Vehicle with a by-wire system

Abstract

The invention relates to a vehicle with a by-wire system comprising a primary braking system (B1) and a primary steering system (L1), as well as independently operating redundant braking systems (B2) and redundant steering systems (L2). The by-wire system includes a central evaluation unit that, in the event of a fault during driving, performs an escalation control to autonomously bring the vehicle to a safe state, i.e., a forced deceleration and / or a forced shutdown. According to the invention, the central evaluation unit has two independently operating central coordinators (K1, K2): a primary coordinator (K1), which normally performs the escalation control, and a redundancy coordinator (K2), which takes over the escalation control if the primary coordinator (K1) malfunctions.

Description

[0001] The invention relates to a vehicle with a by-wire system according to the preamble of claim 1.

[0002] A by-wire steering and / or braking system is based on a technology that lacks a mechanical linkage at the fallback level. In the event of a fault, if no energy is available in the vehicle or the steering and / or braking system experiences a critical error in its software or processing, the respective function is no longer available to the driver.

[0003] Brake-by-wire and / or steer-by-wire systems are based on redundancy concepts. This means that a functional chain is primarily covered by two components or systems, both of which can independently perform the basic function, for example, actuating the brake pedal to decelerate the vehicle. This applies analogously to the steering system. These systems are also powered by a redundant energy supply. A primary-side braking system and a primary-side steering system are powered by a single primary-side energy supply. The same applies to the primary side, where a secondary-side braking system and a secondary-side steering system are powered by a separate secondary-side energy supply.

[0004] A by-wire system of this type operates with a redundancy concept, incorporating a primary braking system and a primary steering system, as well as independent redundant braking and steering systems. Furthermore, the by-wire system features a central evaluation unit that, in the event of a failure of the primary steering or braking system during operation, initiates an escalation control process to autonomously bring the vehicle to a safe state. This is achieved, for example, through autonomous forced deceleration and / or forced vehicle shutdown. The faults leading to a failure of the primary steering or braking system are diverse; that is, they can originate from the primary and / or secondary side, or from the primary or secondary power supply.

[0005] In such a by-wire system, the redundancy concept is only applied to the braking and steering systems. However, the escalation control performed by the central evaluation unit to autonomously bring the vehicle to a safe state does not utilize the redundancy concept.

[0006] From DE 10 2017 204 691 B3, a control device for the redundant execution of an operating function in a motor vehicle is known. In the control device, the vehicle's assistance systems for escalating a vehicle are implemented redundantly to achieve redundancy, with the functions of the assistance systems being executed on multiple processors;

[0007] From DE 10 2016 215 665 A1, a method for operating driver assistance systems in a motor vehicle is known. In the motor vehicle, the power supply of a dual assistance system is implemented redundantly by supporting a charge controller for the main power supply of the assistance systems with a voltage regulator, which, in the event of a defect of the charge controller, supplies an operating voltage to one of the assistance systems.

[0008] A redundant object detection system for driver assistance systems is known from DE 11 2012 001 318 B4. The driver assistance system has redundant image acquisition devices.

[0009] The object of the invention is to provide a vehicle with a by-wire system in which the required safety standards can be met more easily compared to the prior art.

[0010] The problem is solved by the features of claim 1. Preferred embodiments of the invention are disclosed in the dependent claims.

[0011] The invention relates to a vehicle with a by-wire system comprising a primary braking system and a primary steering system. Furthermore, independently operating redundant braking and steering systems are provided. The by-wire system also includes a central evaluation unit. In the event of a fault during driving (i.e., for example, a fault in the primary braking system or the primary steering system), this unit performs an escalation control to autonomously bring the vehicle to a safe state. This is achieved, for example, by autonomous forced deceleration and / or forced vehicle shutdown. According to the characterizing part of claim 1, the redundancy concept implemented in the steering and braking systems is further extended to the central evaluation unit. Accordingly, the central evaluation unit has two independently operating central coordinators, namely a primary coordinator and a redundancy coordinator.The primary coordinator normally handles escalation management. The backup coordinator is normally inactive and only takes over escalation management if the primary coordinator malfunctions.

[0012] According to the invention, the redundancy concept is applied to the aspect of escalation or escalation control in order to autonomously bring the vehicle to a safe state. The invention is based on a safety assessment according to which the controllability of the situation or the timely escalation of the vehicle must exhibit the same level of safety as the steering and braking functions. Therefore, according to the invention, it is not only ensured that the steering and braking functions of the vehicle can be performed during driving; furthermore, with the aid of the two central primary and redundancy coordinators, it is ensured that the occurrence of errors is addressed without time delay and that the vehicle is brought to a safe state.

[0013] The advantage of distributing the evaluation between the two coordinators lies in the very high availability, analogous to the functional chains of driver braking and driver steering. The probability is therefore balanced that – provided the vehicle can still steer and decelerate – escalation to a safe state is also guaranteed.

[0014] In the primary or redundancy coordinator, a process sequence can be implemented which may consist of the following four essential implementation steps: - Analysis of the vehicle's condition and assessment of the availability of the driver's braking and steering systems in the vehicle, including the power supply; - Deceleration of the vehicle to a standstill; and - Determining that the vehicle has come to a standstill. - Permanent parking of the vehicle

[0015] According to the invention, all these aspects are redundantly present in the vehicle; accordingly, these aspects operate autonomously and are interconnected. All aspects are designed and allocated across technical control units in such a way that even in the event of a simple fault or a failure of the primary system, the vehicle's situation remains controllable.

[0016] The status of the braking systems, steering systems, and power supply systems, which together constitute the redundant chains of operation for driver braking and steering as well as the driver's power supply, can be monitored by the two coordinators. The availability status of the escalation mechanisms for achieving a safe state is also monitored. - Deceleration of the vehicle to a standstill; - Determining the vehicle's standstill; and - permanent parking of the vehicle.

[0017] According to the invention, the two coordinators provide the availability information. Based on the availability assessment, the primary and redundancy sides are independently able to evaluate and execute an escalation of availability. For example, if the primary energy system fails completely, all primary components also become inoperative. The redundancy side is not affected by this failure and can still perform an assessment of the remaining availability within its system and subsequently initiate an escalation.

[0018] It may be possible to implement redundancy in the safe state asymmetrically. This means that the redundancy side may only coordinate or evaluate the secondary systems and subsystems. The primary side can access both sides of the escalation process. The redundancy coordinator only becomes active if the primary coordinator fails. Vehicle clearance is granted solely by the primary coordinator, which reads the individual status of the components on the redundancy side as well as the overall status of the redundancy coordinator.

[0019] Exemplary embodiments and a comparative example not covered by the invention are described below with reference to the accompanying figures.

[0020] They show: Fig. 1 and Fig. 2 each in a block diagram a by-wire system according to a first and a second embodiment, and Fig. 3 in a further block diagram a by-wire system according to a comparative example not covered by the invention.

[0021] For the sake of a simpler understanding of the invention, reference is first made to the block diagram of the Fig. Figure 3 illustrates a comparative example not included in the invention. Accordingly, the redundancy concept is applied to the vehicle's braking and steering systems, but not to the central coordinator K. The by-wire system comprises a primary braking system B1 and a primary steering system L2, as well as a redundant braking system B2 and a redundant steering system L2, each operating independently. The braking and steering systems B1, B2, L1, and L2 are in signal communication with the central coordinator K. The coordinator K determines the status of each respective braking and steering system B1, B2, L1, and L2. Furthermore, an energy system E is provided, which is also in signal communication with the coordinator K so that its status can be determined.

[0022] The by-wire system according to the Fig. 3 also features an escalation system ES. The escalation system E consists of the Fig. 3 from a display 1 to provide information to the driver, a parking system 3 for safe parking of the vehicle and a longitudinal dynamics implementation 5 to be able to decelerate the vehicle.

[0023] As soon as the central coordinator K detects a fault status during driving operation in the primary braking system B1 or the primary steering system L1, the coordinator K initiates an escalation control to autonomously bring the vehicle to a safe state. For this purpose, the coordinator controls the display 1, the parking system 3 and / or the longitudinal dynamics conversion 5.

[0024] In the by-wire system according to the Fig. 3. The redundancy concept implemented in the steering system and the braking system does not apply to the central coordinator K, which, in the event of a fault, controls and demands the corresponding implementations of the escalation of the forced vehicle deceleration and the forced vehicle shutdown.

[0025] In contrast, in the Fig. Figure 1 illustrated the redundancy concept in the by-wire system according to the invention. Fig. 3, which is only implemented for the brake and steering system components, is extended to include the aspect of escalation and escalation control in order to autonomously bring the vehicle to a safe state. Accordingly, the by-wire system includes a primary coordinator K1 and a redundancy coordinator K2. The primary coordinator K1 is in signal communication with a primary escalation system ES1. The primary escalation system ES1 has a display 7 for the driver, a deceleration conversion 9, a standstill detection 11, and a parking system 13. Similarly, the redundancy coordinator K2 is in signal communication with a redundancy escalation system ES2, which enables redundancy-based escalation control. The redundancy escalation system ES2 is in the Fig. 1. The redundancy escalation system is designed symmetrically to the primary escalation system ES1. Accordingly, the redundancy escalation system also has a display 15 for the driver, a delay implementation 17, a parking system 19 and a standstill detection system 21.

[0026] As from the Fig. As further shown in Figure 1, the primary steering system L1 and the primary braking system B2 are in signal communication with the primary coordinator K1. Similarly, the redundant steering system L1 and the redundant braking system B2 are in signal communication with the redundancy coordinator K2.

[0027] The primary side, that is, the primary steering system L1, the primary braking system B1, the primary coordinator K1, and the primary escalation system ES1, is assigned a primary power supply E1. Similarly, the redundancy side is assigned a redundant power supply E2. This means that if the primary side fails, the redundancy side can continue to operate independently.

[0028] The primary coordinator K1 indicates in the Fig. 1. The following building blocks: - a status generation module 23 with which the respective status of the primary side components can be determined, i.e. the status of the primary steering system L1, the primary brake system B1 and the primary power supply 1; - a release module 25 which, if an error status is present before the start of travel, blocks a travel release, or alternatively, grants the travel release if no error is present; and - an escalation module 27 which, in the event of at least one detected error status, controls the primary escalation system ES1 or the secondary escalation system ES2.

[0029] The driving authorization module 25 is in the Fig. 1. This is only provided in the primary coordinator K1, which reads the individual status of the components on the redundancy side as well as the overall status of the redundancy coordinator K2. Accordingly, the redundancy coordinator K2 only contains the status generation block 23 and the escalation block 25. In the event of an error status recorded by the status generation block 29, the escalation block 31 controls the redundancy escalation system ES2 or, alternatively, the primary escalation system ES1.

[0030] As from the Fig. As further shown in Figure 1, the status generation block 23 of the primary coordinator K1 is in signal communication with the redundancy coordinator to determine its status. Similarly, the status generation block 29 of the redundancy coordinator K2 is also in signal communication with the primary coordinator K1 to determine its status.

[0031] In the Fig. Figure 2 shows a block diagram of a by-wire system according to a second embodiment. The basic structure and operation of the second embodiment are essentially identical to the structure and operation of the first embodiment. Therefore, reference is made to the preliminary description.

[0032] In contrast to the first embodiment, in the Fig. 2 the redundancy steering system L2, the redundancy braking system B2 and the redundancy power supply E2 in signal connection with the status generation module 23 of the primary coordinator K1 to determine their status.

[0033] Furthermore, in the Fig.2. The primary escalation system ES1 is in signal connection with the status generation block 23 of the primary coordinator K1 in order to determine its status. Similarly, the redundancy escalation system ES2 is also in signal connection with the status generation block 29 of the redundancy coordinator K2 in order to determine its status. REFERENCE MARK LIST: 1 driver display 3 Parking system 5 Longitudinal dynamics implementation 7 Driver Display 9 Delay Implementation 11. Downtime recording 13 Parking system 15 Driver Display 17 Delay Implementation 19 Parking system 21 Downtime recording 23 Status generation module 25 Driving Release Module 27 Escalation module 29 Status generation module 31 Escalation module K Coordinator B1 Primary braking system B2 Redundancy Braking System L1 Primary Steering System L2 Redundancy Steering System Energy system ES escalation system K1 Primary Coordinator K2 Redundancy Coordinator E1 Primary Energy System E2 Redundancy Energy System ES1 Primary Escalation System ES2 Redundancy Escalation System QUOTES INCLUDED IN THE DESCRIPTION

[0000] This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2017 204 691 B3

[0006] DE 10 2016 215 665 A1

[0007] DE 11 2012 001 318 B4

[0008]

Images