ELECTRONIC HYDRAULIC BRAKE DEVICE AND CONTROL METHOD FOR IT

Abstract

Electronic hydraulic brake device with: a brake unit (10) comprising a master brake unit (1) configured to supply a plurality of wheel cylinders (3) with hydraulic brake pressure by means of a motor operation, and an auxiliary brake unit (2) connected to the master brake unit (1) in such a way that it is filled with high hydraulic brake pressure and configured to supply the plurality of wheel cylinders (3) with hydraulic brake pressure when an operational fault of the master brake unit (1) occurs; a first control unit (200) designed to control the actuation of the brake unit (10) and configured to control the auxiliary brake unit (2) such that it is actuated when an operational fault of the main brake unit (1) occurs; and a second control unit (300) configured to assist part of the control of the main brake unit (1) controlled by the first control unit (200) and the control of the auxiliary brake unit (2), where the first and second control units (200, 300) can determine through communication whether the state of the other unit is normal, characterized by that if the investigation result indicates that one of the first or the second control unit (200, 300) is operating abnormally, the other of the first and second control units (200, 300) performs a recovery operation in which the control unit that is operating abnormally is forcibly reset.

Description

CROSS-REFERENCE TO RELATED REGISTRATION BACKGROUND TECHNICAL AREA

[0001] The present invention relates to an electronic hydraulic brake device capable of reliably ensuring the braking stability of a vehicle, and a control method for it. DISCUSSION OF THE STATE OF THE TECHNOLOGY

[0002] The development trend for electric / hybrid vehicles has focused on autonomous vehicles, and a malfunction of an electronic braking system in an autonomous vehicle poses a serious danger to an occupant while the vehicle is in motion. Examples of malfunctions of the electronic braking system include malfunctions of the hydraulic system, the power system, and the control system. Of these malfunctions, a malfunction of the control system carries the highest risk.

[0003] In the current state of the art, a microcontroller unit (MCU) uses multiple cores to focus on monitoring for faults between cores, and a mechanical backup braking device is installed to prepare for a complete MCU failure. This means that if the MCU is damaged, the brake control is disabled, and a driver must apply the mechanical brake to stop the vehicle. In this case, even in autonomous mode (SCC mode), the driver must monitor the vehicle's condition to ensure braking stability. However, since it is difficult to expect the driver to monitor the vehicle's operational state in such a situation, especially given that autonomous vehicles are designed to achieve fully autonomous driving, the mechanical backup braking device may no longer be able to protect the driver.

[0004] To operate an autonomous driving system, a braking device must be used, which is activated according to a command from the autonomous driving system or a braking command from the driver. Currently, a hydraulic braking device using a motor pump or a mechanical braking device using a motor is used and is referred to as the primary braking device. In addition, the autonomous driving system is configured so that a backup braking device can be used simultaneously by a driver, as a malfunction or disruption of the primary braking device may occur while driving. If a braking command is issued while a vehicle is being driven by a human driver, the driver can compensate for a disruption of the primary braking device using the backup braking device, since the driver is in control of the vehicle.In autonomous mode, where driver intervention is minimized or a driver does not intervene in the operation, the driver cannot cope with the malfunction of the main braking device or a delay in reaction time is inevitable.

[0005] The foregoing describes technical information that the present inventor has retained in order to derive the present disclosure or that he obtained during the derivation process of the present disclosure. The foregoing does not necessarily relate to a publicly known technique that becomes publicly available prior to the filing of the present disclosure. [Statement of the Art][Patent Specification]

[0006] (Patent specification 1) Korean patent application no. 2015-0103905. DE 102 15 867 A1 discloses an electronic hydraulic brake device with the features of the preamble of claim 1. OVERVIEW

[0007] The object of the present invention is to provide an electronic hydraulic braking device comprising an auxiliary braking device for supporting a main braking device and which actuates the auxiliary braking device in the event of a malfunction of the main braking device in order to brake a vehicle stably without operation by a driver, and a method for doing so. The problem underlying the invention is solved by the features of claims 1, 3, 7 and 9.

[0008] Various embodiments relate to an electronic hydraulic brake device comprising a main control unit for controlling the electronic brake device and a sub-control unit for monitoring the main control unit, and controlling the sub-control unit in such a way that it performs brake control in place of the main control unit when the main control unit is out of operation or a fault occurs in the main control unit, thereby improving the braking stability of a vehicle, as well as a control method for this.

[0009] In one embodiment of the invention, an electronic hydraulic brake device comprises: a brake unit with a master brake unit configured to supply a plurality of wheel cylinders with hydraulic brake pressure by operating a motor, and with an auxiliary brake unit connected to the master brake unit in such a way that it is filled with high hydraulic brake pressure and is configured to supply the plurality of wheel cylinders with hydraulic brake pressure when an operational fault of the master brake unit occurs; a first control unit designed to control the actuation of the brake unit and configured to control the auxiliary brake unit so that it is actuated when an operational fault of the master brake unit occurs;and a second control unit configured to assist with part of the control of the master brake unit, which is controlled by the first control unit, and the control of the auxiliary brake unit. The first and second control units can determine, by communication, whether the state of the other unit is normal, and if the determination result indicates that one of the first or second control units is operating abnormally, the other of the first and second control units performs a recovery operation in which the control unit operating abnormally is forcibly reset.

[0010] If the investigation results indicate that the first control unit is operating abnormally, the second control unit can perform a recovery operation in which the first control unit, which is operating abnormally, is forcibly reset while part of the first control unit's function is executed. If the investigation results indicate that the second control unit is operating abnormally, the first control unit can perform a recovery operation in which the second control unit, which is operating abnormally, is forcibly reset.

[0011] In a further embodiment of the invention, an electronic hydraulic brake device comprises: a brake unit with a master brake unit configured to supply a plurality of wheel cylinders with hydraulic brake pressure by operating a motor, and with an auxiliary brake unit connected to the master brake unit in such a way that it is filled with high hydraulic brake pressure and is configured to supply the plurality of wheel cylinders with hydraulic brake pressure when an operating fault of the master brake unit occurs; a first control unit designed to control the actuation of the brake unit and configured to control the auxiliary brake unit so that it is actuated when an operating fault of the master brake unit occurs;and a second control unit configured to assist in part of the control of the master brake unit, which is controlled by the first control unit, and in part in the control of the auxiliary brake unit. The first and second control units can determine, by communication, whether the condition of the other unit is normal, the first control unit comprising: a first-first control unit configured to control the actuation of the master brake unit; and a first-second control unit configured to control the actuation of the auxiliary brake unit, as well as to control an actuation of the stability control part contained in the master brake unit, which sets hydraulic brake pressure supplied to the wheel cylinders. The second control unit can assist in the control of the first-second control unit.

[0012] If, during the commissioning of a vehicle, a test result for the master brake unit by the first-first control unit, a test result for the auxiliary brake unit by the first-second control unit, and a test result for the second control unit by the first control unit indicate that the master brake unit, the auxiliary brake unit, and the second control unit are normal, the first-second control unit can check the preset pressure to be generated in the auxiliary brake unit.If, upon starting the vehicle, the test result for the master brake unit by the first control unit, the test result for the auxiliary brake unit by the first control unit, and the test result for the second control unit by the first control unit indicate that a fault has occurred in one or more of the master brake unit, the auxiliary brake unit, and the second control unit, appropriate control measures can be taken and information about the situation in which the fault occurred, as well as information about whether the vehicle is being driven after the fault occurred, can be provided to the driver.

[0013] The master brake unit may comprise: a pedal cylinder configured to generate hydraulic pressure when a pedal is pressed; a master cylinder configured to sense the pedal and generate hydraulic pressure through the operation of the motor; a first hydraulic section connected to the master cylinder and configured to supply hydraulic brake pressure to some of the plurality of wheel cylinders; a second hydraulic section connected to the master cylinder and configured to supply hydraulic brake pressure to the other plurality of wheel cylinders; and a hydraulic connecting section configured to connect or disconnect the first and second hydraulic sections.

[0014] The auxiliary brake unit may include: an auxiliary hydraulic section connected to one of the first and second hydraulic sections to convey hydraulic brake pressure; an auxiliary accumulator connected to the auxiliary hydraulic section and filled with high hydraulic brake pressure; an auxiliary bypass section configured to supply hydraulic brake pressure to the auxiliary accumulator by bypassing the auxiliary hydraulic section; an auxiliary sensing section designed to measure hydraulic brake pressure of the auxiliary accumulator; and an auxiliary pump connected to a storage unit connected to the pedal cylinder in such a way as to store hydraulic brake pressure and supply the hydraulic brake pressure stored in the storage unit to the auxiliary accumulator.

[0015] In one embodiment of the invention, a control method for an electronic hydraulic brake device comprises: controlling, by means of a first control unit, an actuation of a brake unit and controlling an auxiliary brake unit for actuation upon the occurrence of an operational fault of a master brake unit, wherein the brake unit comprises the master brake unit configured to supply hydraulic brake pressure to a plurality of wheel cylinders by operation of a motor, and the auxiliary brake unit connected to the master brake unit to be filled with high hydraulic brake pressure and configured to supply hydraulic brake pressure to the plurality of wheel cylinders when an operational fault of the master brake unit occurs; and assisting, by means of a second control unit, a part of the control of the master brake unit controlled by the first control unit, as well as the control of the auxiliary brake unit.The first and second control units can determine through communication whether the state of the other unit is normal, whereby, if the result of the determination of the mutual state indicates that one of the first or the second control unit is operating abnormally, the corresponding other of the first and second control units will perform a recovery operation to forcibly reset the control unit that is operating abnormally.

[0016] The procedure may further include: performing, by means of the second control unit, a recovery operation in which the first control unit, which is operating abnormally, is forcibly reset while part of the function of the first control unit is being performed, if the result obtained by determining the state of each other unit through communication indicates that the first control unit is operating abnormally; and performing, by means of the first control unit, a recovery operation in which the second control unit, which is operating abnormally, is forcibly reset, if the result obtained by determining the state of each other unit through communication indicates that the second control unit is operating abnormally.

[0017] In a further embodiment of the invention, the control method of an electronic hydraulic brake device comprises: controlling, by means of a first control unit, an actuation of a brake unit and controlling an auxiliary brake unit for actuation in the event of an operational fault of a main brake unit, wherein the brake unit comprises the main brake unit, which is configured to supply hydraulic brake pressure to a plurality of wheel cylinders by operation of a motor, and the auxiliary brake unit, which is connected to the main brake unit to be filled with high hydraulic brake pressure and is configured to supply hydraulic brake pressure to the plurality of wheel cylinders when an operational fault of the main brake unit occurs; and assisting, by means of a second control unit, a part of the control of the main brake unit, which is controlled by the first control unit, as well as the control of the auxiliary brake unit.The first and second control units can determine through communication whether the state of the other unit is normal. Control of the brake unit's actuation includes: controlling, by means of a first-first control unit, the actuation of the master brake unit; controlling, by means of a first-second control unit, the actuation of the auxiliary brake unit; and controlling the actuation of the stability control unit, which is contained within the master brake unit and sets the hydraulic brake pressure to be supplied to the wheel cylinders. Supporting the master brake unit's control may include supporting the control of the first-second control unit.

[0018] The control procedure may further include: controlling a preset pressure to be generated in the auxiliary brake unit, under control of the first-second control unit, when a test result for the master brake unit by the first-first control unit, a test result for the auxiliary brake unit by the first-second control unit and a test result for the second control unit by the first control unit during commissioning of a vehicle indicate that the master brake unit, the auxiliary brake unit and the second control unit are normal;and performing appropriate control measures for a fault and providing information to the driver about the situation in which the fault occurred and information about whether the vehicle was driven after the fault occurred, if the test result for the master brake unit by the first control unit, the test result for the auxiliary brake unit by the first control unit and the test result for the second control unit by the first control unit during the start-up of the vehicle indicate that a fault has occurred in one or more of the master brake unit, the auxiliary brake unit and the second control unit.

[0019] Furthermore, another method and system for implementing the present disclosure and a computer program for carrying out the method may also be provided.

[0020] According to the present disclosures, the electronic hydraulic brake device can be added to an autonomous driving system with the auxiliary brake device to support the main brake device and actuate the auxiliary brake unit in the event of a malfunction of the main brake device in order to brake a vehicle stably without the intervention of a driver.

[0021] Furthermore, the electronic hydraulic brake device can include the main control unit for controlling the electronic hydraulic brake device and the sub-control unit for monitoring the main control unit, and control the sub-control unit in such a way that it performs brake control instead of the main control unit when the main control unit is out of service or a fault occurs in the main control unit, thereby improving the braking stability of a vehicle. BRIEF DESCRIPTION OF THE DRAWINGS Fig. Figure 1 is a figure illustrating a schematic description of an electronic hydraulic brake device according to an embodiment of the present disclosure. Fig. Figures 2 to 4 are flowcharts describing a control method of an electronic hydraulic brake device according to an embodiment of the present disclosure. Fig. Figure 5 is a diagram describing I2C (Inter-Integrated Communication) and redundancy flows of the control unit under a first control unit, a second control unit, and an ASIC (Application Specific Integrated Circuit), which are shown in Fig. 1 are shown. Fig. Figure 6 is a diagram describing the structure of a redundancy message from a control unit, which is located in Fig. 5 is shown. Fig. Figure 7 is a flowchart illustrating a control method of an electronic hydraulic brake device according to another embodiment of the present disclosure. Fig. 8 is a table describing a control unit determination algorithm for each control unit malfunction during driving in Fig. 7. DETAILED DESCRIPTION OF THE ILLUSTRATED FORM OF EXECUTION

[0022] The advantages and properties of the present disclosure and a method for achieving the advantages and properties are illustrated by the following embodiments, which are described in detail with reference to the associated drawings.

[0023] The terms used in this application serve only to describe a specific embodiment. Unless otherwise stated, singular terms may also include plural forms. In this application, the meaning of "have" or "comprise" indicates a property, a number, a step, a process, an element, a component, or combinations thereof, but does not inherently exclude one or more other properties, numbers, steps, processes, elements, components, or combinations thereof. Terms such as "first" and "second" may be used to describe different elements. These terms are used solely to distinguish one element from another.

[0024] In the following, embodiments of the present disclosure are described in detail with reference to the accompanying drawings. In the following descriptions, identical or corresponding elements are designated with the same reference numerals, and overlapping descriptions are avoided.

[0025] Fig. Figure 1 is a schematic representation of an electronic hydraulic brake device according to an embodiment of the present disclosure. Referring to Fig. 1 The electronic hydraulic brake device can include a brake unit 10, a first control unit 200, a second control unit 300, an ASIC (Application Specific Integrated Circuit) 400 and a warning unit 500.

[0026] The brake unit 10 can comprise a master brake unit 1 and an auxiliary brake unit 2. The master brake unit 1 can drive a motor such that it supplies a plurality of wheel cylinders 3 with hydraulic brake pressure. The auxiliary brake unit 2 can be connected to the master brake unit 1 and filled with high hydraulic brake pressure. The auxiliary brake unit 2 can supply the plurality of wheel cylinders 3 with hydraulic brake pressure if an operational fault occurs in the master brake unit 1. That is to say, the electronic hydraulic brake device according to the embodiment of the present disclosure can have a structure in which an electronic brake device of an electric / hybrid vehicle or an autonomous vehicle is divided into the master brake unit 1 and the auxiliary brake unit 2.Furthermore, if a malfunction occurs in the master brake unit 1, the high hydraulic brake pressure stored in the auxiliary brake unit 2 can be quickly supplied to the wheel cylinders 3 to perform emergency braking. The malfunction in the master brake unit 1 may include a fault caused by the disabled engine or malfunctions of various valves controlling a hydraulic circuit.

[0027] In the present embodiment, the master brake unit 1 can comprise a pedal cylinder 110, a master brake cylinder 120, a first hydraulic part 130, a second hydraulic part 140, and a hydraulic connecting part 150. The pedal cylinder 110 can generate hydraulic pressure when a pedal 119 is pressed. The pedal cylinder 110 can form two chambers and provide a pedal force corresponding to the pressure applied to the pedal 119. The master brake cylinder 120 can sense whether the pedal 119 is being actuated and generate hydraulic pressure by operating a motor 129. The master brake cylinder 120 can form one chamber, and the motor 129 can be driven in a forward or reverse direction according to the pressure state of the pedal 119. The master brake cylinder 120 can be connected to the pedal cylinder 110 by a cylinder line 128.The first hydraulic component 130 can be connected to the master brake cylinder 120 and direct the hydraulic brake pressure to some of the plurality of wheel cylinders 3. For example, the first hydraulic component 130 can direct hydraulic pressure to the first wheel cylinders 31, which are mounted on one of the two front wheels or one of the two rear wheels. More precisely, the first hydraulic component 130 can have a first-to-first hydraulic line 131 and a first-to-second hydraulic line 132. The first-to-first hydraulic line 131 can be connected to the master brake cylinder 120 to direct hydraulic brake pressure, and the first-to-second hydraulic line 132 can be connected to the first-to-first hydraulic line 131 and diverge to direct hydraulic pressure to the first wheel cylinders 31. The second hydraulic component 140 can be connected to the master brake unit 120 and direct hydraulic brake pressure to the other plurality of wheel cylinders 3.For example, the second hydraulic part 140 can direct hydraulic brake pressure to second wheel cylinders 32, which are mounted on the opposite of the two front wheels and the opposite of the two rear wheels, respectively. More precisely, the second hydraulic part 140 can have a second-first hydraulic line 141 and a second-second hydraulic line 142. The second-first hydraulic line 141 can be connected to the master brake cylinder 120 to direct hydraulic brake pressure, and the second-second hydraulic line 142 can be connected to the second-first hydraulic line 141 and diverge to direct hydraulic brake pressure to the second wheel cylinders 32. The hydraulic connecting part 150 can connect or disconnect the first and second hydraulic parts 130 and 140. For example, the hydraulic connecting part 150 can connect the first-second hydraulic line 132 and the second-second hydraulic line 142.

[0028] In the present embodiment, the auxiliary brake unit 2 can comprise an auxiliary pump 50, a first auxiliary hydraulic section 61, a second auxiliary hydraulic section 62, an auxiliary accumulator 70, a first auxiliary bypass section 81, a second auxiliary bypass section 82, and an auxiliary sensor section 90. The hydraulic connecting section 150 can prevent the hydraulic brake pressure from moving between the first and second hydraulic sections 130 and 140, respectively, in order to maintain the state in which the first and second hydraulic sections 130 and 140 are separated. The auxiliary pump 50 can be connected to an accumulator 118, which is connected to the pedal cylinder 110, to temporarily store the hydraulic brake pressure and forcefully transmit the hydraulic brake pressure stored in the accumulator 118 to the auxiliary accumulator 70.Since hydraulic brake pressure can be continuously supplied to the auxiliary accumulator 70 by the auxiliary pump 50, vehicle braking can be carried out continuously, even if an operational fault occurs in the main brake unit 1, such as a malfunction of the motor 129. The first auxiliary hydraulic section 61 can be connected to the first hydraulic section 130 for conveying hydraulic brake pressure, and the second auxiliary hydraulic section 62 can be connected to the second hydraulic section 140 for conveying hydraulic brake pressure. The first auxiliary hydraulic section 61 can be connected to the first-second hydraulic line 132, and the second auxiliary hydraulic section 62 can be connected to the second-second hydraulic line 142. The auxiliary accumulator 70 can be connected to the auxiliary pump 50, the first auxiliary hydraulic section 61, and the second auxiliary hydraulic section 62, and can be filled with high hydraulic brake pressure.The first auxiliary bypass element 81 can direct hydraulic brake pressure to the auxiliary accumulator 70 by bypassing the first auxiliary hydraulic element 61, and the second auxiliary bypass element 82 can direct hydraulic brake pressure to the auxiliary accumulator 70 by bypassing the second auxiliary hydraulic element 62. For example, the auxiliary accumulator 70 can be filled with hydraulic brake pressure by the first or the second auxiliary bypass element 81 or 82, and the hydraulic brake pressure of the auxiliary accumulator 70 can be directed to the first and second auxiliary bypass elements 81 and 82. The auxiliary sensor element 90 can measure the hydraulic brake pressure of the auxiliary accumulator 70. For example, the auxiliary sensor element 90 can be configured in the first and second auxiliary hydraulic elements 61 and 62 or in the auxiliary accumulator 70 to measure hydraulic brake pressure.In such a state, the motor 129 can be driven to fill the auxiliary accumulator 70 with high hydraulic brake pressure in the initial stage. Subsequently, the hydraulic brake pressure generated by the master brake cylinder 120 can be transferred to the auxiliary accumulator 70. The transfer of hydraulic brake pressure to cylinder line 128 and to the first and second wheel cylinders 31 and 32 may be restricted. If an operational fault of the master brake unit 1 occurs, requiring braking of the vehicle, the high hydraulic brake pressure stored in the auxiliary accumulator 70 can be transferred to the first-second hydraulic line 132 and the second-second hydraulic line 142, and then to the first and second wheel cylinders 31 and 32.The movement of the hydraulic brake pressure to the first hydraulic line 131 and the second hydraulic line 141 can be restricted. When the first hydraulic line 131 and the second hydraulic line 141 are open during braking of the vehicle by means of the auxiliary brake unit 2, the hydraulic brake pressure of the wheel cylinder 3 can be relieved. If the hydraulic brake pressure needs to be relieved quickly, as in vehicle stability control, the hydraulic brake pressure applied to the wheel cylinder 3 can also be adjusted by controlling valves of the first hydraulic line 132 and the second hydraulic line 142.

[0029] In the embodiment of the present disclosure, the first control unit 200 can serve as a main control unit capable of controlling the overall operation of the brake unit 10, including the main brake unit 1 and the auxiliary brake unit 2, and controlling the auxiliary brake unit 2 such that it is actuated when an operational fault occurs in the main brake unit 1. The second control unit 300 can serve as a sub-control unit, supporting the control of the auxiliary brake unit 2, which is controlled by the first control unit 200, and the control (stability control) of the hydraulic brake pressure supplied to the wheel cylinders 3. In the present embodiment, the first and second control units 200 and 300 can determine, through communication, whether the condition of the other unit is normal.

[0030] Between the first and second control units 200 and 300, two digital hardware signals, Rm and Rs, can be used for a hard reset, and the first control unit 200, the second control unit 300, and the ASIC 400 can perform I2C (Inter-Integrated Communication). Sensors (not shown) are connected to the first and second control units 200 and 300, and a sensor value and a disturbance value, transmitted by the ASIC 400, are input to the first control unit 200 and the second control unit 300 via an I2C line. In the present embodiment, the ASIC 400 can include a motor drive and a valve drive, which, under the control of the first control unit 200, supply current to a motor and a valve, respectively.When the vehicle is put into operation, the first control unit 200 can be set to a master control unit, the second control unit 300 can be set to a slave control unit, and ASCI 400 can be set to a slave control unit. The master control unit can perform vehicle brake control, and the slave control unit can determine the status of the master control unit, the vehicle status, a calculation state, and the like. If the master control unit can no longer function as master, the slave control unit can switch to the master control unit and act as the master in the I2C interface. Subsequently, the failed master control unit can be reset and restored.Once the master control unit is fully restored, the master and slave control units can be synchronized, and the former master control unit can be switched to the slave control unit and function as a slave. To fundamentally prevent errors caused by a memory allocation method (not shown), the first and second control units 200 and 300 can be configured as independent components with separate memory. The first control unit 200, used in the present embodiment, can be configured to function similarly to the main control unit and the master control unit, or it can be configured to encompass both the main control unit and the master control unit.The second control unit 300 used in the present embodiment can be designed to have a similar function to the sub-control unit and the slave control unit, or can be designed to include the sub-control unit and the slave control unit.

[0031] In another embodiment of the present disclosure, the first control unit 200, which serves as the main control unit, can comprise a first-first control unit 210 and a first-second control unit 220. The first-first control unit 210 can serve as a master brake control unit for controlling an actuation of the master brake unit 1, and the first-second control unit 220 can serve as an auxiliary brake control unit for controlling an actuation of a stability control element 1-1 of the master brake unit 1 and an actuation of the auxiliary brake unit 2. The stability control element 1-1 can comprise valves for adjusting a hydraulic brake pressure supplied to the wheel cylinders 3.The first-second control unit 220 can include a first-second-first control unit 221, which serves as a stability control unit for controlling the actuation of the stability control section 1-1 of the main brake unit 1, and a first-second-second control unit 222, which serves as a backup brake control unit for controlling the actuation of the auxiliary brake unit 2. The auxiliary brake control unit can be configured to have a similar function to the backup brake control unit or to include the backup brake control unit.Furthermore, the second control unit 300, which serves as the sub-control unit, can support actuation of the first-second control unit 220, that is, actuation of the first-second-first control unit 221, which serves as the stability control unit for controlling the actuation of the stability control section 1-1 of the master brake unit 1, and actuation of the first-second-second control unit 222, which serves as the backup brake control unit for controlling the actuation of the auxiliary brake unit 2. If an operational fault occurs in the master brake unit 1, the first control unit 200 can control actuation of the auxiliary brake unit 2. If the first control unit 200 is out of service or an operational fault occurs in the first control unit 200, the second control unit 300 can replace part of the function of the first control unit 200.If one or more components of the brake unit 10 and the control units operate abnormally, the warning unit 500 can emit a warning light or signal and provide information on whether operation is possible, so that the driver can recognize the abnormality. The abnormality used in the present embodiment can be analyzed in a similar sense to the occurrence of a malfunction or fault, or can be analyzed in such a way as to include the occurrence of a malfunction or fault.

[0032] Fig. Figure 2 is a flowchart illustrating a control procedure for an electronic hydraulic brake device for a vehicle according to an embodiment of the present disclosure. The following description refers to a description of contents that correspond to those of Fig. 1. Cover, waived. Referring to Fig. In step S211, when a motor is switched on, the first control unit 200 and the second control unit 300 are initialized in step S213. In step S215, the first control unit 200 is configured as the master control unit and the second control unit 300 as the slave control unit. In step S217, the master control unit and the slave control unit perform time synchronization using SPI (Serial Peripheral Interface) communication. In step S219, the master control unit and the slave control unit determine the state of the other unit. If the result of the determination in step S219 indicates that the state of the other unit is normal, vehicle brake control is initiated in step S221. In step S233, the vehicle brake control is initiated by the control unit's redundancy logic.According to the control unit's redundancy logic, the control units operate differently depending on the state of the other unit. In step S225, the master control unit determines whether the engine is switched off. If step S225 determines that the engine is switched off, the master control unit completes the vehicle braking control. If step S225 determines that the engine is switched on, the master control unit transmits current state information and a calculated value to the slave control unit in step S227. In step S229, the slave control unit determines, based on this data, whether the master control unit has failed. If it determines that the master control unit has failed, the slave control unit executes the vehicle braking by applying the control unit's redundancy logic in step S223.Similarly, if the master control unit is determined to have failed, it executes the control unit's redundancy logic to restore the slave control unit.

[0033] Fig. 3 is a flowchart showing a procedure for performing the redundancy logic of the control unit in step S223 from Fig. 2. The following description refers to a description of content that deals with that from the Fig. 1 and Fig. 2 covers, waived. Referring to Fig. 3. For the control unit's redundancy logic, it is important to determine which control unit has failed, whether the fault has an impact on the control, and whether the control is currently being carried out. Since the master and slave control units monitor each other and perform a state change (from master to slave and from slave to master), the recovery logic for the faulty control unit is present on both the master and slave control units.

[0034] In step S311, the master control unit and the slave control unit send / receive current status information to / from each other. In step S313, the master control unit determines whether a fault has occurred. If no fault occurs, the vehicle brake control is performed in step S315.

[0035] In step S317, the master control unit can check for a fault mode. If the fault is an existing fault with an error code, the master control unit can determine in step S319 whether the fault is an actuator fault or a master control unit fault. If step S319 determines that the fault is an actuator fault, the master control unit determines in step S323 whether the fault affects brake control. If the fault does not affect brake control, the master control unit does not perform a state change but instead initiates vehicle brake control in step S315. However, if the fault does affect brake control, the slave control unit, in step S327, wakes up a vehicle control algorithm using an algorithm for monitoring a fault and determining only the current state, and then switches to the master control unit to initiate vehicle brake control.Simultaneously, the recovery logic of the faulty control unit is activated separately in step S329 to restore the control unit in which the fault occurred. If steps S319 and S331 determine that the fault is a master control unit fault, the slave control unit switches to the master control unit in step S327 to start the vehicle brake control. Simultaneously, the recovery logic of the faulty control unit is activated in step S329 to restore the control unit in which the fault occurred.

[0036] If the test result from step S317 indicates that a communication abnormality, a time value interruption, a control mode mismatch, a checksum error, or the like has occurred in the master control unit, the slave control unit can determine in step S333 whether the vehicle is performing brake control such as ABS or ESC. If the vehicle is not performing brake control such as ABS or ESC, the slave control unit switches to the master control unit in step S327 to initiate vehicle brake control. Simultaneously, the recovery logic of the faulty control unit is activated separately in step S329 to restore the control unit in which the fault occurred.However, if the vehicle is performing a braking control operation such as ABS or ESC, the slave control unit wakes up the vehicle control algorithm in step S355 and determines in step S337 whether the vehicle braking control is currently being performed normally or abnormally. If the vehicle braking control is being performed normally, the slave control unit does not perform any state changes until the vehicle braking control is complete. Subsequently, once the vehicle braking control is complete, the slave control unit switches to the master control unit in step S327 to start the vehicle braking control. Simultaneously, the recovery logic of the faulty control unit is activated separately in step S329 to restore the control unit in which the fault occurred. If the vehicle braking control is being performed abnormally, the slave control unit switches to the master control unit in step S327 to start the vehicle braking control.At the same time, the recovery logic of the faulty control unit can be activated separately in step S329 to restore the control unit in which the fault occurred.

[0037] If the test result from step S317 indicates that the fault is a fault of the slave control unit, only a communication abnormality, a time value interruption, or a checksum error can occur, since the slave control unit only serves as minimum logic for monitoring a fault or determining the vehicle mode state. If the master control unit detects the fault of the slave control unit, in step S329 the master control unit separately activates the recovery logic of the faulty control unit to restore the slave control unit.

[0038] Fig. Figure 4 is a flowchart illustrating a procedure for performing the recovery logic of the faulty control unit in step S329. Fig. 3. The following description refers to a description of content that deals with that from the Fig. Covering 1 to 3, waived. Referring to Fig. Step 4 checks for a fault in the control unit (CCU) in step S411. If the faulty CCU is normal, the current master CCU and the faulty CCU perform time synchronization in step S413. In step S415, the faulty CCU switches to the slave CCU. Subsequently, the slave CCU monitors the state of the master CCU in step S417 and performs vehicle brake control in step S419. If step S411 checks that the faulty CCU is abnormal, meaning the CCU fault is not cleared, the faulty CCU is forcibly reset via the Rm or Rs line. In steps S412 and S423, a reset count is incremented, and the faulty CCU is forcibly reset in the next loop if a reset count is less than a preset reference value N.If the reset count is greater than the reference value N, the reset is stopped in step S425 and a warning light contained in the warning unit 500 is illuminated to alert the driver to a driving hazard. The process then returns to step S419 to perform vehicle brake control.

[0039] Fig. Figures 5A to 5F are diagrams describing I2C and redundancy message flows of the control unit under the first control unit 200, the second control unit 300 and the ASIC 400, which are in Fig. 1 are shown. The following description refers to descriptions of content that are similar to those from the Fig. Covering 1 to 4, omitted. Fig. Figures 5A to 5C are illustrations describing the I2C under the first control unit 200, the second control unit 300 and the ASIC 400 and Fig. Figures 5D to 5F are illustrations describing the redundancy message flows of the control unit. Referring to Fig. 5A The master control unit can generate a serial clock to synchronize communication between the slave control unit and the slave ASIC. If a fault occurs in the master control unit, the slave control unit can reset the master control unit, as described in Fig. 5B is shown, and serve as the master to generate SCL (Serial Clock) data. When the master control unit is restored, the master control unit can switch to the slave for monitoring purposes, as shown in Fig. 5C is shown. Referring to Fig. In steps 5D through 5F, the master control unit transmits an M-to-S2 message (message from the master control unit to the slave ASIC) to an ID that is being assigned for the first time, and transmits an M-to-S1 message (message from the master control unit to the slave control unit) to an ID that is being assigned for the second time. The slave control unit receives the M-to-S1 message, performs an operation on the received message, and transmits the result of the operation as an S1-to-M message (message from the slave control unit to the master control unit) to an ID assigned to it. The slave ASIC receives the M-to-S1 message and transmits an S2-to-MCU message (message from the slave ASIC to the master control unit), and both the master control unit and the slave control unit receive this message.

[0040] Fig. Figure 6 is a diagram showing the structures of the control unit's redundancy messages, which are located in the Fig. 5A to 5F are shown. The following description refers to descriptions of content that are similar to those in the Fig. Covering 1 to 5, omitted. Referring to Fig. The six values ​​are a time counter for the M-to-S1 message and a time counter for the S1-to-M message. These are time synchronization values ​​used to synchronize operating times. Since the data bits are limited, the time counter has the same structure as a message counter. A control mode indicates the current vehicle control mode, and a fault mode encompasses a control unit fault and an ASIC fault. A checksum verifies data accuracy.

[0041] Fig. Figure 7 is a flowchart illustrating a control method for an electronic hydraulic brake device according to another embodiment of the present disclosure. The method from Fig. 7 can generate information that is in the fault mode of the in Fig. The message shown in section 6 will be stored. The following description refers to descriptions of content that are similar to those in the Fig. Covering 1 to 6, omitted. Referring to Fig. In step S713, when a driver starts the vehicle in step S711, the first control unit checks whether the master brake unit 1 has failed. If the master brake unit 1 has failed, the first control unit 210 activates the warning unit 500 to turn on a warning light in step S715. If the master brake unit 1 is functioning normally, the first control unit 220 checks in step S717 whether one or more components from the stability control unit 1-1 and the auxiliary brake unit 2 have failed. If one or more components from the stability control unit 1-1 and the auxiliary brake unit 2 have failed, the first control unit 220 activates the warning unit 500 to turn on the warning light in step S719. If the stability control unit 1-1 and the auxiliary brake unit 2 are normal, the first control unit 200 checks in step S721 whether the second control unit 300 has failed.If the second control unit 300 has failed, the first control unit 200 activates the warning unit 500 to turn on all vehicle braking warning lights in step S723 and issues a message to inform the driver of the danger of the autonomous driving state, including the message that the vehicle cannot be operated. If the second control unit 300 is functioning normally, the first control unit 200 checks in step S725 whether a normal pressure of approximately 130 to 170 bar is being built up in the auxiliary accumulator 70, which is contained in the auxiliary brake unit 2. If the pressure is abnormal, the first control unit 200 activates the warning unit 500 to turn on a warning light in step S729. If all control units are functioning normally, the vehicle begins to drive in step S729.Subsequently, in step S731, the first control unit 200 executes a control determination algorithm for each control unit fault in order to implement a control appropriate to the fault. In step S733, the first control unit 200 determines whether the motor is switched on or off. If the motor is switched off, in step S735, the first control unit 200 releases the pressure from the auxiliary accumulator 70, which is contained in the auxiliary brake unit 2, and completes the control operation.

[0042] Fig. Figure 8 is a table describing a control unit determination algorithm in step S729 for each control unit fault during vehicle control in Fig. 7. The following description refers to descriptions of content that are similar to those in the Fig. Covering 1 to 7, omitted. Referring to Fig.8 The control unit determination algorithm may contain for each control unit malfunction during vehicle control: the operating states of the control units when one or more of the master brake unit 1, the auxiliary brake unit 2 and the second control unit 300 fail, the operating states of the control units when all of the master brake unit 1, the auxiliary brake unit 2 and the second control unit 300 are normal, the warning states to inform the driver of a hazard and information about whether the vehicle is being driven.For example, if the main brake unit 1 fails, the first-first control unit 210 stops the main brake unit 1, the first-second-first control unit 221 performs stability control, the first-second-second control unit 222 controls the auxiliary brake unit 2, the second control unit 300 checks the state of the auxiliary brake unit 2 in a waiting state, the warning unit 400 turns on a warning light indicating an abnormality of the main brake unit 1 and outputs a message indicating that autonomous driving is possible.Another example is that if the second control unit 300 fails, the first-first control unit 210 controls the main brake unit 1, the first-second-first control unit 221 performs stability control, the first-second-second control unit 222 enters standby mode to check the pressure of the auxiliary accumulator 70, the second control unit 300 is stopped, and the warning unit 500 activates a warning light indicating the fault of the second control unit 300 and issues a message to induce the driver to drive the vehicle while a warning signal is issued.

[0043] The embodiments of the present disclosure described above can be implemented in the form of computer programs that can be executed on a computer using various components, and the computer programs can be recorded on a computer-readable medium. This medium can include a magnetic medium, such as a hard disk, a floppy disk, or a magnetic tape; an optical medium, such as a CD-ROM or a DVD; a magneto-optical medium, such as a floppy disk; and a hardware device, such as ROM, RAM, or flash memory, configured to store and execute a program instruction.

[0044] The computer program may comprise an available program that is specifically designed and configured for the present disclosure or is known to those skilled in the field of computer software. Examples of the computer program may include code written in a high-level language that can be executed by a computer via an interpreter, as well as machine-language code generated by a compiler.

Claims

[1] Electronic hydraulic brake device with: a brake unit (10) comprising a master brake unit (1) configured to supply a plurality of wheel cylinders (3) with hydraulic brake pressure by means of a motor operation, and an auxiliary brake unit (2) connected to the master brake unit (1) in such a way that it is filled with high hydraulic brake pressure and configured to supply the plurality of wheel cylinders (3) with hydraulic brake pressure when an operational fault of the master brake unit (1) occurs; a first control unit (200) designed to control the actuation of the brake unit (10) and configured to control the auxiliary brake unit (2) such that it is actuated when an operational fault of the main brake unit (1) occurs; and a second control unit (300) configured to assist part of the control of the main brake unit (1) controlled by the first control unit (200) and the control of the auxiliary brake unit (2), where the first and second control units (200, 300) can determine through communication whether the state of the other unit is normal, characterized by , that if the investigation result indicates that one of the first or the second control unit (200, 300) is operating abnormally, the other of the first and second control units (200, 300) performs a recovery operation in which the control unit that is operating abnormally is forcibly reset. [2] Electronic hydraulic brake device according to claim 1, wherein, if the investigation result indicates that the first control unit (200) is operating abnormally, the second control unit (300) performs a recovery operation in which the first control unit (200) that is operating abnormally is forcibly reset while part of the function of the first control unit (200) is performed, wherein, if the investigation result indicates that the second control unit (300) is operating abnormally, the first control unit (200) performs a recovery operation in which the second control unit (300) that is operating abnormally is forcibly reset. [3] Electronic hydraulic brake device with: a brake unit (10) comprising a master brake unit (1) configured to supply a plurality of wheel cylinders (3) with hydraulic brake pressure by means of a motor operation, and an auxiliary brake unit (2) connected to the master brake unit (1) in such a way that it is filled with high hydraulic brake pressure and configured to supply the plurality of wheel cylinders (3) with hydraulic brake pressure when an operational fault of the master brake unit (1) occurs; a first control unit (200) designed to control the actuation of the brake unit (10) and configured to control the auxiliary brake unit (2) such that it is actuated when an operational fault of the main brake unit (1) occurs; and a second control unit (300) configured to assist part of the control of the main brake unit (1) controlled by the first control unit (200) and the control of the auxiliary brake unit (2), where the first and second control units (200, 300) can determine through communication whether the state of the other unit is normal, characterized by , that the first control unit (200) has: a first-first control unit (210) configured to control the actuation of the main brake unit (1); and a first-second control unit (220) configured to control the actuation of the auxiliary brake unit (2) and to control an actuation of the stability control part (1-1) contained in the main brake unit (1) which sets the hydraulic brake pressure supplied to the wheel cylinders (3), where the second control unit (300) supports the control of the first-second control unit (220). [4] Electronic hydraulic brake device according to claim 3, wherein, when a test result for the master brake unit (1) is obtained by the first control unit (210), a test result for the auxiliary brake unit (2) is obtained by the first control unit (220), and a test result for the second control unit (300) is obtained by the first control unit (200) upon commissioning of a vehicle, indicating that the master brake unit (1), the auxiliary brake unit (2), and the second control unit (300) are normal, the first control unit (220) checks the preset pressure to be generated in the auxiliary brake unit (2), wherein, when the test result for the master brake unit (1) is obtained by the first control unit (210), the test result for the auxiliary brake unit (2) is obtained by the first control unit (220), and the test result for the second control unit (300) is obtained by the first control unit (200) upon commissioning of the vehicle,If a fault has occurred in one or more of the main brake unit (1), the auxiliary brake unit (2) and the second control unit (300), appropriate control measures are taken and information about the situation in which the fault occurred, as well as information about whether the vehicle is being driven after the fault occurred, is provided to the driver. [5] Electronic hydraulic brake device according to claim 1, wherein the main brake unit (1) comprises: a pedal cylinder (110) configured to generate hydraulic pressure when a pedal (119) is pressurized; a master brake cylinder (120) configured to sense the pedal (119) and to generate hydraulic pressure through the operation of the motor; a first hydraulic part (130) which is connected to the master brake cylinder (10) and is configured to supply hydraulic brake pressure to some of the multiple wheel cylinders (3); a second hydraulic component (140) connected to the master brake cylinder (1) and configured to supply hydraulic brake pressure to the other multiple wheel cylinders (3); and a hydraulic connection part (150) configured to connect the first and second hydraulic parts (130, 140) or to remove the connection. [6] Electronic hydraulic brake device according to claim 5, wherein the auxiliary brake unit (2) comprises: an auxiliary hydraulic part (61) which is connected to one from the first and second hydraulic parts (130, 140) to convey hydraulic brake pressure; an auxiliary accumulator (70) which is connected to the auxiliary hydraulic part (61) and is filled with high hydraulic brake pressure; an auxiliary bypass part (82) configured to supply hydraulic brake pressure to the auxiliary accumulator (70) by bypassing the auxiliary hydraulic part (61); an auxiliary sensor part (90) designed to measure hydraulic brake pressure of the auxiliary accumulator (70); and an auxiliary pump (50) which is connected to a storage unit which is connected to the pedal cylinder (110) in such a way that hydraulic brake pressure is stored and the hydraulic brake pressure stored in the storage unit is supplied to the auxiliary accumulator (70). [7] Control method of an electronic hydraulic brake device, which includes: Control, by means of a first control unit (200), an actuation of a brake unit (10) and control of an auxiliary brake unit (2) for actuation upon the occurrence of an operational fault of a master brake unit (1), wherein the brake unit (10) comprises the master brake unit (1) configured to supply hydraulic brake pressure to a plurality of wheel cylinders (3) by operation of a motor, and the auxiliary brake unit (2) connected to the master brake unit (1) to be filled with high hydraulic brake pressure and configured to supply hydraulic brake pressure to the plurality of wheel cylinders (3) when an operational fault of the master brake unit (1) occurs; and Support, by means of a second control unit (300), part of the control of the main brake unit (1) which is controlled by the first control unit (200), as well as the control of the auxiliary brake unit (2), wherein the first and second control units (200, 300) determine through communication whether the state of the other unit is normal, characterized by , that If the result of the determination of the mutual condition indicates that one of the first or the second control unit (200, 300) is operating abnormally, perform a recovery operation on the corresponding other of the first and second control units (200, 300) to force a reset of the control unit that is operating abnormally. [8] Control method according to claim 7, wherein performing the recovery process to forcibly reset the control unit that is operating abnormally comprises: Perform, by means of the second control unit (300), a recovery operation in which the first control unit (200), which is operating abnormally, is forcibly reset while part of the function of the first control unit (200) is performed, if the result obtained by determining the state of each other unit through communication indicates that the first control unit (200) is operating abnormally; and Performing, by means of the first control unit (200), a recovery operation in which the second control unit (300), which is operating abnormally, is forcibly reset if the result obtained by determining the state of each other unit through communication indicates that the second control unit (300) is operating abnormally. [9] Control method of an electronic hydraulic brake device, which includes: Control, by means of a first control unit (200), an actuation of a brake unit (10) and control of an auxiliary brake unit (2) for actuation upon the occurrence of an operational fault of a master brake unit (1), wherein the brake unit (10) comprises the master brake unit (1) configured to supply hydraulic brake pressure to a plurality of wheel cylinders (3) by operation of a motor, and the auxiliary brake unit (2) connected to the master brake unit (1) to be filled with high hydraulic brake pressure and configured to supply hydraulic brake pressure to the plurality of wheel cylinders (3) when an operational fault of the master brake unit (1) occurs; and Support, by means of a second control unit (300), part of the control of the main brake unit (1) which is controlled by the first control unit (200), as well as the control of the auxiliary brake unit (2), wherein the first and second control units (200, 300) determine through communication whether the state of the other unit is normal, characterized by , that the control of the actuation of the brake unit (10) includes: Control, by means of a first-first control unit (210), the actuation of the main brake unit (1); and Control, by means of a first-second control unit (220), an actuation of the auxiliary brake unit (2), and control of an actuation of the stability control unit, which is contained in the main brake unit (1) and sets hydraulic brake pressure to be supplied to the wheel cylinder (3), wherein supporting the part of the control of the main brake unit (1) includes supporting the control of the first-second control unit (220). [10] Tax procedure according to claim 9, which further comprises: Control of a preset pressure to be generated in the auxiliary brake unit (2), under control of the first-second control unit (220), when a test result for the master brake unit (1) by the first-first control unit (210), a test result for the auxiliary brake unit (200) by the first-second control unit (220), and a test result for the second control unit (300) by the first control unit (200) during commissioning of a vehicle indicate that the master brake unit (1), the auxiliary brake unit (2), and the second control unit (300) are normal; and Performing appropriate control measures for a fault and providing information to the driver about the situation in which the fault occurred and whether the vehicle was driven after the fault occurred, when the test result for the main brake unit (1) by the first control unit (210), the test result for the auxiliary brake unit (2) by the first control unit (220) and the test result for the second control unit (300) by the first control unit (200) during the start-up of the vehicle indicate that a fault has occurred in one or more of the main brake unit (1), the auxiliary brake unit (2) and the second control unit (300).

Images