METHOD FOR OPERATION OF A VEHICLE'S BRAKE SYSTEM AND BRAKE SYSTEM

Description

[0001] The invention relates to a method for operating a braking system of a vehicle and to a braking system.

[0002] Modern vehicle concepts require braking systems based on the brake-by-wire principle. These systems allow the braking request to be detected by suitable sensors and executed by an electronically controlled actuator of the friction brake or by an electric drivetrain, particularly for the purpose of energy recovery (recuperation).

[0003] For example, DE 10 2007 035 326 A1 describes a braking device, in particular an electrically operated vehicle brake with a brake pedal sensor for receiving a braking request, a control unit connected to the brake pedal sensor and at least one brake actuator which is controlled by the control unit according to the braking request.

[0004] A redundant acquisition of the brake request is known, for example, from WO 01 / 14195 A1 and DE 195 10 525 A1.

[0005] Furthermore, brake-by-wire systems are suitable for initiating braking triggered by an autopilot ("virtual driver"), regardless of whether the human driver operates the brake pedal. Brake-by-wire systems currently in series production typically feature a hydraulic fallback, meaning an operating mode in which the brake pedal is hydraulically and / or mechanically coupled to the wheel brakes.

[0006] In automated driving applications, the hydraulic fallback level is insufficient, so a backup braking system is used for these applications.

[0007] However, with this system approach, true by-wire operation is not possible at the fallback level, as a potentially unintentional actuation of the brake pedal leads to an immediate pressure build-up in the wheel brakes.

[0008] The present invention is based on the objective of providing an improved method for operating a braking system with a hydraulically and mechanically decoupled brake pedal of a vehicle and an improved braking system with a hydraulically and mechanically decoupled brake pedal.

[0009] This problem is solved by the method according to claim 1 and the braking system according to claim 9.

[0010] In a first aspect, the invention relates to a method for operating a braking system of a vehicle, wherein the braking system comprises a primary hydraulic braking system and a brake actuation unit hydraulically decoupled from the primary braking system, wherein the brake actuation unit comprises at least two sensor arrangements configured to independently detect actuation information of the brake actuation unit describing a braking request.The procedure involves determining a first actuation signal by a first sensor arrangement, determining a second actuation signal by a second sensor arrangement, checking whether the determined actuation signals are valid, checking whether the determined actuation signals are plausible with each other if the actuation signals are valid, and implementing the braking request according to the actuation signals and / or issuing a warning and / or performing a predefined braking maneuver by the braking system, depending on the validity and plausibility of the actuation signals, whereby the vehicle decelerates to a standstill with a predetermined deceleration and a warning is issued if it is determined that both actuation signals are invalid, or both actuation signals are valid but not plausible.The validity of the actuation information is determined using a sensor-specific characteristic curve function.

[0011] For example, the predetermined deceleration can be between 1 m / s² and 4 m / s², in particular between 2 m / s² and 3 m / s², in particular 2.44 m / s². It can also be provided that, in particular, a visual warning is issued, especially by activating a warning light.

[0012] The primary braking system preferably performs the check to determine whether the determined actuation information is valid and / or whether the determined actuation information is mutually plausible. Furthermore, the primary braking system may also preferably implement the braking request and / or execute a predefined braking maneuver.

[0013] A "braking system" is understood to be a hydraulic arrangement that is at least designed to generate hydraulic pressure based on a braking request and to modulate this pressure, preferably individually for each wheel, for example to implement a control function such as an anti-lock braking system. Accordingly, such a braking system comprises at least a pressure supply device, for example an electrically driven pump, and a valve arrangement.

[0014] The method according to the invention makes it possible to simultaneously use actuation information acquired from different sensor arrangements and, if necessary, to identify a malfunction of the braking system from the combined effect of the actuation information. If a malfunction is detected based on invalid and / or implausible actuation information, corresponding reactions of the braking system are triggered according to the method according to the invention.

[0015] Preferably, it is provided that if both actuation signals are valid and plausible, the braking request is implemented.

[0016] If exactly one of the actuation signals is invalid, it is preferably provided that the braking request is still executed, but in addition, a warning, in particular a visual warning, is issued, especially by activating a warning light. The warning indicates that a malfunction of the braking system has occurred and is intended to prompt the driver to check the vehicle accordingly or to initiate such a check. Preferably, the braking request is determined from the valid actuation signal, while the invalid actuation signal is ignored when determining the braking request. Furthermore, it may be provided that a maximum vehicle speed and / or vehicle acceleration is limited and / or an engine or generator drag torque is increased when the vehicle's accelerator pedal is released if exactly one actuation signal is detected as invalid.

[0017] To minimize the processing effort for the described procedure, it is further preferred that the plausibility of the determined actuation information is only checked if at least one actuation piece of information, and in particular both actuation pieces of information, are valid. Thus, if at least one actuation piece of information is invalid, a further check for the plausibility of the actuation information is not meaningful and can therefore be omitted.

[0018] The braking system further comprises a secondary hydraulic braking system, wherein the first sensor arrangement is connected to the primary braking system and the second sensor arrangement to the secondary braking system for data transmission and / or signal transmission. Consequently, this configuration constitutes a redundant braking system with two separate braking systems, each independently designed to apply brake pressure to the wheel brakes of a vehicle in response to a braking request. Preferably, both the first and the second braking systems are electro-hydraulic braking systems.

[0019] In a further embodiment, the secondary braking system is designed to decelerate the vehicle according to a braking request determined from the second actuation information in the event of a failure of the primary braking system. Consequently, the second braking system is not dependent on the first braking system when implementing a braking request, but can fully replace the first braking system in the event of a failure.

[0020] To ensure that the method according to the invention can be centralized in this configuration and preferably carried out by the first braking system, a further embodiment provides that the primary braking system and the secondary braking system are interconnected for data transmission and are configured to exchange actuation information received from the sensor arrangements. Accordingly, the second actuation information determined by the second sensor arrangement can be transmitted to the primary braking system and checked there for its validity and plausibility compared to the first actuation information.

[0021] However, it can also be provided that the second braking system already performs the validity check of the second actuation information and transmits the corresponding result to the first braking system. For this purpose, preferably when it is determined that an actuation information is not valid, a validity marker assigned to that actuation information is generated. Preferably, the primary and / or secondary braking system(s) is / are configured to exchange such validity markers for actuation information with each other. Based on the exchanged validity markers, the first braking system can then, for example, check whether a subsequent plausibility check should even be carried out, or whether it can be omitted due to the invalidity of one or both actuation information pieces.Accordingly, it is preferably provided that the primary and / or the secondary braking system is / are designed to take generated and / or received validity markers into account during the local execution of the procedure.

[0022] The validity of the first or second actuation signal, or both, can be checked by the first braking system, the second braking system, or both braking systems simultaneously. Similarly, the plausibility of the actuation signal can also be checked by the first braking system, the second braking system, or both braking systems.

[0023] To increase the operational reliability of a braking system operated according to the inventive method, it is further provided that the primary braking system or the secondary braking system has a third sensor arrangement for determining the braking torque generated by the primary braking system, wherein the secondary braking system is configured to read out the sensor information determined by the third sensor arrangement. For example, the third sensor arrangement can be a pressure sensor. In this way, the braking torque can be determined from a system pressure determined by the pressure sensor.

[0024] According to the invention, the second braking system is able to determine at any time, based on the combination of the second actuation information and the braking torque generated in the first braking circuit, whether the first braking system is still functioning as intended. If the second braking system detects that the braking torque provided by the first braking system does not correspond to a braking request derived from the second and / or the first actuation information, the second braking system may, for example, issue a warning to the driver. Furthermore, the second braking system may be configured to bring the vehicle to a controlled stop with a defined deceleration in such a case.

[0025] Building on this, the invention further provides that, in the event of an interruption in communication with the primary braking system, the secondary braking system checks whether the sensor information matches a braking request derived from the second actuation information. If the sensor information does not match the braking request derived from the second actuation information, the secondary braking system implements the braking request derived from the second actuation information. Consequently, in this case, the second braking system decelerates the vehicle completely independently of the first braking system. For this purpose, the second braking system is preferably configured to apply brake pressure to the wheel brakes of a front axle of the vehicle. This is particularly advantageous because the greatest force transmission during a braking maneuver typically occurs via the front wheels of a vehicle.

[0026] In a preferred embodiment, it is further provided that if both actuation signals are valid and plausible, the braking request is derived only from the first actuation signal. In this case, the second actuation signal serves merely to verify the functionality of the braking system on the one hand and to validate the first actuation signal on the other.

[0027] In an alternative embodiment, the braking request is determined from the first and second actuation signals, with the weighting of these signals depending on the strength of the braking request. For example, at low actuation levels of the brake actuator, the first actuation signal is weighted more heavily, while above a certain actuation level, the second signal is weighted more heavily. This weighting depends, for instance, on the type of sensor arrangement.Thus, it can happen that a first type of sensor arrangement provides more reliable values ​​for low actuation levels than a second type of sensor arrangement, while the second type of sensor arrangement provides more reliable, or finer-graded, values ​​for actuation information at higher actuation levels.

[0028] To determine the validity of actuation information, the invention provides that the validity of the actuation information is determined based on a sensor-specific characteristic curve function. For example, a characteristic curve can specify which typical sensor signals are to be expected from the sensor arrangements or are permissible for these sensor arrangements. If a received actuation information is recognized as permissible based on the characteristic curve, the actuation information is marked as "valid". Conversely, if a received actuation information is recognized as impermissible based on the characteristic curve, the actuation information is accordingly marked as "invalid".

[0029] According to a further embodiment, the plausibility of the actuation information is determined by checking whether a braking request derived from the first actuation information lies within a defined tolerance of a braking request derived from the second actuation information. Only if the braking requests are mutually within the specified tolerances are the actuation information considered plausible. If, however, the braking requests lie outside the tolerances, it is assumed that the determined actuation information contradicts each other, and therefore the actuation information is deemed implausible. Preferably, the tolerance depends on measurement tolerances of the sensor arrangements and / or sensor-specific characteristic curves.

[0030] To increase the operational reliability of the braking system, the first sensor arrangement and / or the second sensor arrangement and / or the third sensor arrangement are preferably designed redundantly. Furthermore, preferably at least one of the sensor arrangements, in particular the first and second sensor arrangements, and in particular all sensor arrangements, each has redundant signal paths for transmitting actuation information to the primary and / or secondary braking system.

[0031] To ensure the independence of the actuation information determined by the sensor arrangements, a further embodiment provides that the first sensor arrangement derives actuation information from a first physical measurement, and the second sensor arrangement derives actuation information from a second physical measurement, the first physical measurement being different from the second. This ensures that the measurements leading to the determination of the respective actuation information do not influence each other. If the sensor arrangements were to influence each other, a systematic error could be reflected equally in both sensor arrangements, so that both sets of actuation information would still appear valid and plausible even though both sets of information are faulty.

[0032] Accordingly, it may be provided that the first and / or second sensor arrangement determines actuation information from the distance traveled by a brake pedal and / or from the rotation angle of a lever arm on which the brake pedal is mounted. Furthermore, it may be provided that the first and / or second sensor arrangement determines actuation information from a force exerted on the brake pedal and / or from hydraulic pressure generated in the brake actuation unit as a result of the actuation of the brake pedal.

[0033] To increase the reliability of the braking system, it is also preferably provided that the braking system has a first power supply for supplying the primary braking system and the first sensor arrangement and / or a second power supply for supplying the secondary braking system and the second sensor arrangement.

[0034] InIn another aspect, the invention relates to a braking system for a vehicle with a primary hydraulic braking system and a brake actuation unit hydraulically decoupled from the primary braking system, wherein the brake actuation unit has at least two sensor arrangements configured to independently detect actuation information of the brake actuation unit describing a braking request, wherein the primary braking system and the brake actuation unit are configured to carry out the method described above.

[0035] In one embodiment, the braking system includes a secondary hydraulic braking system, wherein the first sensor arrangement is connected to the primary braking system and the second sensor arrangement is connected to the secondary braking system for data transmission. Preferably, the primary and secondary braking systems are configured to exchange data from the first sensor arrangement and data from the second sensor arrangement, in particular actuation information. In this case, it can also be provided that the method described above is carried out by the primary braking system and / or the secondary braking system and the brake actuation unit. For this purpose, the primary braking system is preferably connected to the secondary braking system, in particular via a data bus.

[0036] To carry out at least part of the method, the primary braking system preferably comprises a first electronic control unit, wherein the first control unit is configured to check the actuation information with regard to its validity and / or plausibility and / or to control the primary braking system to implement a braking request. Alternatively or additionally, it can also be provided that the secondary braking system comprises a second control unit, wherein the second control unit is configured to check the actuation information with regard to its validity and / or plausibility and / or to control the secondary braking system to implement a braking request. Depending on the embodiment of the method, different sub-steps of the method can thus also be implemented by different control units.

[0037] The braking system preferably has a first energy supply for the primary braking system and the first sensor arrangement and / or a second energy supply for the secondary braking system and the second sensor arrangement.

[0038] According to a preferred embodiment, the primary braking system has a third sensor arrangement for determining the braking torque generated by the primary braking system, wherein the secondary braking system is configured to read out the sensor information obtained by the third sensor arrangement.

[0039] Preferably, the primary braking system is designed as a first electro-hydraulic brake control unit / brake module and / or the secondary braking system is designed as a second electro-hydraulic brake control unit / brake module, wherein in particular the first and the second brake control unit / brake module are spatially separated.

[0040] Furthermore, the brake actuation unit preferably includes a pedal force simulator, in particular a hydraulic pedal force simulator.

[0041] Preferred embodiments of the invention are explained in more detail below with reference to the drawings. These show Figure 1 is a schematic representation of a braking system, Figure 2 shows schematic representations of a brake actuation unit with different sensor arrangements, Figure 3 shows a schematic representation of the connection between the primary braking system and the secondary braking system, and Figure 4 shows a functional diagram to illustrate the information structure.

[0042] In the following, similar or identical features are marked with the same reference symbols.

[0043] In one embodiment of the invention, the problem formulated at the outset is solved by combining a redundant braking system with a brake actuation unit, preferably designed as an electronic brake pedal, for detecting driver requests.

[0044] This architecture is also suitable for modular vehicle concepts, where the chassis and body can be flexibly combined and are only connected by electrical interfaces.

[0045] A redundant electrical system is advantageous for the application of this architecture, meaning an independent electrical power supply for the main and backup braking systems (primary and secondary braking systems) and the respective connected sensors or sensor arrays for detecting driver input or for capturing actuation information from the brake actuator that describes a braking request. The brake actuator is hydraulically / mechanically decoupled from the primary and secondary braking systems. This will be discussed in more detail below with reference to the Figure 1 explained in detail.

[0046] The Figure 1Figure 1 shows an embodiment of the proposed architecture of a brake system 100 based on a redundant architecture with a primary brake system 102 (PBS) and a secondary brake system 104 (SBS), wherein the secondary brake system 104 is connected downstream of the primary brake system 102. The brake systems PBS and SBS can be either (electro)hydraulic or electromechanical brake systems. The two brake systems 102 and 104 each have associated electronic control units (PBS ECU 106 and SBS ECU 108) and are each powered by separate power supplies (B1 or Power Supply 1 110, B2 or Power Supply 2 112). For clarity, the connections between the power supplies 110 and 112 and the powered elements of the brake system 100 are not shown.Rather, the letters B1 and B2 indicate which elements are supplied by which energy supply 110 (B1) or 112 (B2).

[0047] The primary brake system 102 is directly connected to the wheel brakes 116 and 118 of a rear axle of the vehicle. The connection between the primary brake system 102 and the wheel brakes 120 and 122 of the front axle of the vehicle is indirect via the secondary brake system 104. It is preferably provided that, during normal operation of the brake system 100, the brake pressure supplied by the primary brake system 102 for the wheel brakes 120 and 122 is transmitted unchanged through the secondary brake system 104 to the wheel brakes 120 and 122. Only in the event of a fault in the brake system 100, as will be explained below, does the secondary brake system 104 take over the pressure for the wheel brakes 120 and 122 of the front axle.

[0048] The rear axle wheel brakes 116 and 118 are each equipped with an integrated parking brake (IPB), with both parking brakes being controllable by both control units 108 and 106.

[0049] Furthermore, a communication link 124 exists between the control unit 106 of the primary brake circuit 102 and the control unit 108 of the secondary brake circuit 104, for example via a data bus set up accordingly.

[0050] The primary brake system 102 with the control unit 106 is preferably spatially separated from the secondary brake system 104 with the control unit 108.

[0051] To detect a braking request from a vehicle driver, the braking system 100 includes the brake actuation unit 114. The brake actuation unit 114, preferably designed as an electronic brake pedal (e-pedal), comprises a pedal interface, preferably a pedal force simulator, and at least two independent sensors for detecting pedal actuation, i.e., for detecting the driver's braking request. Exemplary actuation arrangements are shown in the Figures 2 and 3 As shown. In addition to a braking request initiated by the driver, a braking request can also be triggered by a driving function, such as an autopilot ("virtual driver"). Such braking requests are transmitted directly from the corresponding interface to the two control units 106 and 108.

[0052] The following will now refer to the Figure 2Different variants of brake actuation units 114 are described. A common feature of the depicted brake actuation units 114 is that they each have at least one first sensor arrangement 126 and one second sensor arrangement 128, which are each configured to independently detect a braking request resulting from the actuation of a brake pedal 130 and to determine corresponding actuation information. The two sensor arrangements 126 and 128 of the brake actuation units 114 are preferably each intrinsically safe, i.e., a faulty signal is detected. The exact safety requirements are to be derived from a hazard analysis in the specific application; however, in the general case, an ASIL D requirement according to ISO 26262 is to be assumed. This, in turn, means that the two sensors or sensor arrangements 126 and 128 must each contain redundant signal paths.Furthermore, the brake actuation units 114 each have a pedal force simulator 134 which is designed to exert a force on the brake pedal 130 when the brake pedal 130 is actuated, which is directed opposite to the actuation of the brake pedal 130 and imitates a classic hydraulic brake system in its force-displacement behavior.

[0053] To common-mode To avoid errors, e.g. simultaneous failure of both sensor arrangements 126 and 128 due to the same electromagnetic radiation, diverse measurement principles are preferably used.

[0054] This shows the Figure 2 a) An embodiment of a brake actuation unit 114 with redundant displacement and angle sensors. Here, the displacement sensor (s) is considered, for example, as the primary (first) sensor arrangement 126 and the angle sensor (α) as the secondary (second) sensor arrangement 128.

[0055] In the context of this invention, a redundant sensor or a redundant sensor arrangement is understood to be an arrangement in which either the signal acquisition, the signal transmission, or both the signal acquisition and the signal transmission are each performed multiple times, but at least twice.

[0056] Alternatively, as in Figure 2 b)As shown, a secondary driver request signal or corresponding actuation information can also be derived from the pedal force (F) by means of a corresponding sensor arrangement 126'. Measuring the force can be advantageous for functional reasons, as a better resolution is generally obtained at high values ​​of the driver request ("steep characteristic curve"). Force sensors are not common in the automotive sector; however, one possibility for indirect measurement is the detection of hydraulic pressure, whereby the e-pedal assembly then includes hydraulic components ("wet simulator"), which may not be desirable. Advantageously, only dry components should be used in the vehicle body, and hydraulics only in the chassis. A corresponding design of a brake actuation unit 114 with a pressure sensor 132 is shown in the Figure 2 c)The pressure sensor 132 is shown as an additional sensor arrangement to the angle sensor 128" and the displacement sensor 126'.

[0057] The operating concept or procedure for operating the previously described brake system 100, as described below, is generic and therefore not based on a specific technical implementation of the sensors. However, it is assumed that a primary (first) sensor arrangement 126 (e.g., piston rod travel sensor) is connected to the primary brake system 102 (PBS) and a secondary sensor arrangement 128 (e.g., pedal angle sensor) is connected to the secondary brake system 104 (SBS).

[0058] Furthermore, it is assumed that a communication interface 124 (PBS-SBS COM) exists between the primary braking system 102 (PBS) and the secondary braking system 104 (SBS), and that all primary and secondary assemblies have their own independent electrical power supply 110 and 112. Figure 4illustrates the underlying generic architectural approach.

[0059] Based on this architecture, both driver request sensor signals (actuation information) are available in the electronic control units 106 and 108 (SBS ECU, PBS ECU) of both brake systems 102 and 104. This applies to the signal values ​​of the first actuation information PDBRS 200 (Primary Driver Brake Request Signal), the second actuation information SDBRS 202 (Secondary Driver Brake Request Signal), as well as their validity flags (validity markers) PDBRS_Valid, SDBRS_Valid, which are determined in a first processing step 204 or 206.

[0060] These validity flags assume the value "True" if the respective signal is recognized as valid by the processing control unit; otherwise, they assume the value "False". Thus, in the processing logic of both control units 106 and 108, a primary driver brake request (PDBR) and a secondary driver brake request (SDBR) can be generated.

[0061] This calculation is performed in steps 208 and 210 by applying a primary (sensor-specific) characteristic curve function PF to the primary driver brake request signal and a secondary (sensor-specific) characteristic curve function SF to the secondary driver brake request signal, i.e. PDBR = PF PDBRS SDBR = SF SDBRS

[0062] Provided both signals are valid, i.e. PDBRS _ Valid = = True & & SDBRS _ Valid = = True , In step 212, an additional plausibility check must be applied, which checks whether the deviation between the primary and secondary driver braking request is within the expected tolerances.

[0063] This additional monitoring layer allows unexpected error modes that occur despite ensuring the necessary integrity levels (ASIL requirements) to be intercepted.

[0064] The following table defines how the resulting driver braking request is advantageously formed, depending on the validity of the individual signals and the result of the plausibility monitoring. # PDBRS_Valid SDBRS_Valid PDBR <-> SDBR Plausible DBR result comment 1 Yes Yes Yes DBR = PDBR Normal operation 2 Yes no n / a DBR = PDBR Brake warning light on. Redundancy no longer exists. Risk avoidance at the vehicle level is recommended. 3 no Yes n / a DBR = SDBR 4 Yes Yes no DBR = 2.44 m / s 2< Brake warning light on. Critical fault. Vehicle should be stopped immediately. 5 no no n / a DBR = 2.44 m / s 2<

[0065] In normal, error-free operation, case #1 of the table, both signals are valid and their plausibility with each other is also given. The deviation between the calculated primary and secondary brake request is therefore smaller than a threshold value resulting from the tolerances of the sensors and the different functions PF and SF.

[0066] In normal operation, the resulting braking request is then derived in step 214, for example, only from the primary sensor.

[0067] If functional reasons, e.g., better resolution of the secondary signal at high values ​​of the braking request, justify its use, an alternative blending between primary and secondary driver braking request can be implemented in step 214.

[0068] As soon as one of the sensor signals is invalid, cases #2 and #3 in the table, the resulting driver braking request is preferably calculated from the remaining valid signal in step 214. In these cases, no further redundancy level is available within the braking system, so the driver is preferably informed via a brake warning light.

[0069] It is then the driver's responsibility to decide whether to continue the journey with the red warning light illuminated or to end it. However, part of the overall safety concept at the vehicle level can also include minimizing the risk of continuing the journey through measures such as... Limiting the maximum vehicle speed, limiting the maximum acceleration capability, activating increased engine drag torque or generator braking torque when releasing the accelerator pedal

[0070] Case #4 addresses the unexpected situation where a plausibility discrepancy is detected between the primary and secondary driver braking requests, even though both sensor arrays 126 and 128 are providing a valid signal. In this case, a default driver request is preferentially generated, and the vehicle is brought to a standstill with a predefined braking action.

[0071] In order to avoid violating the safety objectives against both underbraking and overbraking, braking at a rate of 2.44 m / s² is preferably carried out.

[0072] The same strategy can also be applied in the second-failure scenario, case #5, i.e., if both driver request sensors fail (one after the other).

[0073] The in Figure 4 The block diagram shown illustrates an exemplary implementation of an operating concept for driver request generation on the electronic control units of the primary and secondary braking systems. The processing logic is the same on both systems, but should preferably be implemented differently to meet the requirement for software diversity.

[0074] A special case is the interruption of communication between the primary and secondary brake control units.

[0075] If the primary control unit 106 (PBS ECU) detects a loss of communication with the secondary control unit 108 (SBS ECU), this corresponds to case #2 in the table, meaning the second actuation information on the primary control unit 106 is invalid. However, the primary brake control unit 106 will still detect and execute the primary driver brake request from the first actuation information.

[0076] If the secondary control unit 108 detects a loss of communication with the primary control unit 106, two scenarios are possible: a) There is an interruption in communication, but the primary brake system 102 is intact and continues to execute the driver's braking request. b) The primary brake system 102 has failed.

[0077] To distinguish between these two scenarios, the secondary braking system 104 preferably includes monitoring of the primary braking system 102.

[0078] For this purpose, the secondary braking system 104 preferably uses internal sensors to detect the actual applied braking torque (third sensor arrangement). For example, this third sensor arrangement is a pressure sensor of the primary braking system 102 or of the secondary braking system 104.

[0079] The actual braking torque applied is compared with the secondary driver braking request calculated within the secondary braking system 104. If it is determined that the braking request is not implemented or is only implemented insufficiently, i.e., scenario b) applies, the secondary braking system 104 is preferably activated and executes the calculated braking request.

[0080] Preferably, a system approach and an operating concept for a system based on the brake-by-wire principle are presented, which do without a hydraulic fallback level.

[0081] This advantageously supports applications of automated driving, while maintaining a decoupling of the brake pedal 130 even in the event of a fault.

[0082] Advantageously, vehicle concepts with modular chassis / body design are simplified by the elimination of mechanical interfaces.

Claims

1. A method for operating a braking system (100) of a vehicle, wherein the braking system (100) comprises a primary hydraulic braking system (102) and a brake actuation unit (114) hydraulically decoupled from the primary braking system (102), wherein the brake actuation unit (114) comprises at least two sensor arrangements (126, 128) which are configured to detect, independently of one another, pieces of actuation information (200, 202) of the brake actuation unit (114) describing a brake request, wherein the method comprises the steps: • determining a first piece of actuation information (200) by a first of the sensor arrangements (126), • determining a second piece of actuation information (202) by a second of the sensor arrangements (128), • checking (204, 206) whether the respective determined pieces of actuation information (200, 202) are valid, • if the pieces of actuation information (200, 202) are valid, checking (212) whether the determined pieces of actuation information (200, 202) are mutually plausible, and • implementing the brake request according to the pieces of actuation information (200, 202) and / or outputting a warning and / or performing a predefined braking man oeuvre by the braking system (100) depending on the validity and plausibility of the pieces of actuation information (200, 202), wherein the vehicle is decelerated to a standstill with a predefined deceleration and a warning is output if it is determined that both pieces of actuation information (200, 202) are invalid or both pieces of actuation information (200, 202) are valid but implausible, and wherein the validity of one piece of actuation information (200, 202) is determined on the basis of a sensor-specific characteristic curve function (PF, SF), characterized in that the braking system (100) comprises a secondary hydraulic braking system (104), wherein the first sensor arrangement (126) is connected to the primary braking system (102) and the second sensor arrangement (128) is connected to the secondary braking system (104) for data transmission and / or signal transmission, wherein the primary braking system (102) or the secondary braking system (104) comprises a third sensor arrangement for the determination of the braking moment generated by the primary braking system (102), wherein the secondary braking system (104) is configured to read out the sensor information determined by the third sensor arrangement, wherein the secondary braking system (104), in the case of an interruption of communication with the primary braking system (102), checks whether the sensor information matches a brake request determined from the second piece of actuation information (202), and wherein, in the case that the sensor information does not match the brake request determined from the second piece of actuation information (202), the secondary braking system (104) implements the brake request derived from the second piece of actuation information (202).

2. The method as claimed in claim 1, characterised in that the secondary braking system (104) is configured to decelerate the vehicle according to a brake request determined from the second piece of actuation information (202) upon failure of the primary braking system (102).

3. The method as claimed in claim 1 or 2, characterised in that the primary braking system (102) and the secondary braking system (104) are interconnected for data transmission and are configured to exchange with one another pieces of actuation information (200, 202) received from the sensor arrangements (126, 128).

4. The method as claimed in any one of the preceding claims, characterised in that, if both pieces of actuation information (200,202) are valid and plausible, the brake request is derived only from the first piece of actuation information (200).

5. The method as claimed in any one of the preceding claims, characterised in that the brake request is determined from the first (200) and the second (202) pieces of actuation information, wherein a weighting of the first (200) and second (202) pieces of actuation information, upon the determination of the brake request, depends on the intensity of the brake request.

6. The method as claimed in any one of the preceding claims, characterised in that the plausibility of the pieces of actuation information (200, 202) is determined in that it is checked whether a brake request derived from the first piece of actuation information (200) lies within an established tolerance around a brake request derived from the second piece of actuation information (202).

7. The method as claimed in any one of the preceding claims, characterised in that the tolerance depends on measurement tolerances of the sensor arrangements (126, 128) and / or sensor-specific characteristic curve functions.

8. The method as claimed in any one of the preceding claims, characterised in that the first sensor arrangement (126) derives a piece of actuation information (200) from a first physical measurement parameter and the second sensor arrangement (128) derives a piece of actuation information (202) from a second physical measurement parameter, wherein the first physical measurement parameter differs from the second physical measurement parameter.

9. A braking system (100) for a vehicle with a primary hydraulic braking system (102) and a brake actuation unit (114) hydraulically decoupled from the primary braking system (102), wherein the brake actuation unit (114) comprises at least two sensor arrangements (126, 128) which are configured to detect, independently of one another, pieces of actuation information (200, 202) of the brake actuation unit (114) describing a brake request, wherein the braking system (100) comprises a secondary hydraulic braking system (104), wherein the first sensor arrangement (126) is connected to the primary braking system (102) and the second sensor arrangement (128) is connected to the secondary braking system (104) for data transmission and / or signal transmission, wherein the primary braking system (102) or the secondary braking system (104) comprises a third sensor arrangement for determining the braking moment generated by the primary braking system (102), wherein the secondary braking system (104) is configured to read out the sensor information determined by the third sensor arrangement and wherein the primary braking system (102) and the brake actuation unit (114) are configured to perform the method as claimed in claim 1 or any one of claims 4 to 8.

10. The braking system (100) as claimed in claim 9, characterised in that the braking system (100) comprises a secondary hydraulic braking system (104), wherein the first sensor arrangement (126) is connected to the primary braking system (102) and the second sensor arrangement (128) is connected to the secondary braking system (104) for data transmission and wherein the primary braking system (102) and / or the secondary braking system (104) are / is configured to perform the method as claimed in any one of claims 1 to 8.

11. The braking system (100) as claimed in claim 10, characterized in that the primary braking system (102) comprises a third sensor arrangement for determination of the braking moment generated by the primary braking system (102), wherein the secondary braking system (104) is configured to read out the sensor information determined by the third sensor arrangement.