drawing schematically and in part depicts components of a known compressed air brake system (a compressed air brake assembly) for vehicles, such as those used in commercial vehicles. Therefore, reference is made to components of the compressed air brake system or the compressed air brake assembly only to the extent that their description and explanation contribute to a better understanding of the invention. Furthermore, for the sake of clarity, identical or at least similar components are not repeatedly designated with the same reference numbers in the drawing; instead, a single reference number may be given as an example and representative of such identical or at least similar components.

[0037] The drawing shows Fig. 1 a schematic and partial structure of a brake system or brake scheme known per se with a first electronic control unit as a main control unit and a second electronic control unit as a backup control unit as well as a plurality of solenoid valves used jointly by both control units; Fig. 2 a known arrangement of a pressure control valve with common and dedicated connections and controllable switches for their control or energizing; Fig. 3 a further description of the arrangement of a pressure control valve, which is known per se, with common and dedicated connections as well as controllable switches for their control or energizing according to Fig. 2; Fig. 4 a simplified and excerpted representation of a redundantly designed compressed air brake system with an arrangement of a current blocking device according to an exemplary embodiment; Fig. 5 an alternative arrangement of the power cut-off device according to Fig. 4; Fig. 6 another alternative arrangement of the power cut-off device according to Fig. 4; Fig. 7 another alternative arrangement of the power cut-off device according to Fig. 4; and Fig. 8 another alternative arrangement of the power cut-off device according to Fig. 4. Description of the exemplary implementations

[0038] As described above, in Fig. Figure 1 shows a schematic and partial structure of a brake system or brake scheme known per se, with here a first electronic control unit 3 as a first control unit or main control unit and a second electronic control unit 3.2 as a second control unit or backup control unit, as well as a plurality of pressure control valves or solenoid valves 1 used jointly by both control units 3, 3.2.

[0039] Each pin of the pressure control valves 1 is connected to both the main control unit 3 and the backup control unit 3.2. The main control unit 3 is supplied by a first power supply 22.1 at a predetermined potential relative to vehicle ground, and the backup control unit 3.2 is supplied by a second power supply 22.2 at the predetermined potential relative to vehicle ground. The main and backup control units 3 and 3.2 are arranged and configured to act as switches, as needed, on switching devices 4, 5, 6, 7, 8, 16 located in the power supply path and the ground path, for example, suitable MOSFETs or other suitable power switches or output stages.

[0040] In the Fig. In the exemplary brake scheme shown in 1, the first control unit 3, i.e. the main control unit, can be a first electronic control unit or ECU (in Fig. 1 not shown) which may be part of a “standard” EBS system or electronic braking system, and may include the second control unit 3.2, i.e. the backup control unit, a second electronic control unit or ECU (in Fig. (1 not shown) include an iFBM (foot brake module with integrated magnet) which controls a backup system. The two electronic control units in the two control units 3 and 3.2 are connected to the power supplies 22.1 and 22.2, respectively, and can communicate with each other and with other vehicle systems via a data bus 23. The control units 3 and 3.2 together form control unit assemblies.

[0041] It goes without saying that the in Fig. The part of a compressed air brake system shown in Figure 1 can be part of a brake system or brake assembly of any vehicle, such as a commercial vehicle as a towing vehicle and / or its trailer, and the compressed air brake system can be of a type known per se and, in particular, be electrically, hydraulically, pneumatically, electro-hydraulically, or electro-pneumatically actuated. It is further understood that the number, configuration, and arrangement of the control units 3, 3.2, the pressure control valves 1, and the switches 4, 5, 6, 7, 8, 16 are not limited to the number, configuration, and arrangement used herein as examples, as long as the effects and advantages of the invention can be achieved in a corresponding number, configuration, and arrangement.Details of the known compressed air brake system have been omitted from the following description for the sake of simplicity, insofar as they do not contribute to a better or easier understanding of the invention.

[0042] In a compressed air brake system of the type and application described herein, it must be ensured that a fault in one of the control circuits does not, if possible, negatively affect another control circuit. The following embodiment addresses the objective that, in particular, not all, for example both, control circuits should be rendered completely inoperative by a single fault.

[0043] According to the present embodiment, diodes or functionally equivalent components or elements are arranged in electronic control units, in a wiring harness (for example, in plugs or sockets of pressure control valves or electronic control units), and / or in, for example, a special T-connector. During fault-free operation, only one of the electronic control units is responsible for controlling the pressure control valves. In all electronic control units, both the positive and negative leads are blocked as long as no solenoid valve needs to be energized.

[0044] As in Fig. As shown in Figure 4, according to the second embodiment, an electro-pneumatic actuator, e.g. the pressure control valve 1, consists electrically of two solenoid valves 2, each of which has the common connection 4.1 and each of which has its own dedicated connection 4.2, 4.3.

[0045] The first controlling electronic control unit (ECU 3) and the second controlling electronic control unit (ECU 3.2) each have switching devices 4, 16 for switching the common terminals of all solenoid valves 2 and switching devices 5, 6, 7, 8 for each solenoid valve 2 for its individual energizing. As mentioned above, the switching devices 4, 5, 6, 7, 8, 16 can, for example, be configured as electronic output stages 15, 16, which are controlled by a first logic unit 17 in the first electronic control unit 3 and a second logic unit 17.2 in the second electronic control unit 3.2.

[0046] A distinction is made between output stages that connect the supply lines of the pressure control valves 1 to positive (+) (highside), and output stages that connect the return lines of the solenoid valves 2 to negative (-) or ground (lowside). An output stage that switches one of the two paths for several solenoid valves 2 simultaneously can be a highside output stage or a lowside output stage (common ground). For the purposes of this description, a negative connection (lowside) is assumed.

[0047] A double-sided shutdown option is necessary to prevent unwanted current flow to a solenoid valve 2 even in the event of a short circuit of one of the supply lines 10 to the supply voltage 9 or to ground, or due to a short circuit of the final stage 12.

[0048] In order to detect other faults in a timely manner, such as short circuits between supply and return lines 11, short circuits between return line and supply 13 and between return line and ground 14, as well as any cable breakage, electrical values ​​(e.g. voltages at the terminals, excessive currents) are constantly monitored and test pulses are applied to the magnets from time to time and the electrical response is evaluated.

[0049] As in Fig. As shown in Figure 4, according to the present embodiment, a diode 18 and a diode 19 are arranged at the respective connection of the switching devices or output stages 15, 16 in the direction of the solenoid valves 2 or their respective connection to the power supply or ground.

[0050] In the present embodiment according to Fig. 4 The diodes 18, 19 are arranged inside the first and second control units 3, 3.2, as indicated in the figure by a broken line, and are arranged in a blocking direction such that they block current flowing into their respective electronic control units 3, 3.2, i.e., current coming from outside (blocking direction) and allow current flowing out of their respective electronic control units 3, 3.2 (forward direction).

[0051] It is noted that these diodes 18, 19 in corresponding modifications of the present embodiment are located outside the first and second control units 3, 3.2 ( Fig. 5), by a diode circuit arrangement 20 operating equivalently to a single or separately arranged diode 18, 19 ( Fig. 6), through a common current path section between the switching devices or output stages 15, 16 and the respective electronic control units 3, 3.2 ( Fig. 7) and / or by an additional, reverse-polarized and actively switched output stage 26 in conjunction with a diode 19 ( Fig. 8) can be replaced. With regard to the latter modification, it is also conceivable to replace diode 19 with a corresponding additional actively switched output stage, or only to replace diode 19 with a corresponding actively switched output stage 26 and to leave diode 18 as a diode, i.e., not to replace diode 18 with an actively switched output stage 26.

[0052] The diodes 18, 19, the circuit arrangement 20 operating equivalently to a single diode and / or an additional, reverse-polarized and actively switched output stage 26 are arranged in their installation position and polarity and configured to prevent, in the event of a fault, a current from flowing in an undesired or intended, i.e., "wrong", direction into the electronic control units 3, 3.2 via the connecting line to the pressure control valve 1 and causing damage through connections 24, 25 to the other electronic parts of the electronic control units 3, 3.2.

[0053] This advantageously prevents a ground offset between the two controlling electronic control units 3, 3.2 from leading to the destruction of one or both of the electronic control units 3, 3.2 when both electrical circuits have a common ground (-), and prevents a defective electronic control unit 3, 3.2 from being unintentionally supplied "backwards" if, for example, it is disconnected from its supply voltage due to a fault, or prevents the current from being short-circuited from an intact electronic control unit to the solenoid valve 2 if a defective electronic control unit has a short circuit of its supply to ground, since the parasitic diode of the high-side output stage of the defective electronic control unit would allow the current from the intact ECU to pass through when this intact electronic control unit switches on the solenoid valve 2.In such a fault scenario, the defective electronic control unit could engage in unintended and potentially dangerous activities, and the solenoid valve 2 of the relevant pressure control valve 1 could be prevented from switching, or the intact electronic control unit could also be destroyed due to excessive current flow. In such a case, the required redundancy would no longer be present.

[0054] According to the present embodiment, in both electronic control units 3, 3.2, the output stages of both the positive and negative lines are always blocked when no solenoid valve 2 needs to be energized. In fault-free operation, only one of the electronic control units 3, 3.2 is defined as controlling the pressure control valves 1. This distribution of tasks can be maintained during fault-free operation or changed cyclically or according to other predetermined criteria, for example, criteria configured to harmonize the thermal load on the output stages.

[0055] Furthermore, an electronic control unit in a passive state does not actively energize a solenoid valve 2 for testing purposes as long as it remains in a passive state. This prevents the output of test pulses to a solenoid and advantageously prevents the triggering of values ​​from a permanent monitoring system in another electronic control unit and the resulting unjustified fault detection.

[0056] The electronic control unit in a passive state can optionally monitor the voltage levels on its lines to the pressure control valves 1 and, if necessary, verify them with information transmitted from the active electronic control unit via a digital interface, e.g., a CAN bus, regarding the current actuation of the solenoid valves. In particular, this allows for monitoring the reliable blocking of diodes 18 and 19, for example, when diodes 18 and 19 are connected in circuits within the electronic control unit as shown in [reference to diagram]. Fig. 4 shown or before connections 24, 25 as in Fig. 7 are shown arranged.

[0057] If a currently active first electronic control unit, for example the first electronic control unit 3, is no longer able to control the pressure control valves 1 for any reason (e.g. after loss of supply voltage, due to an electrical fault within the electronics, e.g. due to a shorted output stage, a broken cable in a line 10 to a pressure control valve 1), a previously passive, second electronic control unit, for example the second electronic control unit 3.2, now becomes the active electronic control unit and henceforth takes over the control of the pressure control valves 1, insofar as this is still possible.

[0058] For this purpose, this second electronic control unit 3.2, which switches from the passive state to the active state, can, for example, detect itself that the previously active first electronic control unit 3 has failed due to a failure of communication with it. Alternatively, the previously active first electronic control unit 3, or another electronic control unit that has detected the fault in the previously active first electronic control unit 3, can notify the second electronic control unit 3.2 of the detected fault.

[0059] The second, now active, electronic control unit 3.2 can then detect, based on the voltage levels on its lines 10, whether one of the short circuits 9, 13 is present or whether one of the dedicated (individual) output stages in the no longer active first electronic control unit 3 is shorted out 12. In such cases, continued operation of the pressure control valves 1 is no longer possible, because switching on the common switching device 16 or 19 would immediately and unintentionally activate a solenoid valve 2. The active electronic control unit therefore terminates the operation of the pressure control valves 1 in these cases.

[0060] If none of the aforementioned fault conditions 9, 12, 13, i.e., no short circuit and no cross-linking of a final stage, are present, the active electronic control unit can pulse-switch on the common switching device 4, 16 and one or more of the dedicated switching devices 5, 6, 7, 8 in order to detect a fault 11 based on an excessive current flow.

[0061] A short circuit to ground 14 or a short circuit to the common output stage 16 of a faulty electronic control unit can be detected by the fact that when the corresponding individual output stage is switched on in a pulse-like manner with the common output stage switched off, no voltage is present on the return line before the common output stage.

[0062] If one of the aforementioned errors 9, 11, 12, or 13 is detected, continued operation of pressure control valve 1 or pressure control valves 1 is not possible. This is because, in the case of a short circuit to the dedicated line of a solenoid valve 2 in an electronic control unit, it would be counterproductive for only this electronic control unit to switch off the corresponding common output stage on the opposite polarity, as the current would then flow through the common output stage on the opposite polarity of the other electronic control unit, unintentionally activating the solenoid valve. Therefore, in the aforementioned error cases, the now active electronic control unit terminates the operation of pressure control valve 1 or pressure control valves 1.

[0063] In the other fault cases 14, 21 of a short circuit to ground or a shorted common output stage of a defective electronic control unit, the operation of the pressure control valves 1 may be continued, at least for a limited time, by the active electronic control unit which has taken over the operation of the pressure control valves 1 in place of the defective electronic control unit.

[0064] It is noted that for each detected error, a corresponding error message can be issued and transmitted, unless this has already been done by the defective electronic control unit or another monitoring system provided and configured for this purpose.

[0065] As described above, the invention relates to a device for decoupling and / or protecting against equalizing currents for use when at least one electro-pneumatic actuator 1 is shared by a plurality of independently powered control unit devices 3, 3.2 in redundant systems for autonomous driving. Each electro-pneumatic actuator 1 has a common connection 4.1, via which the electro-pneumatic actuator 1 can be coupled and switched with a common connection 4.1 of other electro-pneumatic actuators 1, and at least one dedicated connection 4.2, 4.3, via which the at least one electro-pneumatic actuator 1 can be individually powered. The number of dedicated connections 4.2, 4.3 is determined by the common connection 4.1 and the number of dedicated connections 4.2, 4.3.3 of all electro-pneumatic actuators 1, a corresponding number of switching devices 4, 5, 6, 7, 8, 16 is arranged to switch a current into or against the at least one electro-pneumatic actuator 1. The invention provides at least one current flow blocking device 18, 19, 20, 21, which is configured to prevent an unwanted current flow to an inactive electronic control unit 3, 3.2 of the first and second electronic control units 3, 3.2. REFERENCE MARK LIST 1 pressure control valve 2 solenoid valves 3 first ECU 3.2 second ECU 4.1 Common connection solenoid valve 4.2 Separate connection of solenoid valve 4.3 Separate connection of solenoid valve 4 switches for common connection 5 switches for separate connection 6 switches for separate connection 7 switches for separate connection 8 switches for separate connection 9 Short circuit to supply or ground 10 Short circuit in supply line 11 Short circuit between supply and return lines 12 Short circuit due to a short circuit in the final stage 13 Short circuit between return line and supply 14 Short circuit between return line and ground 15 Power stage 16 switches for common connection; power amplifier 17 logic units 22.1 First power supply 22.2 Second power supply 23 Data bus 24 connection 25 connection

Claims

[1] Protective device for decoupling electrical control circuits when at least one electro-pneumatic actuator (1) is used jointly by a plurality of independently powered control unit devices in a redundant system for autonomous driving, wherein the at least one electro-pneumatic actuator (1) has a common connection (4.1) via which the at least one electro-pneumatic actuator (1) can be coupled and switched with a common connection (4.1) of at least one other electro-pneumatic actuator (1), and at least one dedicated connection (4.2, 4.3) via which the at least one electro-pneumatic actuator (1) can be individually energized, the majority of control device assemblies comprise at least a first control device assembly comprising a first electronic control unit (3) and a first number of switching devices (4, 5, 6, 7, 8, 16) corresponding to the common connection (4.1) and the number of dedicated connections (4.2, 4.3) of all electro-pneumatic actuators (1), and at least a second control device assembly comprising a second electronic control unit (3.2) and a second number of switching devices (4, 5, 6, 7, 8, 16) corresponding to the common connection (4.1) and the number of dedicated connections (4.2, 4.3) of all electro-pneumatic actuators (1), and which at least a first and second control unit are arranged to switch a current into or not into the at least one electro-pneumatic actuator (1) via the switching devices (4, 5, 6, 7, 8, 16), and at least one current flow blocking device (18, 19; 20; 21) is provided, which is configured to prevent, when one of the first and second control device units switches a current into the at least one electro-pneumatic actuator (1), a current flow resulting from this switch-on to the electronic control unit (3, 3.2) of another of the first and second control device units, wherein - the current flow blocking device (18, 19) is designed as a diode (18; 19) arranged at a terminal of each of the switching devices (4, 5, 6, 7, 8, 16) and the diode (18, 19) is arranged inside the first and second electronic control units (3, 3.2) or outside the first and second electronic control units (3, 3.2) between the at least one electro-pneumatic actuator (1) and each of the switching devices (4, 5, 6, 7, 8, 16), or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a diode (19) is arranged as the current blocking device, or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a diode (18) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, or - on the supply potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device, and on the ground potential side in a common current path section between the switching devices (4, 5, 6, 7, 8, 16) and the first and second electronic control units (3, 3.2) a reverse-polarized and actively switched output stage (26) is arranged as the current flow blocking device. [2] Device according to claim 1, characterized by, that the first and second control unit assemblies comprise a main brake control unit with the first electronic control unit (3) and a backup brake control unit with the second electronic control unit (3.2), and the at least one electro-pneumatic actuator (1) comprises a solenoid valve (2) or a pressure control module (1) containing solenoid valves, wherein the first and second control unit assemblies are arranged to access coils of the solenoid valves (2) and / or the pressure control modules (1) in common, wherein the coils are configured to be actuated via the switching devices (4, 5, 6, 7, 8, 16), and wherein the switching devices (4, 5, 6, 7, 8, 16) include semiconductor switches and / or output stages configured to be supplied via a common power supply and ground path. [3] Device according to claim 1 or 2, characterized by, that the switching devices (4, 5, 6, 7, 8, 16) are configured as electronic output stages (15, 16) arranged to be controlled by a logic unit (17, 17.2) of the first or second electronic control unit (3, 3.2), wherein an output stage is, in each case, an output stage that connects the supply lines of an electro-pneumatic actuator to a positive potential, or an output stage that connects the return lines of the electro-pneumatic actuator (1) to a negative potential or ground potential. [4] Device according to any one of the preceding claims, characterized by , that several diodes (18, 19) are arranged in a diode circuit arrangement (20) forming a T-piece, which operates equivalently to a single diode (18, 19). [5] Device according to any of the preceding claims, characterized by , that the first and second electronic control units (3, 3.2) are configured to block both the switching devices (4, 5, 6, 7, 8, 16) of a positive and a negative line when no electro-pneumatic actuator (1) is to be energized, In a fault-free operation in accordance with predetermined criteria, only one of the first and second electronic control units (3, 3.2) takes over the control of the at least one electro-pneumatic actuator (1), an electronic control unit of the first and second electronic control units (3, 3.2) in a passive state is configured not to actively energize an electro-pneumatic actuator (1) for testing purposes; and the electronic control unit in the passive state is configured to switch to an active state in the event of a fault in an active control unit of the first and the second electronic control units (3, 3.2), which prevents further operation of the active control unit, and to take over the control of the electro-pneumatic actuator (1) as the new active electronic control unit instead of the faulty electronic control unit; wherein the electronic control unit in the passive state is configured to monitor voltage levels on its lines to the at least one electro-pneumatic actuator (1), to validate this monitoring with information transmitted to it from the active electronic control unit regarding a momentary actuation of the at least one electro-pneumatic actuator (1), and to monitor a safe locking of the current flow blocking device. [6] Braking system of a passenger car or commercial vehicle, characterized by that a protective device according to one of the preceding claims is installed in the braking system. [7] Brake system according to claim 6, characterized by that it is electro-pneumatically operated.

Images