Method for controlling a braking system in an emergency mode in the event of a fault and braking system

Abstract

The invention relates to a method for controlling a braking system in an emergency mode in the event of a malfunction, as well as to a braking system. The method comprises the steps of: transmitting (S1) a deceleration signal (6) to at least two actuator devices (3) of the braking system of a vehicle, wherein the at least two actuator devices (3) are each designed to build up a braking force for decelerating the vehicle; identifying (S2) a simultaneous malfunction in signal processing of the at least two actuator devices (3); and adapting (S3) an electronic signal transmission (5) between a central control unit (4) of the vehicle and at least one of the at least two actuator devices (3) such that the simultaneous malfunction is bypassed in order to build up the braking force.

Description

[0001] The present invention relates to a method for controlling a braking system in an emergency mode in the event of a malfunction and to a braking system with which such a method can be carried out. State of the art

[0002] Braking systems such as brake-by-wire and methods for operating them are known from the prior art. Such braking systems generally have multiple wheel brakes, each of which is assigned to one of the wheels of a vehicle so that each wheel can be braked individually. Hydraulic braking systems, in particular, are known for this purpose. When applying the brakes, a user can be assisted by a brake booster, for example a vacuum brake booster or an electromechanical brake booster (BWA). In addition, assistance systems such as an anti-lock braking system (ABS) or an electronic stability program (ESP), which can actively influence the braking behavior of a vehicle, are known. In particular, electromechanical brake boosters together with an electronic stability program can form a redundant brake-by-wire braking system.

[0003] By using two independent components (BWA and ESP) to provide hydraulic pressure in the brake circuits of the braking system, it can be ensured that even if one component fails, sufficient hydraulic pressure can still be built up in the brake circuits to actuate the braking system. The hydraulic braking system thus comprises several independent hydraulic brake circuits, so that if one hydraulic brake circuit fails, the remaining hydraulic brake circuit(s) still enable the vehicle to be decelerated.Furthermore, the use of two independent components, each capable of building up hydraulic pressure in the brake circuits, ensures that even if one component fails to build up hydraulic pressure, the other component can still build up sufficient hydraulic pressure to decelerate the vehicle. In this way, a hydraulic braking system can ensure the necessary redundancy and thus safety in the braking system. No mechanical connection is required between a user-operated element, such as a brake pedal, and the braking system. In other words, the setpoint for building up hydraulic pressure in the braking system is determined exclusively by the provision of electronic signals.

[0004] For example, DE 10 2017 109 175 A1 describes a control device for a motor vehicle, comprising a main control unit configured to control at least one predetermined driver assistance function of the motor vehicle when the main control unit is in an active state, to detect an error, and, upon detection of an error, to transition from the active state to a passive state in which the driver assistance function is not controlled by the main control unit. Furthermore, DE 10 2018 222 757 A1 describes, for example, a braking system for a motor vehicle comprising two brake circuits, each of which comprises a control unit and a battery, wherein the respective control unit is configured to control two of a total of four service brakes and at least one of at least two electric parking brakes.

[0005] One difficulty with such braking systems is providing a control system for a simultaneous failure of the BWA and ESP due to software errors. Such a failure could be caused by identical components in the software implemented in both the BWA and the software. Disclosure of the invention

[0006] The invention provides a method for controlling a braking system in an emergency mode in the event of a malfunction, having the features of claim 1, and a braking system having the features of claim 10.

[0007] According to a first aspect of the invention, a method for controlling a braking system in an emergency mode during a malfunction is provided. The method comprises the following steps. Transmitting a deceleration signal to at least two actuator devices of the braking system of a vehicle, wherein the at least two actuator devices are each designed to build up a braking force for decelerating the vehicle: Identifying or determining the presence of a simultaneous malfunction or functional impairment of a signal processing of the at least two actuator devices. Adapting an electronic signal transmission or signal flow structure between a central control unit of the vehicle and at least one of the at least two actuator devices so that the simultaneous disturbance is bypassed in order to build up the braking force.

[0008] According to a second aspect of the invention, a braking system is provided. A method according to the first aspect of the invention can be carried out with the braking system. The braking system comprises at least two actuator devices for building up a braking force in the braking system. Furthermore, the braking system comprises a central control unit configured to identify a simultaneous fault in the signal processing of the at least two actuator devices and to adapt electronic signal transmission between the central control unit and at least one of the at least two actuator devices so that the simultaneous fault can be circumvented.

[0009] One idea underlying the present invention consists in the detection of a simultaneous malfunction of at least both brake system components or actuator devices and a subsequent adaptation of the electronic signal transmission or signal flow structure on at least one of the two brake system components. Direct assignment of a software error that has already occurred to a software device is not possible in field operation. Therefore, the software error can continue to occur. To minimize error recurrence, the electronic signal transmission for braking force buildup is adapted. The brake system can be designed as an electromechanical brake system or as a hydraulic brake system. In a hydraulic brake system, the at least two actuator devices are each designed, for example, to build up a hydraulic pressure in a hydraulic brake circuit of the brake system.

[0010] An advantage of the present invention is that the unlikely event of simultaneous degradation of both actuator devices due to a common software error after an initial failure can be prevented. This can increase the acceptance of by-wire braking systems among end customers.

[0011] Advantageous embodiments and further developments emerge from the further subclaims and from the description with reference to the figures of the drawing.

[0012] According to a further development of the present invention, the simultaneous fault is identified by the vehicle's central control unit. This means that the central control unit can, for example, detect a failure and / or an error in the at least two actuator devices or in the signal processing of the at least two actuator devices.

[0013] According to a further development of the present invention, the simultaneous fault is further identified by a substitute control unit or backup control unit of the vehicle, wherein electronic communication signals between the central control unit and the substitute control unit are monitored. Thus, the electronic communication signals can be forwarded via bus communication, in particular CAN, FlexRay, Ethernet, or the like. For example, error monitoring, which can detect a failure of the actuator devices, can be implemented in an external control unit, such as the substitute control unit. The external control unit can monitor network communication with the control unit to be monitored.

[0014] According to a further development of the present invention, the adapted electronic signal transmission transmits a parameter for a motor position, a motor torque, a motor current and / or a motor speed to bypass the disturbance.

[0015] According to a further development of the present invention, the fault is circumvented by omitting a control function of the signal processing system affected by the simultaneous fault, in particular a recuperation function, a pressure control function, an arbitration function, and / or a limiting function. This means that control functions that are routinely executed during normal operation are omitted. Thus, errors in these control functions can no longer lead to a failure of the corresponding actuator device. Corresponding omitted control functions, for example, the limiting function or the pressure control function, can lead to poorer braking performance than during normal operation.

[0016] According to a further development of the present invention, the adjustment of the electronic signal transmission consists of a control command for building up the braking force from the central control unit. Thus, no further signals from other control units, such as an ESP, a WSS, a generator, or the like, are required by the brake component or actuator device to build up the braking force.

[0017] According to a further development of the present invention, adapting the electronic signal transmission comprises a direct control command from the central control unit to a motor controller of the at least one actuator device. The direct control command can be, for example, a diagnostic command or the like.

[0018] According to a further development of the present invention, the at least two actuator devices comprise an electromechanical actuator or brake booster and an electronic stability program (ESP for short), wherein the electromechanical actuator and the electronic stability program are each configured to generate a braking force in the braking system. In particular, simultaneous malfunctions of the electromechanical actuator and the electronic stability program can be identified.

[0019] According to a further development of the present invention, the steps of identifying and / or adapting are performed at least partially by a cloud-enabled server. In this way, the determination of the relevant signal and its value from the central control unit to the braking component can also be calculated in a cloud.

[0020] In the following, the inventive concept presented above is presented again and in addition In other words, this idea concerns - in simplified terms - a Method, wherein a driver braking request is transmitted to at least one central control unit in the vehicle, further signals between the central control unit and brake components, in particular a BWA and / or an ESP, bring about a brake force build-up, in particular a hydraulic pressure build-up in a hydraulic brake system, wherein a simultaneous failure of both brake components is detected on at least one central control unit and a corresponding substitute reaction with new signals for the pressure build-up between the central control unit and the brake component takes place. Short description of the drawings

[0021] The invention is explained below with reference to the figures of the drawings. The figures show: Fig. 1 is a schematic representation of a braking system according to an embodiment of the invention; Fig. 2 is a flowchart of a method for controlling a braking system in an emergency mode in the event of a fault according to another embodiment of the invention; Fig. 3A, Fig. 3B is a schematic representation of a difference in electronic signal transmission between normal operation ( Fig. 3A) and emergency mode ( Fig. 3B) according to a further embodiment of the invention.

[0022] In the figures, the same reference numerals designate identical or functionally equivalent components, unless otherwise stated. The numbering of process steps is for clarity and generally does not imply a specific chronological order. In particular, several process steps can be performed simultaneously. Description of the embodiments

[0023] Further advantages, features and details of the invention will become apparent from the following description, in which various embodiments are described in detail with reference to the drawing.

[0024] Fig. Figure 1 shows a schematic representation of a braking system 1 according to an exemplary embodiment of the invention. The braking system 1 is designed and configured, for example, for use in a vehicle. In particular, the braking system 1 is designed as a hydraulic brake-by-wire braking system.

[0025] The hydraulic braking system 1 comprises, for example, a hydraulic brake circuit 2, two actuator devices 3 for generating braking force, and a central control unit 4. In the hydraulic braking system 1 illustrated here as an example, the two actuator devices 3 can be configured to generate hydraulic pressure in the brake circuit 2, so that the hydraulic pressure in the brake circuit 2 generates the braking force for decelerating the vehicle. The two actuator devices 3 here are, for example, an electromechanical brake booster (BWA for short) and an electronic stability program (ESP for short).

[0026] The central control unit is configured to identify a simultaneous signal processing fault of the at least two actuator devices 3 and to adapt an electronic signal transmission 5 between the central control unit 4 and at least one of the at least two actuator devices 3 so that the simultaneous fault can be bypassed. A deceleration signal 6 for braking the vehicle can be transmitted via a bus communication system integrated into the vehicle. Here, for example, a user's deceleration request 6 is sent to the central control unit 4 via a brake pedal. The deceleration signal 6 in the form of the transmitted driver braking request can be forwarded to the BWA and ESP. The two actuator devices 3 then build up the hydraulic pressure.

[0027] Depending on the actuation of the brake pedal, a booster control unit can control the electromechanical brake booster 3 to generate the hydraulic pressure in the hydraulically configured brake system 1, which is used to apply the wheel brakes. Each wheel brake of the vehicle can be individually controlled to adjust the brake pressure or braking force for each wheel brake. The brake pressure is set or changed, for example, by a force or torque buildup from the engine.

[0028] Furthermore, the electromechanical actuator 3, the electronic stability program 3, the central control unit 4 and the brake pedal can communicate with each other via bus communication.

[0029] The braking system 1 is designed to carry out a method for controlling a braking system in an emergency mode in the event of a malfunction. For example, this method is a method with features according to the embodiment of Fig. 2.

[0030] Fig. 2 shows a flowchart of a method for controlling a braking system in an emergency mode in the event of a fault according to another embodiment of the invention.

[0031] The method comprises the steps of transmitting S1, identifying S2 and adapting S3.

[0032] During transmission S1, a deceleration signal 6, for example, a deceleration request from a driver, is transmitted to at least two actuator devices 3 of the braking system 1 of a vehicle. The at least two actuator devices 3 are each designed to build up a braking force in the braking system 1 to decelerate the vehicle. The deceleration signal 6 is transmitted via a bus communication system integrated into the vehicle. The at least two actuator devices 3 comprise, for example, an electromechanical actuator or brake booster and an electronic stability program. Both the electromechanical actuator 3 and the electronic stability program 3 are designed to build up the braking force.

[0033] During identification S2, a simultaneous malfunction, for example a failure and / or an error, in a signal processing system of the at least two actuator devices 3 is detected. The simultaneous malfunction is identified in particular by the central control unit 4 of the vehicle. Furthermore, the simultaneous malfunction can be identified by a replacement control unit (also referred to as a backup control unit) of the vehicle, wherein the electronic communication via CAN, FlexRay, Ethernet, or the like between the central control unit 4 and the replacement control unit can be monitored. In particular, the simultaneous malfunction of the electromechanical actuator 3 and the electronic stability program 3 is identified here S2.

[0034] During adaptation S3, an electronic signal transmission 5 or signal flow structure between a central control unit 4 of the vehicle and at least one of the at least two actuator devices 3 is used, so that the simultaneous disturbance is bypassed in order to build up the braking force. For example, the disturbance is bypassed by omitting a control function of the signal processing affected by the simultaneous disturbance, in particular a recuperation function, a pressure control function, an arbitration function and / or a limitation function. This means that control functions which are run through as standard in normal operation (see, for example, Fig. 3A) are omitted. This means that errors in these control functions can no longer lead to a failure of the corresponding actuator device 3. Omitted control functions, such as limiting functions and pressure regulators, can lead to poorer braking performance than in normal operation.

[0035] Optionally, the adaptation S3 of the electronic signal transmission 5 in a hydraulically configured brake system 1 consists of a control command for building up the hydraulic pressure from the central control unit 4. Thus, no further signals from other control units, such as the ESP, a WSS, a generator, or the like, are required by the brake component or actuator device 3 to build up the hydraulic pressure. Alternatively or additionally, the adaptation S3 of the electronic signal transmission 5 comprises a direct control command from the central control unit 4 to an engine controller of the at least one actuator device 3. The direct control command can be, for example, a diagnostic command or the like.

[0036] After the adaptation step S3, the adapted electronic signal transmission 5 transmits, for example, a parameter for a motor position, a motor torque, a motor current and / or a motor speed to bypass the disturbance.

[0037] The steps of identifying S2 and / or adapting S3 are performed at least partially by a cloud-enabled server. Furthermore, the determination of the relevant signal and its value from the central control unit 4 to the brake component 3 are calculated by the cloud-enabled server. In particular, the central control unit 4 and the cloud-enabled server can execute different steps of the method, communicating with each other, for example, via a BUS system.

[0038] In the Fig. 3A and Fig. 3B is a schematic representation of a difference in the electronic signal transmission 5 between a normal operation, which is exemplified in Fig. 3A, and the emergency mode, which is exemplified in Fig. 3B. Specifically, the electronic signal transmission 5 for a hydraulically designed braking system is illustrated.

[0039] Fig. Figure 3A shows the electronic signal transmission 5 in normal operation, beginning with a deceleration signal or control command, for example, a driver braking request FB, and ending with the buildup of hydraulic pressure HD in a brake circuit. The driver braking request FB is forwarded by a variety of control functions. Here, the driver braking request FB passes through a driver request FW, a recuperation function RK, a pressure control function DR, an arbitration function AR, a limiting function LF, and a motor controller MR before the hydraulic pressure HD is built up.

[0040] In the emergency mode, for example, the control command is forwarded directly to the motor controller MR, as described in Fig. 3B. The control command thus omits the recuperation function RK, the pressure control function DR, the arbitration function AR, and the limiting function LF. The control command here is a parameter for a motor position MP of the motor.

[0041] Although the present invention has been explained above using exemplary embodiments, it is not limited thereto but can be modified in a variety of ways. In particular, combinations of the above embodiments are also conceivable. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2017 109 175 A1

[0004] DE 10 2018 222 757 A1

[0004]

Claims

[1] Method for controlling a braking system (1) in an emergency mode in the event of a fault, comprising the steps of: Transmitting (S1) a deceleration signal (6) to at least two actuator devices (3) of the braking system (1) of a vehicle, wherein the at least two actuator devices (3) are each designed to build up a braking force for decelerating the vehicle; Identifying (S2) a simultaneous disturbance of a signal processing of the at least two actuator devices (3); and Adapting (S3) an electronic signal transmission (5) between a central control unit (4) of the vehicle and at least one of the at least two actuator devices (3) so that the simultaneous disturbance is bypassed in order to build up the braking force. [2] Method according to claim 1, wherein the simultaneous fault is identified by the central control unit (4) of the vehicle. [3] The method of claim 2, wherein the simultaneous fault is further identified by a backup control unit of the vehicle, wherein electronic communication signals between the central control unit (4) and the backup control unit are monitored. [4] Method according to one of the preceding claims, wherein the adapted electronic signal transmission (5) transmits a parameter for a motor position, a motor torque, a motor current and / or a motor speed to bypass the disturbance. [5] Method according to one of the preceding claims, wherein the disturbance is circumvented by omitting a control function of the signal processing affected by the simultaneous disturbance, in particular a recuperation function, a pressure control function, an arbitration function and / or a limiting function. [6] Method according to one of the preceding claims, wherein the adaptation (S3) of the electronic signal transmission (5) consists of a control command for building up the braking force from the central control unit (4). [7] Method according to one of the preceding claims, wherein the adaptation (S3) of the electronic signal transmission (5) comprises a direct control command from the central control unit (4) to a motor controller of the at least one actuator device (3). [8] Method according to one of the preceding claims, wherein the at least two actuator devices (3) comprise an electromechanical actuator and an electronic stability program, wherein the electromechanical actuator (3) and the electronic stability program (3) are each designed to build up a braking force in the braking system (1). [9] Method according to one of the preceding claims, wherein the steps of identifying (S2) and / or adapting (S3) are at least partially carried out by a cloud-enabled server. [10] Braking system (1) with which a method according to one of the preceding claims can be carried out, comprising: at least two actuator devices (3) for building up a braking force in the braking system (1); and a central control unit (4) which is configured to identify a simultaneous fault in a signal processing of the at least two actuator devices (3) and to adapt an electronic signal transmission (5) between the central control unit (4) and at least one of the at least two actuator devices (3) so that the simultaneous fault can be bypassed.

Images