Redundant braking system and method for operating such a braking system

Abstract

Braking system (80) for a vehicle, which is configured to detect at least one state variable for controlling the braking system (80), comprising: - a primary control means (40) configured to control the braking system (80) by means of at least one actuator and taking into account the at least one state variable, - a redundancy control means (41) configured to control the braking system (80) by means of at least one actuator and taking into account at least one state variable, wherein the braking system (80) is configured, upon the occurrence of at least one switching condition, to no longer control the braking system (80) exclusively by means of the primary control means (40), but at least partially by means of the redundancy control means (41), wherein the braking system (80) is configured to be at least partially electronically controlled by means of the redundancy control means (41),wherein the redundancy control means (41) has an electronic control connection to at least one actuator which is configured to be electronically controlled by the primary control means (40) and / or wherein the redundancy control means (41) has at least one electronic connection to at least one recording means which is also electronically connected to the primary control means (40).

Description

[0001] The present invention relates to a redundant braking system, in particular for road vehicles, and to a method for operating such a braking system.

[0002] Commercial vehicles with highly automated driving functions that relieve the driver of the task and responsibility for driving at least for a limited time, i.e. can be operated autonomously, for example, must continue driving the vehicle if any error occurs until the driver takes over driving the vehicle again.

[0003] The derived system property "Fail-Operational" requires that the basic functions of the vehicle, especially at the execution level, continue to be guaranteed, at least with functional restrictions. For brake control in autonomous driving, this means that if any error occurs, the braking system can continue to be operated electronically, so that driving dynamics control functions such as ABS, ASR, ESP can continue to be implemented, albeit possibly with restrictions.

[0004] A duplication of all components of the braking system to form a redundancy system is expedient in terms of maintaining functionality even if a fault occurs, but is not justifiable in terms of costs, installation space and weight, especially in series production.

[0005] It is therefore the object of the present invention to extend a conventional electronically controlled brake system which can continue to be braked in an electronically controlled manner even in the event of a fault.

[0006] This object is solved with the subject matter of the independent claims. Advantageous developments are the subject of the subclaims.

[0007] According to the invention, a braking system is provided which is designed to detect at least one state variable for controlling the braking system and which is suitable for a vehicle, having: - a primary control means, which is designed to control the braking system by means of at least one actuator and taking into account the at least one state variable, - a redundancy control means, which is designed to control the braking system by means of a part of the at least one actuator and taking into account a part of the at least one state variable, wherein the braking system is designed to no longer exclusively control the braking system when at least one switching condition occurs the primary control means, but at least in part by the redundancy control means.

[0008] “By means of a part of the at least one actuator” means that not all actuators that are controlled by the primary control means are necessarily also controlled by the redundancy control means. It can also be less. Actuators can also be provided which are controlled exclusively by the redundancy control means.

[0009] “Taking into account a part of the at least one state variable” means that not all state variables that are taken into account by the primary control means are also necessarily taken into account by the redundancy control means. It can also be less. State variables can also be provided which are only taken into account by the redundancy control means.

[0010] The brake system is preferably designed such that when at least one switching condition occurs, the brake system is no longer controlled exclusively by the primary control means, but at least partially by the redundancy control means. In a preferred embodiment of the invention, the brake system is controlled exclusively by the redundancy control means. In other forms of the invention, partial functions are still taken over by the primary control means, with the redundancy control means preferably taking over additional control functions.

[0011] It is also conceivable to design the braking system in such a way that several switching stages are provided. For example, the switchover takes place in a first stage to partial control by the redundancy system when a first switchover condition occurs, with a complete changeover to the redundancy system taking place in a second stage as soon as control by the primary system is no longer possible.

[0012] The brake system preferably has at least one actuator, which is designed to influence a brake pressure for controlling at least one brake of the brake system, and / or at least one detection means, which is designed to detect at least one state variable for controlling the brake system.

[0013] The braking system is preferably designed as an electropneumatic braking system and / or for autonomous operation.

[0014] An electropneumatic braking system is known in principle. This essentially means a brake system that generates the brake pressures pneumatically, with the brake system being designed to generate these brake pressures in an electronically controlled or regulated manner. For example, the primary control means or also the redundancy control means is provided for this purpose, which is designed to transmit control commands to components of the brake system, preferably to actuators, in order to influence the brake pressure in this way.

[0015] The primary control means is preferably designed as an electronic control unit.

[0016] The redundancy control means is preferably designed as an electronic control unit.

[0017] The primary control means and / or the redundancy control means are / is preferably integrated into a component of the brake system. This component is preferably an actuator or another electro-pneumatic component of the brake system.

[0018] The primary control means and / or the redundancy control means are / is also preferably designed as part of a control means present in the brake system. This is also preferably designed as an electronic control unit.

[0019] Preferably, the braking system is designed to be electronically controlled by the primary and / or the redundant control means.

[0020] The at least one actuator is preferably a pressure generator, which is designed to generate the brake pressure, in particular from a pressure accumulator, and / or a pressure regulator, which is designed to control and / or regulate the brake pressure.

[0021] For this purpose, the pressure generator preferably has a connection to a pressure accumulator, via which it is supplied with a pressure medium, in particular compressed air, from which the pressure generator generates the braking pressure. The pressure regulator is preferably designed as a valve, particularly preferably as a solenoid valve, and is also designed to regulate the braking pressure of the pressure generator, so that the braking pressure can be reduced by the pressure regulator.

[0022] The at least one detection means preferably has a sensor which is designed to detect the at least one state variable and / or which has an interface which is designed to receive the at least one state variable from a vehicle network.

[0023] Preferably, the at least one state variable is in particular a wheel speed, a speed, an acceleration, a wheel torque, a brake pressure. The state variable is particularly preferably suitable for determining a driving state, in particular with regard to dynamic driving stability. This can also be done with the inclusion of other state variables.

[0024] The driving state is preferably described by two state variables, such as sideslip angle and yaw rate, or longitudinal and lateral acceleration of the vehicle.

[0025] Preferably, the primary control means is adapted to be powered by a primary supply source and the redundant control means is preferably adapted to be powered by a redundant supply source.

[0026] The primary and redundant supply sources are preferably in the form of the on-board electrical system of the vehicle.

[0027] A switching condition is preferably a failure of the primary supply source and / or an at least partial failure of the primary control means. Thus, if an error occurs which at least partially prevents the control of the brake system by the primary control means, the control of the brake system is preferably partially, particularly preferably completely, taken over by the redundancy control means.

[0028] The braking system is preferably designed to be at least partially electronically controlled by the redundancy control means. This means that the redundancy control means does not necessarily have to receive electronic access to all components of the brake system to which the primary control means has electronic access.

[0029] The primary control means and / or the redundancy control means are / is preferably designed to receive the at least one state variable.

[0030] "Electronically controlled" or "electronically regulated" means here preferably that control signals are sent to components of the brake system, which were previously determined electronically, for example by a software algorithm, in particular on the basis of the at least one state variable. The control signals can be different. The control signals are preferably electrically pronounced.

[0031] The braking system preferably has an operating level, a so-called “first redundancy level”, in which at least individual components of the braking system can no longer be controlled electronically. The control, in particular the transmission of control signals to these components, takes place here in a different way, preferably by means of pneumatically designed control signals.

[0032] The redundancy control means is preferably designed to electronically regulate brake pressures on individual wheels or at least individual axles of the vehicle and / or a trailer. For this purpose, the redundancy control means preferably has electronic control connections to at least some of the corresponding pressure regulators and / or the corresponding pressure generators, which are also electronically controlled by the primary control means. In addition, the redundancy control means is preferably designed to be electronically supplied with state variables of the brake system via the same detection means. Electronic control of the braking system can thus advantageously also be achieved in the first redundancy level, as a result of which certain stabilization functions can also be implemented. The formation of the first redundancy level of the brake system with a further control means has the advantage that actuators and detection means do not have to be kept available separately for the first redundancy level. Instead, the actuators and detection means that are present in any case can be used.

[0033] The braking system preferably has at least one control device which is designed to generate a non-electronic braking input for the braking system in order to trigger braking by the braking system, the control device being designed to be controlled, in particular electronically, by the redundancy control means.

[0034] Thanks to the control device, the brake system is also able to receive brake inputs that are generated during autonomous driving operation in the first redundancy level. The brake inputs are preferably in the form of pneumatic signals, with the control device having a connection to the pressure accumulator in order to generate these signals. In this way, the braking system can also be controlled in the first redundancy level during autonomous driving.

[0035] The brake system preferably has a foot brake module which is designed to generate at least one control signal for generating a brake pressure from a brake input, the at least one control signal being designed electronically and / or pneumatically, with the foot brake module and the module being designed in one piece or separately are.

[0036] A brake input can be transmitted electronically to the foot brake module. In addition, particularly in the first redundancy level, the brake input can also be non-electronic, preferably pneumatic.

[0037] In the case of autonomous operation, the brake input can be generated by the primary or the redundancy control means with the aid of the control device, or by a driver, with a position of a brake pedal preferably being electronically detected, and / or by the foot brake module by means of mechanical penetration of the brake pedal is received in the foot brake module.

[0038] In a further embodiment of the invention, a method for operating a braking system is provided, which has the following steps: - Check whether a switching condition has occurred; - Changing the control of the braking system from the primary control means at least in part to the redundancy control means when a switching condition occurs.

[0039] When at least one switching condition occurs, the brake system is no longer controlled exclusively by the primary control means, but at least in part by the redundancy control means. In a preferred embodiment of the invention, the brake system is controlled exclusively by the redundancy control means. In other forms of the invention, partial functions are still taken over by the primary control means, with the redundancy control means preferably taking over additional control functions.

[0040] The method preferably has a step in which the information essential for the operation of the brake system is transferred to the redundancy control means, the transfer taking place during the at least partial change from the primary to the redundancy control means or already beforehand.

[0041] The method preferably has one of the following steps: - Detecting at least one state variable for controlling the braking system; - Determination of the driving condition, in particular with regard to dynamic driving stability; - Generating brake pressure to control at least one brake depending on the driving condition; - Determine information essential for the operation of the braking system.

[0042] The information that is essential for the operation of the braking system preferably contains information about: - applied brake pressures, - at least one state variable, in particular a wheel speed, a speed, an acceleration, a wheel torque, a brake pressure, or another suitable variable in order to determine the driving state, in particular with regard to driving dynamics stability, - ongoing monitoring functions, in particular for monitoring the at least one actuator and / or the at least one detection means, - running control functions, in particular for the control and / or regulation of wheel slip and / or dynamic driving stability of the vehicle, - Driven actuators, in particular - Existing error states in particular the at least one actuator and / or the at least one sensor.

[0043] A switching condition is preferably a failure of the primary supply source and / or an at least partial failure of the primary control means.

[0044] In a further embodiment of the invention, a computer program product is provided with a program code stored on a machine-readable carrier which is designed to, when executed on a data processing device, cause the data processing device to execute the method according to the invention as described above.

[0045] The data processing device is preferably designed as a primary control means and / or a redundancy control means, which makes it possible to design it to control the brake system.

[0046] In the following, preferred embodiments of the invention are described by means of the accompanying drawings.

[0047] In detail shows: figure 1 an embodiment of a braking system according to the invention, figure 2 brake system control connections figure 1, figure 3 shows a flow chart of a method according to the invention and figure 4 is a detailed flow chart of the stepS11 out figure 3.

[0048] figure 1 shows an embodiment of a braking system according to the invention 80 and figure 2 shows control connections of the braking system 80 out figure 1. The following description of the braking system 80 refers to both drawings.

[0049] It's a front axle v.a and a rear axle HA shown, each having wheels 1 features attached to an axis 2 are rotatably mounted. The wheels 1 is assigned a braking device, which is designed as a friction brake in the example shown. This is on every wheel 1 a brake disc 3 provided, which is designed to, with a friction partner, in this case a brake pad 4 , rubbing contact. The brake disc 3 is non-rotatable with the respective wheel 1 connected and thus rotates with the wheel while driving 1 with.

[0050] To perform braking, the respective brake lining 4 with the appropriate brake disc 3 brought into contact by an introduced brake pressure, resulting in a frictional force on the brake disc 3 adjusts, which has a braking moment result, which the rotation of the brake disc 3 and especially the wheel 1 counteracts.

[0051] For reasons of clarity, further components of the vehicle and in particular the axle structure or the structure of the brakes are not shown in this representation.

[0052] Furthermore, such a brake and vehicle structure is not to be regarded as limiting the subject matter of the invention. It serves only as an example to clarify the mode of operation of the subject matter according to the invention. Rather, alternative construction options for a brake are also conceivable, such as a drum brake instead of the disc brake shown. Other versions of a vehicle are also conceivable. For example, you could have more than one front or rear axle v.a , HA , so a total of more than two axes can be provided.

[0053] Also on the wheels 1 Speed ​​sensors (not shown) are provided to measure speeds of individual wheels 1 capture.

[0054] Below is the brake system 80 described. This has a pressure accumulator 10 on which via supply lines 14 , 14a , 14b different components 18 , 20 , 82 of the braking system 80 supplied with compressed air.

[0055] One component is a foot brake module 18 represents which one with the supply line 14 via a supply input 15 connected. Above that is the foot brake module 18 supplied with compressed air. The foot brake module 18 also has a control input 19 on, over which the foot brake module 18 can receive pneumatic brake inputs. In addition, the foot brake module 18 two control outputs 16 , 17 on, over which the foot brake module 18 can emit pneumatic control signals. The foot brake module also has 18 via an interface (not shown) to a driver, via which it can receive brake inputs, which are input via a brake pedal, for example. The foot brake module 18 is designed to electronically receive the driver's braking inputs or braking inputs that are generated during autonomous driving and to other components of the braking system 80 to transmit. The foot brake module 18 is also designed to receive the brake inputs pneumatically if electronic detection of the brake inputs is not possible. A direct mechanical penetration (not shown) of the brake pedal into the foot brake module is required for this 18 provided, whereby a driver within the foot brake module 18 can generate a pneumatic pressure corresponding to a brake input. In the case of autonomous driving, a corresponding pneumatic brake input can be made via the control input 19be received. The foot brake module 18 is also designed to generate pneumatic control signals from these pneumatic brake inputs and these via the control outputs 16 , 17 to provide.

[0056] The braking system 80 further comprises a control device 82 on which via a supply input 83 using a supply line 14a with compressed air from the pressure accumulator 10 is supplied. The control device 82 is designed to generate a pneumatic brake input, which can be used in autonomous driving to trigger braking. Therefore, the control device 82 a control output 84 on, this via a control line 13 with the control input 19 the foot brake module 18 connected. The foot brake module 18 can thus pneumatic brake inputs of the control device 82 receive. The control device 82 is further configured to generate the pneumatic brake inputs from an electronic control signal.

[0057] The control device 82 and the foot brake module 18 can also be formed integrally in another embodiment that is not shown.

[0058] Furthermore, the braking system 80 a pressure generator 20 on. This is via a supply line 14b from the accumulator 10 supplied with compressed air. The pressure generator 20 is designed to provide pneumatic brake pressure for the front axle v.a , the rear axle HA as well as to create a follower. The pressure generator 20 is designed to generate the brake pressure using an electronic control signal and alternatively using pneumatic control signals. via a control line 22 stands the pressure generator 20 with the control output 16 the foot brake module 18 in connection to pneumatic control signals for the front axle v.a and to receive a trailer and via a control line 23 stands the pressure generator 20 with the control output 17 the foot brake module 18 in connection to pneumatic control signals for the rear axle HA to recieve. To transfer the pneumatic brake pressure to the front axle v.a and the trailer is the pressure generator 20 with a line 26 and to transmit the pneumatic brake pressures to the rear axle HA stands the pressure generator 20 with a line 27 in connection.

[0059] On the front axle v.a and rear axle HA are wheel-specific pressure regulators 28 provided, which are designed for example as solenoid valves. This pressure regulator 28 are designed to use the brake pressure which is given to them via the lines 26 , 27 is transmitted, regulate on the basis of an electronically generated control signal, so that a wheel-specific brake pressure in the individual brake lines 29 , which transmit the brake pressure to the brakes, prevails.

[0060] Furthermore, a trailer module 24 shown. This is essentially also a pressure regulator 24 , which is designed to a pneumatic brake pressure, which he via the line 26 receives, to regulate on the basis of an electronic control signal and to a brake line 50 transfer to a trailer.

[0061] In addition, a primary means of control 40 and a redundancy control means 41 shown, which can be provided, for example, as separate electronic control units. The primary means of control 40 is thereby via a primary supply source 52 and the redundancy control means 41 via a redundant supply source 58 supplied with electrical energy. The corresponding lines are not shown.

[0062] The primary means of control 40 is by means of a primary control connection SV1 , in the figure2 is shown as a fine dashed line. The primary control connection SV1 is designed as an electronic control connection, over which the primary control means 40 is capable of several components of the braking system 80 electronically controlled. As in figure 2 shows the primary control means 40 so with the foot brake module 18 , the pressure generator 20 and the pressure regulators 24 , 28 in connection. Via the primary control connection SV1 is the primary means of control 40 also connected to the speed sensors, not shown, and / or other sensors (not shown), such as pressure sensors for detecting the brake pressure, so that speed signals from the wheels 1 or brake pressures applied to the brakes to the primary control means 40 can be transferred.

[0063] The redundancy control means 41 is available by means of a redundancy control connection SV2 , in the figure 2 is shown as a rough dashed line. The redundancy control connection SV2 is designed as an electronic control connection, over which the redundancy control means 41 is capable of several components of the braking system 80 electronically controlled. As in figure 2 shows the redundancy control means 41 so with the pressure regulators 28 and the control device 82 in connection. Via the redundancy control connection SV2 is the redundancy control agent 41 also connected to the speed sensors, not shown, and / or other sensors (not shown), such as pressure sensors for detecting the brake pressure, so that speed signals from the wheels 1 or brake pressures applied to the brakes to the redundancy control means 41 can be transferred.

[0064] The primary control connection SV1 and the redundancy control link SV2 are thus also designed to receive data and measured variables.

[0065] In addition, in a further embodiment that is not shown, there is a control and / or data connection between the primary control means 40 and the redundancy control means 41 provided so that control signals, measured variables and other data and information can be exchanged between the two. This connection can be provided, for example, as a separate connection, or it can be implemented in the vehicle using an already existing infrastructure, such as a CAN-BUS. Above all, this enables the operation of the braking system 80 partly by the primary control agent 40 and partly the redundancy control means 41 .

[0066] The braking system shown 80 has several operating levels (normal operation, first and second redundancy level) in which it can be operated. These are described below with the help of figure 1 and figure 2 described. normal operation

[0067] In normal operation, the braking system is controlled 80 by the primary control agent 40 , which is connected via the primary control connection SV1 controls the components described above. A brake input for the braking system 80 , which can be generated by a driver using the brake pedal or is generated automatically in autonomous operation, is controlled by the foot brake module 18 received electronically and sent to the primary control means 40 transfer. The primary means of control 40 determines the corresponding brake pressures for the front axle from the brake input v.a , the rear axle HA and a trailer. The pressure generator is used to generate these pressures 20 corresponding to the primary control means 40 via the primary control connection SV1 driven. The pressure generator 20 generated from the pressure it takes from the accumulator 10 via the supply line 14b receives the corresponding brake pressures. The brake pressures are via the lines 26 , 27 to the front axle v.a , the rear axle HA and sent the trailer. On the front axle v.a and rear axle HA the brake pressure is adjusted individually for each wheel by the pressure regulator 28regulated. The control of this pressure regulator 28 is carried out by the primary control means 40 electronically via the primary control link SV1 . The primary means of control 40 uses information from the brake system to control the brake pressures, such as the wheel speeds, which it sends via the primary control connection, for example SV1 receives. Furthermore, the primary control means controls 40 also the pressure regulator 24 electronically to a trailer via the brake line 50 to provide a brake pressure and to regulate it. Through the wheel-specific control of the brake pressures by the pressure regulator 28 it is possible to use stabilization functions through the braking system 80 provide that are so pronounced that the vehicle, for example, stabilized driving dynamics, or can be decelerated with the shortest possible braking distance. First level of redundancy

[0068] An error now occurs within the braking system 80 on which a control by the primary control means 40 prevented or at least limited, the control of the braking system 80 now at least in part by the redundancy control means 41 carried out. Such an error can be caused, for example, by an at least partial failure of the primary control means 40 or failure of the primary power source 52 to be marked. The redundancy control means 41 now does not have a control connection to the foot brake module 18 , however, the control device can 82 via the redundancy control connection SV2 control and thus a pneumatic brake input to the control input 19 the foot brake module 18 to transfer. That's the braking system 80 also in the event of a fault in which an electronic control by the primary control means 40 is not possible or only possible to a limited extent, a brake input for the brake system 80 to generate, which also now an autonomous operation is possible. In addition, the foot brake module 18 Receive braking inputs from a driver using a mechanical feed-through. The foot brake module 18 converts all brake inputs into pneumatic control signals and transmits them via the control lines 22 , 23 to the pressure generator 20 who like the foot brake module 18 not with the redundancy control means 41 via the redundancy control connection SV2 connected. The received pneumatic control signals are generated by the pressure generator 20 translated into brake pressures that this for the front axle v.a , the rear axle HA and the trailer to the lines 26 , 27 transmits. On the front axle v.a and rear axle HA the brake pressure is adjusted individually for each wheel by the pressure regulator 28 regulated. The control of this pressure regulator 28 is carried out by the redundancy control means 41 electronically via the redundancy control link SV2 . The redundancy control means 41 uses information from the brake system to control the brake pressures, such as wheel speeds, vehicle acceleration or applied brake pressures, which it transmits via the redundancy control connection, for example SV2 received from appropriate sensors or interfaces. The brake pressure, which is transmitted to the trailer in this embodiment, is transmitted in an unregulated manner because the pressure regulator is electronically regulated 24 not through the redundancy control link SV2 is possible. Through the wheel-specific control of the brake pressures by the pressure regulator 28 it is possible to use stabilization functions in the first redundancy level through the braking system 80 provide that are so pronounced that the vehicle, for example, stabilized driving dynamics, or can be decelerated with the shortest possible braking distance. In addition, further embodiments are conceivable in which, for example, a pressure control for the trailer is also provided. Second level of redundancy

[0069] The second level of redundancy is finally reached when another error occurs. The braking system 80is now no longer due to the redundancy control means 41 or in part by the primary control means 40 and in part by the redundancy control means 41 controllable, for example because the redundancy control means 41 or the redundancy supply source 58 have failed. As a result, all pressure regulators 24 , 28 can no longer be controlled electronically. If this has not already happened in the first redundancy level, these now switch to an open position, so that braking pressure is applied to the wheels in an unregulated manner 1 or a trailer using a brake line 50 is transferred. Autonomous driving is no longer possible at this level, since neither the primary control means 40 nor the redundancy control means 41 can create automated brake inputs as described above. However, a driver's brake inputs can still be applied mechanically through the foot brake module 18 be received. This means that pneumatic control signals are generated by the foot brake module 18 and braking pressures with the help of the pressure generator 20 in the same way as in the first redundancy level. However, these brake pressures are now uncontrolled on the front axle v.a , rear axle HA and trailers because, as described above, regulation is no longer possible. Thus, in the second redundancy level, it is no longer possible to regulate the brake pressure individually for each wheel, which means that it is no longer possible to stabilize the driving dynamics. However, it is still possible to convert a braking input into a vehicle deceleration and to stop the vehicle, whereby the second level of redundancy also contributes to the safety of driving operations.

[0070] The braking system shown here 80 is not to be understood as limiting to the subject matter of the invention. Rather, other braking systems are conceivable, which also represent objects according to the invention. For example, instead of a single pressure generator 20 several pressure generators can also be provided, the brake pressure for only part of the brake system 80 , for example only the rear axle HA , provide.

[0071] However, it remains the essential idea of ​​the invention that an existing electronic brake system is expanded in such a way that it can still be controlled electronically in the first redundancy level. As few components as possible are added to form the first redundancy level, with as many components as possible, such as pressure regulators 28 , are electronically controlled during normal operation and in the first redundancy level. These components are not provided separately for each operating level. Instead, each level of operation accesses the same component, such as pressure regulators 28 or sensors, too.

[0072] In a further embodiment that is not shown, in which a control and / or data connection between the primary control means 40 and the redundancy control means 41 is provided, it is provided that the primary control means 40 and the redundancy control means 41 are not connected to all speed sensors and / or other sensors, such as pressure sensors for detecting the brake pressure. Here are the primary controls 40 and the redundancy control means 41 each with only a part of the speed sensors and / or other sensors in connection, with detected by the sensors variables between the primary control means 40 and the redundancy control means 41 be replaced. Is, for example, the control of the braking system 80 no longer by the primary means of control 40 possible because this has failed, the redundancy control means takes over 41 the control. However, the recorded variables that the primary control means are no longer available 40 had captured. Therefore, the quantities detected by the sensors that are sent to the redundancy control means 41 are transmitted, selected so that here, too, an electronic control of the braking system 80is possible. For example, wheel speeds and brake pressures of one wheel each 1 and the corresponding brake of an axle v.a , HA of the vehicle in order to be able to regulate the brake pressure by axle at least on the basis of these variables.

[0073] figure 3 shows a flowchart of a method according to the invention and figure 4 shows a detailed flow chart of the step S11 out figure 3. The following description of the procedure refers to both drawings.

[0074] After starting the procedure is in one step S11 the operation of the braking system 80 with the help of the primary control agent 40 out figure 1 and figure 2 carried out.

[0075] Furthermore, within a run of the method step S10 executed, in which a check is made as to whether a switching condition has occurred, which is a change S12 the control of the braking system would be caused at least in part from the primary control means to the redundancy control means. A switching condition is given, for example, by an at least partial failure of the primary control means or by a failure of the primary supply source, so that electronic control of the brake system by the primary control means is no longer possible. The redundancy control means can then electronically control the braking system via the in figure 2 shown control connection SV2 carry on.

[0076] in step S11 becomes, for example, at least one step S14 , S16 , S18 , S20 , S22 out figure 4 carried out, which are characterized in detail as follows:

[0077] in step S14 at least one state variable for controlling the brake system is detected. State variables are to be understood here, in particular, as variables that allow conclusions to be drawn about the current operating state of the brake system or of the vehicle in general. In particular, this involves at least one applied brake pressure, vehicle acceleration and / or vehicle speed, at least one wheel speed and the like. In addition, braking inputs from a driver or braking inputs that were generated automatically during autonomous driving, such as steering angles, braking inputs and the like, can also be recorded. The state variables are suitable for enabling a calculation of a required brake pressure, preferably for each individual wheel.

[0078] in step S16 the driving condition of the vehicle is determined, in particular with regard to driving dynamics stability. These are preferably in step S14 determined state variables and / or other variables that are received, for example, via a vehicle BUS. The driving state describes the movement of the vehicle at least on the level. It is therefore described, for example, by two state variables, such as sideslip angle and yaw rate, or longitudinal and lateral acceleration of the vehicle. An evaluation with regard to driving dynamics stability can be carried out, for example, by comparing the values ​​of the driving state with reference values, for example from a mathematical vehicle model operated in parallel. If the driving state deviates too far from the behavior of the vehicle model, it can be concluded that the driving state is unstable in terms of driving dynamics. Other evaluation methods are known to the person skilled in the art from the prior art.

[0079] in step S18 brake pressure is generated, which is used to control at least one brake of the vehicle. As a result, a braking torque is applied to the corresponding wheel on at least one brake. When generating the brake pressure, in particular, in step S16 Determined driving condition and / or in step S14 detected state variables are taken into account, so that the vehicle can be stabilized in terms of driving dynamics by selectively activating individual brakes.

[0080] in step S20 information that is essential for the operation of the braking system is determined. Including fall next to the in stepS14 detected state variables and / or in step S16 determined driving condition, also other information, such as which monitoring and diagnostic functions for checking the brake system are currently active, whether and which control functions for the brake pressure, for example anti-lock braking system, traction control, etc. are currently active, which components, for example pressure regulators and / or pressure generators of the braking system are currently being controlled, or which error states, for example individual components of the braking system, are currently present.

[0081] in step S22 this information, which is essential for the operation, is transferred to the redundancy control means. This means it is able to take over control of the braking system at any time. The step can S22 be executed continuously so that the primary and redundant control means always have the same information, or step S22 takes place only when changing the controller according to step S12 he follows.

[0082] The process steps listed do not necessarily have to be processed in the order shown. Rather, further sequences of the method according to the invention can be represented in which the sequence of individual steps is reversed or individual steps are also omitted. The method according to the invention is also designed to be processed continuously during operation of the vehicle, with individual steps, such as the steps S14 , S16 and S20 , can be processed in parallel.

[0083] When performing the procedure or when operating the braking system in general 80 it is also irrelevant whether the vehicle is currently in autonomous driving mode or whether the vehicle is being controlled by a driver. The braking system 80 in figure 1 and figure 2 is designed in such a way that it can implement both braking inputs via the brake pedal and braking inputs resulting from autonomous driving. The conversion in the primary control level takes place electronically by electronic detection of a brake input by the foot brake module 18 and by electronic control of the pressure generator 20 and the pressure regulator 24 , 28 by the primary control agent 40 . In the first redundancy level, the control takes place partly electronically, partly pneumatically, with the electronic control being carried out by the redundancy control means 41 he follows. Brake inputs from a driver can be made via the foot brake module 18 be received, at the same time can also be a pneumatic brake input from the control device 82 in autonomous driving to the foot brake module 18 be transmitted. The foot brake module 18 , which is now no longer electronically controlled, generates pneumatic control signals from these brake inputs, which are sent to the pressure generator 20 are passed, which is designed to generate the brake pressures using the pneumatic control signals. In the shown embodiment of the braking system 80 eventually become the pressure regulators 28 by the redundancy control means 41 electronically controlled, so that here too, at least in the towing vehicle, an electronically controlled wheel-specific regulation of the brake pressure is possible.

[0084] The embodiments shown do not have a limiting effect on the subject matter of the invention. Rather, further embodiments are also conceivable, which, however, do not call into question the principle according to the invention. For example, a braking system according to the invention can also have several pressure generators that generate braking pressure, for example, only for sections of the braking system, such as individual axles or a trailer. Combinations of pressure generators and pressure regulators can also be provided, which, for example, not only generate a brake pressure but also regulate it at the same time. These combinations can also supply braking pressure to only sections of the braking system, for example.

[0085] Additionally, the vehicle may be configured to tow more than one trailer. The braking system can 80be trained to influence the brake pressure for each trailer individually or for all together.

[0086] The braking system 80 then has a trailer module, for example 24 on, which is designed to influence the brake pressure of the trailer.

[0087] The embodiments explained here do not restrict the subject matter of the invention thereto, but only show preferred embodiments of the invention. In addition, further embodiments are conceivable, which can be obtained by combining individual features of different embodiments. Reference List 1 wheel 2 axis 3 brake disc 4 brake pad 10 accumulator (compressed air source) 13 control line 14 supply line 14a supply line 14b supply line 15 supply input (foot brake module) 16 control output (foot brake module, interface for v.a and trailer) 17 control output (foot brake module, interface for HA ) 18 foot brake module 19 Foot brake module control input 20 pressure generators 22 control line (for v.a and trailer module 24 ) 23 control line (for HA ) 24 pressure regulator (trailer module) 26 line 27 line 28 pressure regulator (pressure control valve) 29 brake line 40 primary control means (control unit) 41 redundancy control means (control unit) 50 brake line (to trailer) 52 Primary Power Source 58 Redundancy supply source 80 braking system 82 control device 83 supply input (control device) 84 control output (control device) S10 Check whether a switching condition has occurred S11 operation of the braking system via the primary control means S12 Changing the control of the brake system at least partially from the primary control means to the redundant control means when a switching condition occurs S14 detecting at least one state variable for controlling the braking system S16 Determination of the driving condition, in particular with regard to dynamic driving stability S18 generation of brake pressure to control at least one brake depending on the driving condition S20 Determination of essential information for the operation of the braking system S22 transfer of the information essential for the operation of the braking system to the redundancy control means SV1 (electronic) primary control link SV2 (electronic) redundancy control link HA rear axle VA front axle

Claims

[1] Braking system (80) for a vehicle which is designed to detect at least one state variable for controlling the braking system (80), comprising: - a primary control means (40) designed to control the braking system (80) by means of at least one actuator and taking into account at least one state variable, - a redundancy control means (41) configured to control the braking system (80) by means of a part of the at least one actuator and taking into account a part of the at least one state variable, wherein the braking system (80) is configured to, upon the occurrence of at least one switching condition, no longer exclusively by means of the primary control means (40), but at least partly by means of the redundancy control means (41). [2] Braking system (80) according to claim 1, comprising: - at least one actuator designed to influence a brake pressure for controlling at least one brake of the braking system (80), and / or - at least one detection device designed to detect at least one state variable for controlling the braking system (80). [3] Braking system (80) according to any of the preceding claims, wherein the braking system (80) as an electropneumatic braking system, and / or is trained for autonomous operation, and / or wherein the braking system (80) is designed to be electronically controlled by the primary control means (40) and / or the redundancy control means (41). [4] Brake system (80) according to one of claims 2 or 3, wherein the at least one actuator is a pressure generator (20) configured to generate the brake pressure, in particular from a pressure accumulator (10), and / or a pressure regulator (24, 28) configured to control and / or regulate the brake pressure. [5] Braking system (80) according to one of claims 2 to 4, wherein the at least one detection means has a sensor configured to detect the at least one state variable and / or has an interface configured to obtain the at least one state variable from a vehicle network. [6] Braking system (80) according to one of the preceding claims, wherein the at least one state variable is in particular a wheel speed, a velocity, an acceleration, a wheel torque, a brake pressure, or another suitable variable to determine a driving condition, in particular with regard to driving dynamic stability. [7] Braking system (80) according to one of the preceding claims, wherein the primary control means (40) is configured to be supplied with energy by a primary supply source (52) and the redundancy control means (41) is configured to be supplied with energy by a redundancy supply source (58). [8] Braking system (80) according to one of the preceding claims, wherein a switching condition is a failure of the primary supply source (52) and / or an at least partial failure of the primary control means (40). [9] Braking system (80) according to one of the preceding claims, wherein the braking system (80) is configured to be at least partially electronically controlled by the redundancy control means (41). [10] Brake system (80) according to any one of the preceding claims, comprising: - at least one control device (82) configured to generate a non-electronic brake input for the brake system (80) in order to trigger braking by the brake system (80), wherein the control device (82) is configured to be controlled, in particular electronically, by the redundancy control means (41). [11] Braking system (80) according to claim 10, comprising: - a foot brake module (18) configured to generate at least one control signal for generating brake pressure from a brake input, wherein the brake signal is optionally electronic or pneumatic, wherein the foot brake module (18) and the control device (82) are formed as one piece or separately. [12] Method for operating a braking system (80) according to any one of claims 1 to 11, comprising the following steps: - Check (S10) whether a switching condition has occurred; - Switching (S12) the control of the brake system (80) from the primary control means (40) at least partially to the redundancy control means (41) when a switching condition occurs. [13] The method of claim 12, comprising at least one of the steps: - Acquisition (S14) of at least one state variable for controlling the braking system (80); - Determining (S16) the driving condition, in particular with regard to driving dynamic stability; - Generating (S18) brake pressure to control at least one brake depending on the driving condition; - Determine (S20) essential information for the operation of the braking system (80); - Transfer (S22) of the information essential for the operation of the braking system (80) to the redundancy control medium (41), the transfer taking place during the at least partial switch from the primary control medium (40) to the redundancy control medium (41) or even before. [14] Method according to claim 13, wherein the information essential for the operation of the brake system (80) is in particular information on - applied brake pressures, - at least one state variable, in particular a wheel speed, a velocity, an acceleration, a wheel torque, a brake pressure, or another suitable variable, is used to determine the driving condition, especially with regard to driving dynamic stability, - ongoing monitoring functions, in particular for monitoring the at least one actuator and / or the at least one detection device, - ongoing control functions, in particular for controlling and / or regulating wheel slip and / or vehicle dynamic stability, - controlled actuators, in particular - include existing fault conditions, in particular of the at least one actuator and / or the at least one sensor. [15] Method according to any one of claims 12 to 14, wherein a switching condition is a failure of the primary supply source (52) and / or an at least partial failure of the primary control means (40). [16] Computer program product comprising program code stored on a machine-readable medium, configured, when executed on a data processing device, to cause the data processing device to execute the method according to any one of claims 12 to 15.

Images