Brake system structure and vehicle comprising a brake system structure

Abstract

The invention relates to a brake system structure (100) for a vehicle (F), preferably a brake-by-wire system, in which detection devices (11, 21, 31) and conversion devices (13, 23, 33) for a brake request are mechanically decoupled from one another, having: - a first brake system (10) for providing a brake function, said first brake system being designed to be autonomous and having a first power supply (E1), - a second brake system (20) for providing a first fallback level for the brake function, said second brake system being designed to be autonomous and having a second power supply (E2), and - a third brake system (30) for providing a second fallback level for the brake function, in particular by means of a regenerative deceleration, wherein a third power supply (E3) is provided at least for the first brake system (10).

Description

[0001] Description

[0002] Brake system structure and vehicle with a brake system structure

[0003] The invention relates to a braking system structure for a vehicle, in particular a brake-by-wire system, in which, in particular, detection devices and implementation devices for a braking request are mechanically decoupled from one another. Furthermore, the invention relates to a vehicle with a corresponding braking system structure.

[0004] Brake-by-wire systems are generally well-known. Brake-by-wire systems can provide several advantages for both conventional vehicles and automated (Level 4 according to the SAE definition) to autonomous (Level 5 according to the SAE definition) vehicles.

[0005] For automated vehicles, brake-by-wire systems can allow the pedal assembly to be folded away and / or retracted. This creates more space for the driver, who becomes a passenger during fully automated driving, to engage in activities such as sleeping, reading the newspaper, surfing the internet, etc. Furthermore, the mechanical decoupling between the brake pedal and the brake actuator prevents inadvertent misoperation during fully automated driving: Even if the brake pedal were not retracted, accidental contact with the brake pedal during fully automated driving (e.g., if the driver is asleep) would not result in an unwanted vehicle reaction. Autonomous vehicles do not have a driver, so a brake-by-wire system is essential.

[0006] In conventional vehicles, brake-by-wire systems can facilitate entry and exit by folding and / or retracting the foot pedals. Braking behavior can be individually adapted and personalized to the driver. Electronic adjustment of the brake characteristic (braking torque dependent on pedal travel and / or force) allows the driver to experience braking behavior as softer or harder, sporty or comfortable, direct or dampened. These settings can be transferred from vehicle to vehicle for individual driver preference.

[0007] Environmental benefits are also conceivable. By increasing the clearance between the brake disc and the brake pad, residual braking torque can be reduced. This enables a reduction in CO2 and brake dust emissions, as well as an increase in battery-electric range. Furthermore, safety benefits are possible. By breaking the mechanical connection via a push / pull rod between the brake pedal and the brake control system, pedal intrusion can be reduced in the event of a crash.

[0008] In addition, the vehicles can be easily adapted to be accessible for people with disabilities. For people with a physical disability that makes operating the pedals difficult or impossible, alternative operating concepts can be offered without complex vehicle modifications when by-wire braking systems are installed as standard.

[0009] Furthermore, this reduces the number of variants. A virtually uniform pedal assembly can now be installed across all vehicle classes.

[0010] With brake-by-wire systems, the driver's mechanical fallback function is eliminated. A fallback function can be provided to enable continued driving in a degraded driving mode (e.g., reduced speed) and / or limited driving mode (e.g., only for a limited time or a limited distance) after an initial failure.

[0011] DE 102020202 477 A1 discloses a safety system for an electrically powered motor vehicle with three braking systems. The vehicle is designed to be fully automated and / or autonomously driven.

[0012] DE 102019216 896 A1 discloses a braking system for a vehicle that has a primary and a secondary braking system. The two braking systems are controlled independently of each other via two different control systems.

[0013] The disadvantage of known systems is that after a second fault and / or after the primary braking system and the secondary braking system fail, continued driving and safety in the operation of the vehicle can no longer be guaranteed.

[0014] The object of the invention is therefore to provide an improved braking system structure for a vehicle, in particular a brake-by-wire system, in which, in particular, detection devices and implementation devices for a braking request are mechanically decoupled from one another. In particular, the object of the invention is to provide such a braking system structure for a vehicle, in particular such a brake-by-wire system, which enables increased safety in the operation of the vehicle and which creates improved customer comfort. Furthermore, the object of the invention is to provide an improved vehicle with a corresponding braking system structure.

[0015] The object of the invention is achieved by: a braking system structure for a vehicle, in particular a brake-by-wire system, in which detection devices and implementation devices for a braking request are preferably mechanically decoupled from one another, having the features of the independent device claim. Furthermore, the invention relates to a corresponding vehicle having the features of the independent device claim. Features described in connection with individual aspects and / or embodiments of the invention naturally also apply in connection with the other aspects and / or embodiments, and vice versa, so that with regard to the disclosure, reciprocal reference is or can always be made to the individual aspects and / or embodiments of the invention.

[0016] The invention provides: a braking system structure, a so-called brake-by-wire system, for a vehicle, e.g. a hybrid or electric vehicle, e.g. a fully automated (Level 4 according to the SAE definition) to autonomous (Level 5 according to the SAE definition) vehicle. In the braking system structure, detection devices and implementation devices for a braking request (which can come, for example, from the driver or the vehicle) can advantageously be mechanically decoupled from one another. The braking system structure has the following subsystems: a first (or primary) braking system (so-called autonomous braking system) for providing a braking function, which is designed autonomously and / or has a first (or primary) energy supply, a second (or secondary) braking system (so-called autonomous braking system) for providing a first fallback level for the braking function, which is designed autonomously and / or has a second (orsecondary) energy supply, and a third braking system (at least partially indirect and / or functionally implemented braking system) to provide a second fallback level for the braking function, for example via an electromechanical drive system of the vehicle, e.g. by means of generator deceleration.

[0017] The vehicle in which the braking system structure according to the invention can be used can, for example, have a traction battery, e.g., a high-voltage battery that can be operated with direct voltages of approximately 60 V to approximately 1.5 kV. The vehicle can also have an electric motor. Furthermore, the vehicle can have at least one central control unit. Furthermore, the vehicle can have a driver-vehicle interface, e.g., in the form of an interactive input and output unit, e.g., comprising a display, an acoustic output device, etc.

[0018] The vehicle in which the braking system structure according to the invention can be used can preferably be designed as a fully automated vehicle (Level 4 according to SAE definition) or an autonomously driving vehicle (Level 5 according to SAE definition).

[0019] If the driver is in control, the braking request can come from the driver, for example, by applying an electronic brake pedal. If the vehicle is in control, the braking request comes from the vehicle.

[0020] In a fully automated vehicle (Level 4 according to the SAE definition), the driver can become a passenger or user of the vehicle. A fully automated vehicle can feature a driver-vehicle interface. In an autonomous vehicle (Level 5 according to the SAE definition), there is no driver involved. Only users are involved. An autonomous vehicle can feature a user-vehicle interface.

[0021] The concept of the invention lies in the fact that the braking system structure provides two redundant, autonomous braking systems that are designed to be self-sufficient or independent and can function independently of each other and of other functional systems of the vehicle. The first and second autonomous braking systems are supplied with electrical energy via two independent power supplies, the first and second power supplies. The independent power supplies can, for example, each have a high-voltage battery that can be operated with direct voltages of approximately 60 V to approximately 1.5 kV. Furthermore, the independent power supplies can each have a suitable DC / DC converter.

[0022] Each of these two braking systems can also have several subsystems, such as a braking request detection (or detection device for detecting the braking request) and a braking request implementation (or

[0023] Implementation device for implementing the braking request). In both autonomous braking systems, the braking request can be transmitted from the respective detection point to the respective implementation point via a corresponding transmission system, such as a bus system or a data bus, e.g., with a CAN or SENT protocol. The respective braking request detection point can be implemented as an electronic brake pedal. The driver's actuation of the brake pedal can be detected, for example, via force and / or displacement sensors or similar. Control electronics for the braking request detection point, comprising, for example, corresponding electronics and / or software, can passively receive the sensor data, actively query it, and, if necessary, evaluate it. Furthermore, the control electronics for the respective braking request detection point can transmit the sensor data and / or the evaluation results to the corresponding braking request implementation point via an associated transmission system.The respective braking request implementation can also have control electronics, including, for example, corresponding electronics and / or software. The evaluation of sensor data from the respective braking request detection can be performed in the control electronics of the braking request detection and / or in the control electronics of the braking request implementation. The control electronics of the braking request detection and the control electronics of the braking request implementation can be provided as separate control electronics or as a common control electronics.

[0024] At least one or each brake request implementation can be implemented as a so-called "wet" by-wire braking system. The respective brake request implementation can comprise an electric motor, various sensors, and hydraulic valves. The brake calipers of the wheels contain brake pads, which are pressed against the brake discs by hydraulic pressure. Control electronics for the brake request implementation and the brake calipers are connected via hydraulic lines (for hydraulic valves). The control electronics actuate the electric motor to generate a specific hydraulic pressure and thus a specific braking torque, which corresponds to the detected braking request. The pressure at the four wheels can be set, adjusted, and / or modulated via the hydraulic valves.

[0025] At least one or each braking request implementation can be implemented as a so-called "dry" by-wire braking system. The respective braking request implementation can comprise an electric motor, various sensors, and mechanical actuators. The brake calipers of the wheels contain brake pads, which are pressed against the brake discs via electric motors and mechanical actuators. The control electronics and the brake calipers are connected via power lines (for the electric motors) and data lines (for the sensors). The control electronics controls the electric motors in the brake calipers to generate a specific braking torque that corresponds to the braking request. The braking torque at the four wheels can be modulated by appropriately controlling the electric motors.In addition to the first and second autonomous braking systems, which can have their own long-term energy supply, a short-term energy supply can also be provided. The third braking system uses the generator-driven electric motor and the control unit of the electric motor. The electric motor is directly connected to the high-voltage battery, in particular the traction battery. The high-voltage battery, in particular the traction battery, feeds the first energy supply and the second energy supply. The control unit of the electric motor is connected to the first energy supply and to the short-term energy supply. The short-term energy supply can represent part of the third braking system. The respective long-term energy supply can, for example, be provided via a DC / DC converter, which can be connected to a corresponding high-voltage battery. The short-term energy supply can, for example,via a low-voltage battery and / or a supercapacitor, so-called ultra-cap, or similar. The operating voltage of the low-voltage battery can be between 12 V and 14 V.

[0026] If a so-called "wet" by-wire braking system is used, this braking system, equipped with hydraulic valves, can advantageously be connected to the short-term energy supply. This allows basic braking functions such as braking the vehicle to a standstill, as well as safety-relevant brake control functions such as ABS and ESC, to be maintained, at least for a short time, even if the primary and secondary long-term energy supplies fail simultaneously.

[0027] Furthermore, the inventive concept lies in the fact that the third braking system can be provided at least partially as an indirect or dependent and / or functionally implemented or indirect braking system (or deceleration system) for providing a second fallback level for the braking function, for example via another functionally essential system of the vehicle, such as an electromechanical drive system, for example through regenerative deceleration. An electric motor of the electromechanical drive system, which is operated in a generator mode for regenerative deceleration, acts as a third braking request conversion device (or conversion device for converting the braking request). At least one high-voltage battery, in particular a traction battery, and possibly at least one further auxiliary battery of the vehicle can be charged via the electric motor in generator mode for regenerative deceleration.

[0028] The third braking system can advantageously include a third braking request detection system. The braking request detection can be carried out, for example, via a button on an electronic parking brake. The button can be connected directly to the electronics of the primary and secondary braking request implementation via a signal line (i.e., no data bus). The third braking request detection system can deliver the detection results to the first and / or second autonomous braking system.

[0029] The braking system assembly may have its own control unit, which may communicate with a central control unit of the vehicle. Furthermore, the braking system assembly may have a control unit that may be integrated into the central control unit of the vehicle via software and / or hardware.

[0030] Since the subsystems have multiple components, the failure of one of these components can lead to the failure of the respective subsystem. Failure of the primary or secondary brake request sensing can be caused, for example, by a failure of electronics, a sensor, or software. Failure of the primary or secondary brake request implementation can be caused, for example, by a failure of electronics, a sensor, software, or an electric motor. Failure of the primary or secondary power supply can be caused, for example, by a failure of a power line, a battery, a DC / DC converter, a fuse, an electronic component, or software. Failure of a data bus, for example the failure of the data bus between brake request sensing and brake request implementation, can also lead to the failure of the primary or secondary braking system.

[0031] The control unit can receive diagnostic messages, "alive" signals, and / or error states from the first and second autonomous braking systems and from the third indirect braking system, as well as from the first and second energy supplies and from the third energy supply, e.g. via a suitable transmission system, such as a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission. The control unit can receive the operating parameters, such as the state of charge and the temperature, from the traction battery, e.g. via a suitable transmission system, such as a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission.

[0032] Based on these input signals (diagnostic messages and / or error states and / or operating parameters), the control unit can decide whether regenerative deceleration is possible at all, to what extent, and / or until a standstill. Furthermore, the control unit can decide whether continued travel is possible after a first or second fault in the respective braking systems and / or power supplies. Furthermore, the control unit can decide whether automatic deceleration and / or emergency braking must be requested, and / or whether the automatic deceleration and / or emergency braking should be carried out regeneratively using the electric motor and / or via the first braking request implementation and / or via the second braking request implementation using the brake calipers.

[0033] The control unit can request a control unit of the electric motor to perform regenerative deceleration. The control unit can request deceleration using the brake calipers from the first braking request implementation and / or the second braking request implementation. Furthermore, the control unit can control the driver-vehicle interface to inform and / or warn the driver about the errors and / or to provide a suggestion for further operation of the vehicle, such as visiting a workshop. Furthermore, the control unit can inform the driver about the remaining distance and / or the remaining driving time.

[0034] The control unit and the electric motor control unit may be provided as a common unit or as two separate control units.

[0035] The following describes several exemplary failure scenarios that demonstrate the advantages of the braking system design according to the invention following a simple failure in one of the braking systems. The advantages lie in particular in the fact that continued driving of the vehicle can be ensured. Continuing driving of the vehicle after a simple failure is possible because, after a simple failure, two options are still available for continuing operation of the vehicle.

[0036] • A relevant fault scenario is the failure of the primary or secondary brake request detection. In this case, redundant detection of the brake request is still ensured via the remaining secondary or primary brake request detection, as well as via the third brake request detection (e.g., a button on an electronic parking brake). The vehicle can continue to drive, at least to a limited extent, e.g., for a specific time and / or distance, possibly at a limited speed. The driver can be informed of this via the driver-vehicle interface.

[0037] • Another relevant fault scenario is the failure of the primary or secondary brake request implementation when regenerative deceleration is possible at the same time. The control unit detects whether regenerative deceleration is possible based on operating parameters such as the state of charge and temperature of the high-voltage battery, particularly the traction battery. In this fault scenario, redundant implementation of the brake request via the remaining secondary or primary brake request implementation, as well as via regenerative deceleration, is still ensured. The vehicle can continue to drive, at least to a limited extent, e.g., for a specific time and / or distance, possibly at a limited speed. The driver can be informed of this via the driver-vehicle interface.

[0038] • Another relevant fault scenario is the failure of the first or second energy supply for the first or second braking system. If the first energy supply fails, the energy supply to the first braking system is continued for a short time via the third energy supply, and the energy supply to the secondary braking system is continued via the second energy supply. If the second long-term energy supply fails, the energy supply to the first braking system is continued via the first long-term energy supply and for a short time via the third energy supply. The vehicle can continue to drive, at least to a limited extent, e.g., for a specific time and / or distance, possibly at a limited speed. The driver can be informed of this via the driver-vehicle interface.

[0039] The following describes several exemplary fault scenarios that demonstrate the advantages of the braking system design according to the invention following a single fault or a double fault in one of the braking systems. The advantages lie in the fact that, after a double fault, the vehicle can be decelerated to a safe state, ideally to a standstill, through automatic braking. Automatic braking after a double fault is possible because, after a double fault, at least one opportunity is still available to decelerate the vehicle automatically and / or in response to the braking request.

[0040] • A relevant fault scenario is the simultaneous failure of the first and second braking systems. In this fault scenario, the control unit requests automatic braking or, if possible, emergency braking via regenerative deceleration from the control unit of the electric motor, e.g. after a short time, e.g. 1 minute. The control unit of the electric motor then controls the electric motor so that it is transferred to generator mode and decelerates recuperatively, advantageously taking into account the state of charge and / or the temperature of the high-voltage battery, in particular the traction battery. The vehicle can thus be decelerated, advantageously and / or if possible to a standstill, and the high-voltage battery, in particular the traction battery, and possibly at least one other auxiliary battery of the vehicle can be charged. The driver can be informed and / or warned of this via the driver-vehicle interface.• Another relevant fault scenario is the simultaneous failure of the first and second power supplies for the first and second braking systems. In this case, the power supply to the control unit and the first braking system is briefly ensured by the third power supply. In this case, the control unit requests immediate deceleration and / or emergency braking to a standstill from the first braking system. The driver can be informed and / or warned of this via the driver-vehicle interface.

[0041] • A relevant fault scenario is the failure of either the primary or secondary brake request implementation, if regenerative deceleration is not possible at the same time. The control unit detects whether regenerative deceleration is possible based on operating parameters, such as the charge level and temperature of the high-voltage battery, especially the traction battery. Possible causes for preventing regenerative deceleration include:

[0042] A fully charged high-voltage battery, especially the traction battery. The high-voltage battery, especially the traction battery, cannot absorb energy, which prevents it from being charged through recuperative deceleration. This can occur, for example, during long downhill rides when the high-voltage battery, especially the traction battery, is fully charged through recuperation. When charging at a charging station, however, the high-voltage battery, especially the traction battery, is usually not fully charged to protect the high-voltage battery.

[0043] Very low temperatures of the high-voltage battery, especially the traction battery (e.g., -30°C). Regardless of the charge level of the high-voltage battery, especially the traction battery, it cannot absorb electrical power at very low temperatures, which prevents the high-voltage battery, especially the traction battery, from being charged through regenerative deceleration.

[0044] In this event, the control unit requests automatic deceleration and / or emergency braking to a standstill from the remaining functioning braking system after a short time. The driver can be informed and / or warned of this via the driver-vehicle interface.

[0045] As already indicated above, it can be advantageous if the third braking system can be at least partially functionally implemented by another functionally essential system of the vehicle, in particular by an electromechanical drive system and / or an electronic parking brake. In this way, existing resources in the vehicle can be used to provide a second fallback level for providing the braking function. The first or primary braking system normally provides the braking function. The first fallback level for providing the braking function is provided by the second or secondary braking system. The second fallback level is provided by the third (at least partially indirect) braking system functionally or indirectly via another functionally essential system of the vehicle.

[0046] Advantageously, the third braking system can be designed to provide the braking function through regenerative or regenerative deceleration. In this way, an electric motor of the electromechanical drive system can be advantageously used not only to propel but also to decelerate the vehicle. The electric motor can thus serve as a third implementation device for implementing the braking request.

[0047] Furthermore, it may be advantageous if the third braking system can have a third detection device for detecting the braking request. In this way, the third (at least partially indirect) braking system can provide both a braking request detection (or detection device for detecting the braking request) and a braking request conversion (or conversion device for converting the braking request). The detection device for detecting the braking request in the third braking system is the third detection device. The conversion device for converting the braking request in the third braking system can preferably be an electric motor of an electromechanical drive system of the vehicle when the electric motor is operated in generator mode.

[0048] Advantageously, the third detection device can comprise a button of an electronic parking brake. This provides a structurally simple and advantageous detection device for detecting the braking request in the third braking system.

[0049] Thus, the third detection device can be implemented at least in part functionally by another functionally essential system of the vehicle, in particular by an electronic parking brake, preferably a button of an electronic parking brake.

[0050] Furthermore, it may be advantageous if the third detection device can be signal-connected via a first signal line, in particular directly, to the electronics of a first conversion device of the first braking system, and / or the third detection device can be signal-connected via a second signal line, in particular directly, to the electronics of a second conversion device of the second braking system. In this way, the third detection device can directly access the first and / or second conversion device to convert the braking request, advantageously without a data bus.

[0051] Furthermore, a third power supply can be provided at least for the first braking system. The third power supply can preferably be designed to supply a control unit. It is conceivable that the third power supply can be designed as a short-term power supply, in particular comprising a low-voltage battery and / or a supercapacitor. Thus, in the braking system design, three power supplies—two long-term power supplies and one short-term power supply—can be provided to enable safe braking of the vehicle in the event of a single fault or even a double fault in one of the power supplies.

[0052] As already indicated above, the first braking system or the primary braking system can be designed autonomously and operate independently and autonomously from other systems in the vehicle. For this purpose, the first braking system can have a first detection device for detecting the braking request, a first conversion device for converting the braking request, and / or a first transmission system for forwarding the detected braking request from the first detection device to the first conversion device. Furthermore, the first braking system can have at least one control electronics unit for a first detection device, a first conversion device, and a first transmission system.

[0053] As also indicated above, the second braking system or the secondary braking system can also be designed autonomously and operate independently and autonomously from other systems in the vehicle. For this purpose, the second braking system can have a second detection device for detecting the braking request, a second conversion device for converting the braking request, and / or a second transmission system for forwarding the detected braking request from the second detection device to the second conversion device. Furthermore, the second braking system can have at least one control electronics system for a second detection device, a second conversion device, and a second transmission system.

[0054] Advantageously, the first power supply can be designed as a long-term power supply, for example, comprising a high-voltage battery and / or a DC / DC converter. According to a further advantage, the second power supply can be designed as a long-term power supply, for example, comprising a high-voltage battery and / or a DC / DC converter. Furthermore, it is conceivable that the first power supply and / or the second power supply can be designed to supply a control unit. In this way, the first power supply and / or the second power supply can be used across multiple functions.

[0055] It is also conceivable that the first braking system can be connected to a control unit in terms of signaling, for example via a transmission system such as a bus system, for example for transmitting diagnostic data.

[0056] Furthermore, it is conceivable that the first braking system is connected to a control unit in terms of control technology, for example via a transmission system, such as a bus system, for example to carry out automatic braking and / or emergency braking.

[0057] But the second braking system can also be connected to a control unit via a signal transmission system, such as a bus system, for example for transmitting diagnostic data.

[0058] Furthermore, the second braking system can be connected to a control unit in terms of control technology, for example via a transmission system such as a bus system, for example to carry out automatic braking and / or emergency braking.

[0059] In addition, the third braking system can also be connected to a control unit via a transmission system, such as a bus system, for example for transmitting diagnostic data.

[0060] Advantageously, the first power supply can be connected to a control unit via a signal transmission system, such as a bus system, for example for transmitting diagnostic data.

[0061] Furthermore, it may be advantageous for the second power supply to be connected to a control unit in terms of signaling, for example via a transmission system such as a bus system, for example for transmitting diagnostic data.

[0062] Furthermore, it may be advantageous for the third power supply to be connected to a control unit via a signaling system, e.g., via a transmission system such as a bus system, for example, for transmitting diagnostic data. As already mentioned above, a control unit may be provided in the brake system structure. The control unit may, for example, be integrated into a central control unit of the vehicle using software and / or hardware. Alternatively, it is conceivable that the control unit may be provided as a separate control unit.

[0063] Preferably, the control unit is designed to

[0064] Diagnostic data from the first braking system,

[0065] Diagnostic data from the second braking system,

[0066] Diagnostic data from the third braking system,

[0067] To query, receive and / or process diagnostic data from the first energy supply, diagnostic data from the second energy supply, diagnostic data from the third energy supply, and / or at least one operating parameter of a high-voltage battery, in particular a traction battery, of the vehicle.

[0068] In this way, the control unit can decide whether the braking systems are functional, whether there is a fault, whether there is a double fault and / or whether the high-voltage battery, in particular the traction battery, and possibly at least one other auxiliary battery of the vehicle can be charged.

[0069] Furthermore, the control unit can be designed to control the first braking system and / or the second braking system to carry out automatic braking and / or emergency braking.

[0070] The control can preferably be carried out as a function of diagnostic data from the first braking system, from the second braking system, from the third braking system, from the first energy supply, from the second energy supply, from the third energy supply and / or from at least one operating parameter of a high-voltage battery, in particular the traction battery, of the vehicle.

[0071] Furthermore, the control unit can be designed to control another functionally essential system of the vehicle, in particular an electromechanical drive system, in order to provide the braking function by means of a generator-based deceleration.

[0072] The control can preferably be carried out as a function of diagnostic data from the first braking system, from the second braking system, from the third braking system, from the first energy supply, from the second energy supply, from the third energy supply and / or from at least one operating parameter of a high-voltage battery, in particular a traction battery, of the vehicle.

[0073] In addition, the control unit can be configured to control a driver-vehicle interface to inform and / or warn a driver about errors and / or to issue a suggestion for further operation of the vehicle, such as visiting a repair shop. In an autonomously driving vehicle, the driver-vehicle interface can be referred to as a user-vehicle interface or a passenger-vehicle interface.

[0074] In addition, the control unit can be designed to inform a driver about the remaining distance and / or the remaining driving time.

[0075] The invention further provides: a vehicle with a braking system structure, which can be designed as described above. The vehicle according to the invention can achieve the same advantages as those described above in connection with the braking system structure according to the invention. These advantages are incorporated herein by reference.

[0076] Furthermore, a steering system or a steer-by-wire system can be provided in the vehicle, which can have the following subsystems: a first steering system for providing a steering function, which is designed autonomously and / or has a first energy supply, a second steering system for providing a first fallback level for the steering function, which is designed autonomously and / or has a second energy supply, and a third steering system for providing a second fallback level for the steering function, in particular by means of wheel-selective braking.

[0077] The third steering system can be implemented at least in part functionally by another functionally essential system of the vehicle, in particular by the primary and / or secondary braking system and / or a driver assistance system.

[0078] Advantageously, the third steering system can be designed to provide the steering function through wheel-selective braking. The third steering system can further comprise a third detection device for detecting the steering request. The third detection device can, for example, comprise a third steering wheel angle sensor for detecting the steering request. Furthermore, the third detection device can be functionally implemented at least in part by another functionally essential system of the vehicle, in particular by a driver assistance system, preferably a lane keeping assistant, an autopilot, etc.

[0079] The third detection device may have a third transmission system for forwarding the detected steering request to a control unit. Furthermore, a first signal line may be provided, which is designed to forward the detected steering request from the control unit to the first steering system. Furthermore, a second signal line may be provided, which is designed to forward the detected steering request from the control unit to the second steering system.

[0080] The third power supply can be used for the first steering system.

[0081] The invention is further illustrated in more detail with reference to the figure. It should be noted that the figure is merely descriptive and is not intended to limit the invention in any way. It shows:

[0082] Fig. 1 shows an exemplary brake system structure within the scope of the present disclosure.

[0083] Fig. 1 shows a braking system structure 100 within the scope of the present disclosure, which can advantageously be embodied in the form of a brake-by-wire system for a vehicle F, for example, a hybrid or electric vehicle. In the braking system structure 100 within the scope of the present disclosure, detection devices 11, 21, 31 and conversion devices 13, 23, 33 for a braking request (which can come, for example, from the driver or the vehicle) can be mechanically decoupled from one another.

[0084] The braking system structure 100 has the following systems 10, 20, 30: a first or primary braking system 10, which can also be referred to as a first or primary autonomous braking system, which is designed to provide a braking function and which is autonomous and / or has a first or primary energy supply E1, a second or secondary braking system 20, which can also be referred to as a second or secondary autonomous braking system, which is designed to provide a first fallback level for the braking function and which is autonomous and / or has a second or secondary energy supply E2, and a third braking system 30, which can be designed at least in part as an indirect and / or functionally implemented braking system, which is designed to provide a second fallback level for the braking function, e.g.via an electromechanical drive system 103, 104 of the vehicle F, preferably via an electric motor 103 of the electromechanical drive system 103, 104, which can be operated in a generator mode to provide the braking function in the second fallback level in order to enable a generator-based deceleration of the vehicle F.

[0085] The vehicle F can further comprise, as part of the electromechanical drive system 103, 104, a traction battery 104, e.g. a high-voltage battery, which can be operated with direct voltages of approximately 60 V to approximately 1.5 kV.

[0086] The vehicle F may also have at least one central control unit 110.

[0087] In addition, the vehicle F may include a driver-vehicle interface (HMI), for example in the form of an interactive input and output unit, e.g., comprising a display, an acoustic output device, etc.

[0088] As illustrated in Fig. 1, the braking system structure 100 comprises two redundant autonomous braking systems 10, 20 which are self-sufficient or independent and which can function independently of one another and of other functional systems of the vehicle F.

[0089] The first braking system 10 and the second braking system 20 are supplied with electrical energy E via two independent energy supplies E1, E2, as indicated in Fig. 1 by dash-dotted lines. The independent energy supplies E1, E2 can, for example, each have a high-voltage battery that can be operated with direct voltages of approximately 60 V to approximately 1.5 kV. In addition, the independent energy supplies E1, E2 can each have a suitable DC / DC converter. Each of these two autonomous braking systems 10, 20 can also have several subsystems 11, 12, 13 and 21, 22, 23, such as a braking request detection or detection device 11, 21 for detecting the braking request and a braking request conversion or conversion device 13, 23 for converting the braking request.The braking request can be transmitted in both autonomous braking systems 10, 20 from the respective detection device 11, 21 to the respective conversion device 13, 23 via a corresponding transmission system 12, 22, such as a bus system or a data bus, e.g. with a CAN or SENT protocol.

[0090] The respective detection device 11, 21 can be designed as an electronic brake pedal. The driver's actuation of the brake pedal can be detected, for example, via force and / or displacement sensors or the like. Corresponding control electronics of the respective detection device 11, 21, comprising, for example, appropriate electronics and / or software, can passively receive the sensor data, actively query it, and, if necessary, evaluate it. Furthermore, the control electronics of the respective detection device 11, 21 can transmit the sensor data and / or the evaluation results to the corresponding conversion device 13, 23 via an associated transmission system 12, 22.

[0091] The respective conversion device 13, 23 can also have corresponding control electronics, including, for example, corresponding electronics and / or software. The evaluation of sensor data from the respective detection device 11, 21 can be performed in the control electronics of the detection device 11, 21 and / or in the control electronics of the conversion device 13, 23. The control electronics of the detection device 11, 21 and the control electronics of the conversion device 13, 23 can be provided as separate control electronics or as a common control electronics.

[0092] At least one conversion device 13, 23 can be designed as a so-called "wet" by-wire braking system. The conversion device 13, 23 can have an electric motor, various sensors, and hydraulic valves. The brake pads in the brake calipers can be pressed against the brake discs by hydraulic pressure. Control electronics of the conversion device 13, 23 and the brake calipers can be connected to one another via hydraulic lines (for hydraulic valves). The control electronics actuates the electric motor in such a way that a specific hydraulic pressure and a specific braking torque can be generated, which corresponds to the detected braking request. At least one conversion device 13, 23 can be designed as a so-called "dry" by-wire braking system. The conversion device 13, 23 can include an electric motor, various sensors, and mechanical actuating elements.The brake pads in the brake calipers can be pressed against the brake discs via electric motors and mechanical actuators. The control electronics and the brake calipers can be connected via power lines (for the electric motors) and data lines (for the sensors). The control electronics controls the electric motors in such a way that a specific braking torque can be provided that corresponds to the detected braking request.

[0093] The first braking system 10 and the second braking system 20 each have their own energy supply E1, E2, in particular a long-term energy supply. The third braking system 30 can further have a third energy supply E3, in particular a short-term energy supply. The respective long-term energy supply E1, E2 can, for example, have a DC / DC converter, which can be connected to a corresponding high-voltage battery. The short-term energy supply E3 can, for example, have a low-voltage battery and / or a supercapacitor, so-called ultra-cap, or the like.

[0094] If a so-called "wet" by-wire braking system is used and only one of the two braking systems 10, 20 is equipped with hydraulic valves for modulating the braking pressures, the braking system equipped with hydraulic valves can advantageously be connected to the short-term energy supply E3. In this way, even if the primary and secondary long-term energy supplies E1, E2 fail simultaneously, basic braking functions such as braking the vehicle to a standstill, as well as safety-relevant braking control functions such as ABS and ESC, can be ensured, at least for a short time.

[0095] The invention is based on the idea that the third braking system 30 can be designed at least in part as a consequential or indirect braking system, preferably as a deceleration system, for providing a second fallback level for the braking function. The third braking system 30 can functionally utilize another functionally essential system of the vehicle F, such as the electromechanical drive system 103, 104, in particular the electric motor 103 in generator mode G, in order to provide the braking function in the second fallback level, for example by regenerative deceleration of the vehicle F. The electric motor 103 in generator mode G acts like a third conversion device 33 for providing the braking function in the second fallback level. The third braking system 30 can advantageously have its own, meaning third, braking request detection or detection device 31 for detecting the braking request (which, for example,may come from the driver). The detection device 31 may comprise a button of an electronic parking brake. The button may be connected directly to the electronics of the primary and secondary conversion devices 13, 23 via a signal line.

[0096] The braking system assembly 100 may have its own control unit 101, which may be in communication with a central control unit 110 of the vehicle F. As indicated in Fig. 1, the braking system assembly 100 may have a control unit 101, which may be integrated into the central control unit 110 of the vehicle F in terms of software and / or hardware.

[0097] Since the subsystems of the two autonomous braking systems 10, 20 comprise multiple components, the failure of one of these components can lead to a partial or complete failure of the braking systems 10, 20. A failure of one of the braking systems 10, 20 can be caused by a failure of a power line, a data bus, a battery, a DC / DC converter, a fuse, a software, a sensor, an actuator, a valve, a control element, etc.

[0098] As Fig. 1 illustrates, the control unit 101 can receive diagnostic data D1, D2, D3, DE1, DE2, DE3 "alive" signals, and / or error states from the first and second autonomous braking systems 10, 20 and from the third indirect braking system 30 as well as from the first and second energy supplies E1, E2 and from the third energy supply E3, for example via a suitable transmission system, such as a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, such as a radio transmission. The control unit 101 can receive the operating parameters, such as the state of charge SOC and the temperature T, from the high-voltage battery, in particular the traction battery 104, for example via a suitable transmission system, such as B. a bus system or a data bus, e.g. with a CAN or SENT protocol, e.g. via CAN bus, and / or a wireless transmission, e.g.a radio transmission.

[0099] Depending on diagnostic data D1, D2, D3, DE1, DE2, DE3 and / or operating parameters SOC, T of the high-voltage battery, in particular of the traction battery 104, the control unit 101 can decide whether regenerative deceleration is possible at all, to what extent, and / or up to full braking. Furthermore, the control unit 101 can decide whether the vehicle F can continue driving after a first or second fault in the respective braking systems 10, 20, 30 and / or in the energy supplies E1, E2, E3. Furthermore, the control unit 101 can decide whether moderate deceleration and / or emergency braking of the vehicle F is necessary, and / or whether automatic deceleration and / or emergency braking should be carried out regeneratively using the electric motor 103 and / or via the first conversion device 13 and / or via the second conversion device 23 using the brake calipers.

[0100] The control unit 101 can request a control unit 102 of the electric motor 103 to perform regenerative deceleration. The control unit 101 can request deceleration using the brake calipers from the first conversion device 13 and / or the second conversion device 23. Furthermore, the control unit 101 can control the driver-vehicle interface (HMI) to inform and / or warn the driver about errors in the braking systems 10, 20 and / or to issue a suggestion for further operation of the vehicle F, such as visiting a workshop. Furthermore, the control unit 101 can inform the driver about the remaining distance and / or the remaining travel time.

[0101] The control unit 101 and the control unit 102 of the electric motor 103 can be provided as a common control unit, for example as part of the central control unit 110 of the vehicle F, or as two separate control units.

[0102] In the following, some examples of fault cases are described which can be counteracted in an advantageous, comfortable, and safe manner using the braking system structure 100, thus ensuring that the vehicle F can continue to travel. After a simple fault, two options are still provided for operating the vehicle.

[0103] • A relevant fault scenario is the failure of the primary or secondary detection device 11, 21. In this fault scenario, redundant detection of the braking request is still ensured via the remaining secondary or primary detection device 21, 11, as well as via the third detection device 31, e.g., a button of an electronic parking brake. The vehicle F can continue to drive, at least to a limited extent, e.g., for a specific time and / or for a specific distance. The driver can be informed of this via the driver-vehicle interface (HMI).

[0104] • Another relevant error case is the failure of the primary or secondary

[0105] Conversion device 13, 23, if necessary, if regenerative deceleration is possible at the same time. Control unit 101 detects whether regenerative deceleration is possible based on operating parameters, such as the state of charge and temperature, of the high-voltage battery, in particular the traction battery 104. In this fault event, redundant implementation of the braking request via the remaining secondary or primary conversion device 23, 13, as well as, if necessary, via regenerative deceleration, is still ensured. Vehicle F can continue to travel, at least to a limited extent, e.g., for a specific time and / or for a specific distance. The driver can be informed of this via the driver-vehicle interface (HMI).

[0106] • Another relevant fault case is the failure of the first or second energy supply E1, E2 for the first or second braking system 10, 20. If the first energy supply E1 fails, the energy supply to the first braking system 10 is continued for a short time via the third energy supply E3 and the energy supply E2 of the secondary braking system 20 is continued via the second energy supply E2. If the second long-term energy supply E2 fails, the energy supply to the first braking system is continued via the first long-term energy supply E1 and for a short time via the third energy supply E3. The vehicle F can continue to drive, at least to a limited extent, e.g. for a certain time and / or for a certain distance. The driver can be informed of this via the driver-vehicle interface HMI.

[0107] The following describes some examples of single-fault or double-fault cases that can be addressed in an improved and safe manner using the braking system structure 100, so that after a double-fault, the vehicle F can be decelerated to a safe state by automatic braking, if possible, even to a standstill. Advantageously, automatic braking can be ensured after a double-fault because, even after a double-fault, at least one opportunity is still provided to decelerate the vehicle automatically and / or based on the braking request.

[0108] • A relevant fault case is the simultaneous failure of the first and second braking systems 10, 20. In this fault case, the control unit 101 requests automatic braking and / or emergency braking via regenerative deceleration from the control unit 102 of the electric motor 103, for example after a short time, e.g., 1 minute. The control unit 102 of the electric motor 103 then controls the electric motor 103 such that it is transferred to generator mode G and regeneratively decelerates the vehicle F, advantageously taking into account the state of charge SOC and / or the temperature T of the high-voltage battery, in particular the traction battery 104. The electric motor 103 generates a charging current I for the high-voltage battery, in particular the traction battery 104, which is charged as a result. The driver can be informed and / or warned of this via the driver-vehicle interface HMI.

[0109] • Another relevant fault scenario is the simultaneous failure of the first and second power supplies E1, E2 for the first and second braking systems 10, 20. In this fault scenario, the power supply to the control unit 101 and the first braking system 10 is ensured for a short time by the third power supply E3. In this fault scenario, the control unit 101 requests immediate deceleration and / or emergency braking to a standstill from the first braking system 10. The driver can be informed and / or warned of this via the driver-vehicle interface (HMI).

[0110] • A relevant error case is the failure of either the primary or secondary conversion device 13, 23, especially if regenerative deceleration is not possible at the same time. Control unit 101 detects whether regenerative deceleration is possible based on operating parameters, such as the state of charge and temperature, of the high-voltage battery, in particular the traction battery 104. Possible cases where regenerative deceleration is not possible include:

[0111] A fully charged high-voltage battery, in particular the traction battery 104. The high-voltage battery, in particular the traction battery 104, cannot absorb any energy. This can occur, for example, during long downhill rides when the high-voltage battery, in particular the traction battery 104, is fully charged via recuperation. When charging at a charging station, the traction battery 104 is usually not fully charged to protect the high-voltage battery.

[0112] Very low temperature T of the traction battery 104, e.g., T = -30°C. Regardless of the state of charge SOC of the traction battery 104, no electrical power can be absorbed at very low temperatures T.

[0113] In this error event, control unit 101 requests automatic deceleration and / or emergency braking to a standstill from the remaining functioning braking system 10, 20 after a short time. The driver can be informed and / or warned of this via the driver-vehicle interface (HMI).

[0114] F vehicle

[0115] 100 Brake system structure

[0116] 10 first braking system

[0117] 11 first detection device

[0118] 12 first transmission system

[0119] 13 first transfer device

[0120] 20 second braking system

[0121] 21 second detection device

[0122] 22 second transmission system

[0123] 23 second transfer device

[0124] 30 third braking system

[0125] 31 third detection device

[0126] 33 third conversion device, generator delay

[0127] 110 central control unit

[0128] 101 Control unit

[0129] 102 Control unit

[0130] 200 additional functionally essential systems

[0131] 103, 104 Drive system

[0132] 103 Electric motor

[0133] 104 Traction battery

[0134] E electrical energy E1 first energy supply

[0135] E2 second power supply

[0136] E3 third energy supply

[0137] G Generator operation

[0138] I Charging current

[0139] HMI driver-vehicle interface

[0140] 51 first signal line

[0141] 52 second signal line

[0142] S10 automatic braking and / or emergency braking

[0143] S20 automatic braking and / or emergency braking

[0144] D1 Diagnostic data

[0145] D2 Diagnostic data

[0146] D3 Diagnostic data

[0147] DE1 Diagnostic data

[0148] DE2 diagnostic data

[0149] DE3 diagnostic data

[0150] SOC state of charge

[0151] T Temperature

Claims

Claims for a brake system assembly (100) for a vehicle (F) in which detection devices (11, 21, 31) and implementation devices (13, 23, 33) for a brake request are mechanically decoupled from each other, comprising: a first brake system (10) for providing a brake function, which is autonomously designed and has a first power supply (E1), a second brake system (20) for providing a first fallback level for the brake function, which is autonomously designed and has a second power supply (E2), and a third brake system (30) for providing a second fallback level for the brake function; wherein a third power supply (E3) is provided at least for the first brake system (10).Brake system assembly (100) according to claim 1, wherein the third brake system (30) is implemented at least partially by another functionally essential system (200) of the vehicle (F), namely by an electromechanical drive system (103, 104) and / or an electronic parking brake, and / or wherein the third brake system (30) is designed to provide the braking function by means of regenerative deceleration (33).Brake system assembly (100) according to one of the preceding claims, wherein the third brake system (30) has a third detection device (31) for detecting the brake request, wherein in particular the third detection device (31) has a button of an electronic parking brake, and / or wherein the third detection device (31) is at least partially implemented functionally by a further essential system (200) of the vehicle (F), in particular by an electronic parking brake, preferably a button of an electronic parking brake. A brake system assembly (100) according to the preceding claim, wherein the third detection device (31) is connected via a first signal line (S1) to a first conversion device (13) of the first brake system (10) and / or wherein the third detection device (31) is connected via a second signal line (S2) to a second conversion device (23) of the second brake system (20). A brake system assembly (100) according to any one of the preceding claims, wherein the third power supply (E3) is configured to supply a control unit (101) and / or is designed as a short-term power supply.Brake system assembly (100) according to one of the preceding claims, wherein the first brake system (10) comprises a first detection device (11) for detecting the brake request, a first conversion device (13) for converting the brake request and / or a first transmission system (12) for forwarding the detected brake request from the first detection device (11) to the first conversion device (13), and / or wherein the first brake system (10) comprises at least one control electronics for a first detection device (11), a first conversion device (13) and a first transmission system (12).A braking system assembly (100) according to one of the preceding claims, wherein the second braking system (20) comprises a second detection device (21) for detecting the braking request, a second conversion device (23) for converting the braking request, and / or a second transmission system (22) for forwarding the detected braking request from the second detection device (21) to the second conversion device (23), and / or wherein the second braking system (20) comprises at least one control electronics unit for a second detection device (21), a second conversion device (23), and a second transmission system (22). A braking system assembly (100) according to one of the preceding claims, wherein the first power supply (E1) is designed as a long-term power supply. and / or wherein the second power supply (E2) is designed as a long-term power supply, and / or wherein the first power supply (E1) and / or the second power supply (E2) are designed to supply a control unit (101). Brake system assembly (100) according to one of the preceding claims, wherein the first brake system (10) is connected to a control unit (101) via a signal system, e.g., a transmission system such as a bus system, in particular for transmitting diagnostic data (D1), and / or wherein the first brake system (10) is connected to a control unit (101) via a control system, e.g., a transmission system such as a bus system, in particular for performing automatic braking and / or emergency braking (S10). Brake system assembly (100) according to one of the preceding claims, wherein the second brake system (20) is connected to a control unit (101) via a signal system, e.g., a transmission system such as a bus system, in particular for performing automatic braking and / or emergency braking (S10).a bus system, connected to a control unit (101), in particular for transmitting diagnostic data (D2), and / or wherein the second brake system (20) is connected to a control unit (101) via a control system, e.g., a transmission system such as a bus system, in particular for performing automatic braking and / or emergency braking (S20), and / or wherein the third brake system (30) is connected to a control unit (101) via a signal system, e.g., a transmission system such as a bus system, in particular for transmitting diagnostic data (D3). Brake system configuration (100) according to one of the preceding claims, wherein the first power supply (E1) is connected to a control unit (101) via a signal system, e.g., a transmission system such as a bus system, in particular for transmitting diagnostic data (D3). B. a bus system, is connected to a control unit (101), in particular for transmitting diagnostic data (DE1), and / or wherein the second power supply (E2) is signal-technical, e.g. via a transmission system, such as e.g.a bus system connected to a control unit (101), in particular for transmitting diagnostic data (DE2), and / or wherein the third power supply (E3) is connected to a control unit (101) via a signal transmission system, such as a bus system, in particular for transmitting diagnostic data (DE3). Brake system assembly (100) according to one of the preceding claims. wherein a control unit (101) is provided which is integrated, in particular, in a central control unit of the vehicle (F) in terms of software and / or hardware, wherein the control unit (101) is preferably designed to query, receive and / or process diagnostic data (D1) from the first brake system (10), diagnostic data (D2) from the second brake system (20), diagnostic data (D3) from the third brake system (30), diagnostic data (DE1) from the first power supply (E1), diagnostic data (DE2) from the second power supply (E2), diagnostic data (DE3) from the third power supply (E3), and / or at least one operating parameter (SOC, T) of a high-voltage battery, in particular a traction battery (104), of the vehicle (F).Brake system assembly (100) according to the preceding claim, wherein the control unit (101) is configured to control the first brake system (10) and / or the second brake system (20) to perform automatic braking and / or forced braking (S10, S20), preferably depending on diagnostic data (D1, D2, D3, DE1, DE2, DE3) from the first brake system (10), from the second brake system (20), from the third brake system (30), from the first power supply (E1), from the second power supply (E2), from the third power supply (E3) and / or from at least one operating parameter (SOC, T) of a high-voltage battery, in particular a traction battery (104), of the vehicle (F).Brake system assembly (100) according to one of the preceding claims, wherein the control unit (101) is configured to control a further functionally essential system (200) of the vehicle (F) in order to provide the braking function by means of regenerative deceleration, preferably depending on diagnostic data (D1, D2, D3, DE1, DE2, DE3) from the first brake system (10), from the second brake system (20), from the third brake system (30), from the first power supply (E1), from the second power supply (E2), from the third power supply (E3) and / or from at least one operating parameter (SOC, T) of a traction battery (104), of the vehicle (F), and / or wherein the control unit (101) is configured to. To control a driver-vehicle interface (HMI) to inform and / or warn a driver about errors and / or to issue a suggestion for further operation of the vehicle (F), such as visiting a workshop, and / or to inform a driver about the remaining distance and / or the remaining driving time. Vehicle with a brake system assembly (100) according to one of the preceding claims.

Images