Vehicle component having a steering input device for inputting a steering command according to the steer-by-wire concept, and method

Abstract

The invention relates to a vehicle component (500) having a steering input device (510) for inputting a steering command according to the steer-by-wire concept, comprising: a steering unit (501); an actuator device (502); a control device (503); a diagnosis device (504) for identifying failure of the steering input device (510); and a failure protection system (505) which is controllable by the diagnosis device (504) and which acts on the steering unit (501) in the event of a failure identified by the diagnosis device (504). The failure protection system (505) comprises a failure braking device (515), which cancels its braking effect if there is a defined power supply and provides its braking effect if the defined power supply ceases and brakes the movability of the steering unit (501) with a targeted failure braking torque. The diagnosis device (504) is suitable and designed for switching an interruption device (506) into a failure mode, so that the power supply to the failure braking device (515) is interrupted and the failure braking device (515) provides its failure braking torque.

Description

[0001] Vehicle component with a steering input device for specifying a steering command according to the steer-by-wire concept and method

[0002] The invention relates to a vehicle component with a steering input device for inputting a steering command according to the steer-by-wire concept. The steering input device comprises at least one movable steering unit and at least one actuator device for generating a torque acting on the steering unit.

[0003] Such steering control systems are subject to stringent requirements. For example, precise steering feedback and smooth, play-free steering behavior, especially around the center position, as well as overall smooth, harmonious steering behavior, are required. Furthermore, the steering system must be able to provide high torques or counteract the manual steering movement (the torque then corresponds to a braking torque). This is necessary, for example, to represent end stops, to support the driver when exiting the vehicle, or as a counter-torque during very rapid twisting or steering movements.

[0004] Therefore, steering systems with an electric motor have become popular. This motor is coupled to the steering wheel either directly or via a reduction gear or (toothed) belt. Such directly mounted electric motors generate, for example, active braking torques (nominal torques) of up to eight newton meters (Nm) and short-term passive braking torques of up to 25 Nm.

[0005] A further requirement for steering command devices relates to safety in the event of a malfunction, for example a power failure or a failure of the components that generate the torque (failsafe case). Because there is no longer any torque to oppose the steering movement, the steering is very light and no resistance is felt when steering. For example, if an electric motor suddenly fails when turning into a bend, the torque in the steering line that counteracts the manual steering movement drops abruptly. This can lead to the unintentional command of a sharp steering angle via the steering wheel (oversteering). This results in a very dangerous driving situation that must be corrected by the driver. This can even lead to the driver losing control of the vehicle if, for example, the driver steers into the oncoming lane or over the edge of the road on a winding uphill stretch.

[0006] The existing steering systems with fail-safe mechanisms, which can be used to handle such failures, are generally highly redundant and complex, requiring considerable installation space and considerable cost. Furthermore, this also makes fault analysis very complicated. The state of the art (e.g., DE 10 2018 124 499 A1) is known to meet the high reliability requirements of a steer-by-wire unit through triple fail-safe redundancy.

[0007] If a corresponding fault is detected, for example, by a diagnostic device, an additional electric motor or an additional winding of the electric motor is often activated to generate the braking torque. To ensure a high level of safety, in addition to the additional electric motor or winding, the control unit (ECU, Electronic Control Unit) is also implemented in duplicate. In addition, various other components must be implemented at least in duplicate to meet the requirements.

[0008] For example, in order to control a motor with two redundant windings in the event of a fault, two ECUs and two connectors, data lines and cables are required. If one winding or one ECU fails, one still remains active. The two ECUs must be equipped with components from different production batches so that a systematic fault in one component does not have a synchronous (not simultaneous) effect. Two on-board batteries are also required to supply power to the motor if one battery fails. Furthermore, the motor must be able to both drive and brake, which always requires power (4-quadrant operation). The direction of rotation and deflection must also always be processed in the ECU in order to control the motor of the steering command device.

[0009] In contrast, the object of the present invention is to provide an improved vehicle component. In particular, the vehicle component should offer a high level of safety even in the event of a malfunction, while at the same time being easy to implement and economically manufacture in terms of design and space requirements.

[0010] This object is achieved by a vehicle component having the features of claim 1. The method according to the invention is the subject of claim 20. Preferred developments of the invention are the subject of the dependent claims. Further advantages and features of the present invention emerge from the general description and from the description of the exemplary embodiments.

[0011] The vehicle component according to the invention comprises a steering input device for inputting a steering command according to the steer-by-wire concept. The steering input device comprises at least one movable steering unit and in particular a steering wheel. The steering input device comprises at least one actuator device for generating a torque acting on the steering unit. The steering input device comprises at least one control device for controlling the actuator device in order to adjust the torque acting on the steering unit. The steering input device comprises at least one diagnostic device for detecting a malfunction of the steering input device. In particular, in the event of such a malfunction, the actuator device provides an inadmissible torque acting on the steering unit. The steering input device comprises at least one malfunction protection device that can be controlled by the diagnostic device.The emergency shutdown device is suitable and designed to act on the steering unit in the event of a fault detected by the diagnostic device, so that the steering unit cannot be moved without resistance. The emergency shutdown device comprises at least one emergency braking device. The emergency braking device is suitable and designed to cancel its braking effect when there is a defined (sufficient) power supply and to provide its braking effect when the defined (sufficient) power supply fails and to brake the mobility of the steering unit with a targeted emergency braking torque. The emergency shutdown device comprises at least one interruption device. The interruption device can be controlled in particular by the diagnostic device.The diagnostic device is suitable and designed to switch the interruption device (in the event of a detected fault) into a fault mode, so that the energy supply to at least the fault braking device is interrupted and the fault braking device provides its fault braking torque.

[0012] The vehicle component according to the invention offers many advantages. The combination of the special emergency braking device and the interruption device offers a significant advantage. The braking device enables particularly reliable braking of the steering unit so that it cannot be moved without resistance. Because the emergency braking device provides its braking effect without a power supply, the emergency protection system can be implemented very simply and economically. This eliminates the need for complex and often failure-prone control. The interruption device offers a simple and reliable way of specifically triggering the emergency braking device in the event of a malfunction. The interruption device therefore only has to interrupt the power supply to the emergency braking device in the event of a malfunction.The emergency braking torque is preferably in a range from 1.0 Nm to 4 Nm, preferably in a range from 1.5 Nm to 3 Nm. For example, the emergency braking torque can be 2 Nm.

[0013] Preferably, the interruption device is suitable and designed to also interrupt the power supply to the actuator device in the event of a malfunction. This has the advantage that the actuator device can no longer generate inadmissible or undesired torque in the event of a malfunction. This can, for example, prevent the steering unit from being blocked by the actuator device or rotated undesirably in the event of a malfunction. Particularly preferably, the interruption device interrupts at least one supply line that is provided for both the actuator device and the emergency braking device. It is also possible for the interruption device to interrupt at least one supply line each for the actuator device and for the emergency braking device. It is possible for the emergency braking device to be provided at least partially by the actuator device (e.g., service braking device and / or clutch device).Interrupting the power supply to the actuator device can then correspond to interrupting the power supply to the emergency braking device.

[0014] An inadmissible torque acting on the steering unit, which is detected by the diagnostic unit according to the invention in the event of a malfunction of the steering input device, is understood to mean in particular a torque which has a safety-relevant influence on the steering and / or driving characteristics of the vehicle. In particular, the torque can be inadmissibly high or inadmissibly low (relative to a predetermined target value). Such a malfunction occurs, for example, if the actuator device cannot provide the torque acting on the steering unit. For example, if the control of the actuator device is faulty or the actuator device is defective and does not provide any torque. A malfunction also occurs, for example, if the actuator device exerts an inadmissibly high torque. This is the case, for example, if the actuator device is supplied with current in an inadmissible manner and / or with an inadmissibly high current.By detecting the fault, the fault braking device and, if necessary, the actuator device can be brought into a safe state that is not dangerous for the driver.

[0015] In particular, the steering input device comprises at least one power electronics device, which is preferably controllable by the control device. In particular, the emergency braking device and / or the actuator device are supplied with electrical energy by means of the power electronics device. In particular, the interruption device interrupts the energy supply to the power electronics device in the event of a malfunction. Alternatively or additionally, it can be provided that the interruption device interrupts the energy supply to the components connected to the power electronics device (in particular the emergency braking device and / or the actuator device) in the event of a malfunction.

[0016] In particular, a common power electronics device is provided for the emergency braking device and the actuator device. In particular, the interruption device disconnects a supply line between the power electronics device and an associated energy storage device, such as a vehicle battery.

[0017] In an advantageous development, the control device and the power electronics device are each supplied with electrical energy via at least one separate supply line. In particular, in the event of a malfunction, the interruption device interrupts the supply line of the power electronics device, while the supply line of the control device is maintained. In particular, the interruption device does not interrupt the supply line of the control device. Thus, the malfunction braking device can be reliably activated, while the control device remains available for executing steering commands and / or for diagnostics by at least one higher-level control level of a vehicle electronics system.

[0018] In particular, the control device and the power electronics device are connected to at least one (common) energy storage device. For example, at least one vehicle battery is provided for this purpose. It is also possible for the control device and the power electronics device to each be connected to at least one separate energy storage device.

[0019] In an advantageous development, the diagnostic device and the interruption device are supplied with power together with the control device. In particular, these components have at least one common energy storage device. In particular, these components are supplied with power via at least one common supply line.

[0020] In a preferred and advantageous development, the diagnostic device comprises at least two diagnostic units. In particular, the diagnostic units are designed to be redundant. In particular, the diagnostic units are each suitable and designed to process (independently of one another) at least partially the same input data and to provide diagnostic data therefrom.

[0021] The diagnostic device is preferably suitable and configured to utilize the diagnostic data of at least two diagnostic units to detect a malfunction, and preferably to compare them. Preferably, the diagnostic units are provided to mutually monitor and preferably compare their diagnostic data. It is also possible for the diagnostic device to comprise at least one higher-level unit that evaluates the diagnostic data of the diagnostic units and, in particular, compares them with one another.

[0022] In particular, the diagnostic device is suitable and configured to detect the presence of a fault based on the result of the comparison of the diagnostic data from the at least two diagnostic units. For example, a fault is detected if the diagnostic data differ from one another by a defined amount and / or by a defined parameter. Such a comparison can be performed by the individual diagnostic units themselves. It is also possible for such a comparison to be performed by a higher-level unit that is operatively connected to the diagnostic units.

[0023] It is advantageous and preferred that the interruption device comprises at least two interruption units. In particular, the interruption units are designed redundantly. In particular, the interruption units can each be switched to the fault mode independently of one another (by means of the diagnostic device). In particular, the interruption units can each interrupt the power supply to the fault braking device and / or the actuator device independently of one another.

[0024] In particular, the diagnostic device can control the interruption units separately. It can be provided that the diagnostic device always switches both interruption units to fault mode in the event of a fault. It is also possible for the diagnostic device to specifically select at least one interruption unit and switch it to fault mode.

[0025] Preferably, at least one diagnostic unit is assigned to each of the interruption units. It is advantageous and preferred that the diagnostic units can each control their assigned interruption unit and switch it to fault mode on their own. In particular, the diagnostic units can each control their assigned interruption unit and switch it to fault mode independently of the consent of at least one other diagnostic unit. In particular, an individual diagnostic unit can switch the interruption unit to fault mode as soon as it assumes a fault. It can also be provided that the diagnostic units can only switch the interruption device to fault mode with the consent of the other diagnostic unit and / or a higher-level unit.

[0026] In an advantageous embodiment, it is provided that the diagnostic units are each suitable and designed to switch their associated interruption unit into fault mode depending on a comparison of their diagnostic data with the diagnostic data of at least one other diagnostic unit. Preferably, a diagnostic unit can switch its associated interruption unit into fault mode even if its own diagnostic data do not indicate a fault, but at least partially differ from the diagnostic data of the other diagnostic unit.

[0027] The interruption device comprises, in particular, at least one contactor. The contactor is preferably designed as a semiconductor contactor and / or electromechanical contactor and / or phase separator. The semiconductor contactor comprises, in particular, at least one metal oxide semiconductor field-effect transistor (MOSFET). Other suitable contactor designs are also possible. Preferably, the interruption units each comprise at least one contactor or are designed as such. In particular, the interruption device comprises at least one electronic and / or electrical and / or electromechanical switch for isolating the power supply.

[0028] In all embodiments, it is preferred that the steering input device comprises at least one sensor device. In particular, the sensor device is operatively connected to the control device. In particular, the sensor device comprises at least two, preferably three, sensor units. In particular, the sensor units are designed redundantly. In particular, the sensor units each serve to detect a parameter characteristic of the position of the steering unit (e.g. angle of rotation). Additionally or alternatively, at least one sensor unit can also be designed to detect a torque applied to the steering unit.

[0029] It is preferred and advantageous that at least the sensor units are supplied with power regardless of whether the interruption device is in fault mode or not. In particular, in the event of a fault, the power supply to at least the sensor units is maintained. In particular, in the event of a fault, the steering command can be transmitted to the steering device, thus enabling safe continued travel.

[0030] Preferably, at least the sensor units are supplied by at least one energy storage device. In particular, the energy storage device is designed to be redundant with an energy storage device of the control device and / or the actuator device. In particular, the sensor units each have at least one of their own energy storage device and / or at least one common energy storage device. It is also possible for the sensor units to share an energy storage device with the control device.

[0031] In an advantageous development, at least the sensor units are operatively connected to a steering device, bypassing the control device. This preferably ensures that their signal is available for the steering device even in the event of a failure of the control device. The sensor units are preferably also operatively connected to the steering device via the control device.

[0032] In particular, during normal operation, the sensor units send their signals to the control device, which then controls the steering device accordingly. In particular, the sensor device has at least two, preferably three, redundant operative connections to the steering device. In particular, one operative connection leads via the control device to the steering device, and at least one operative connection bypasses the control device to the steering device. Particularly preferably, at least two redundant operative connections to the steering device are provided for each of the sensor units.

[0033] It is possible and advantageous for the emergency braking device to brake independently of the direction of rotation of the steering unit. In particular, the emergency braking device brakes independently of direction. In particular, the emergency braking device does not require any means to adapt its braking effect depending on the direction of rotation. This saves on controls and components as well as installation space. In particular, the emergency braking device is suitable and designed to brake the rotational movement of the steering unit regardless of whether the steering unit is rotated clockwise or counterclockwise.

[0034] In particular, the emergency braking device is suitable and designed to provide its braking effect and to brake the mobility of the steering unit even in the event of a failure of the power supply for the emergency protection device. In particular, in the event of a failure of its power supply, the emergency braking device provides the braking effect regardless of whether other components, for example the control device and / or the diagnostic device and / or the interruption device, are supplied with power or not. In other words, the emergency braking device preferably always brakes when it is no longer supplied with power. In particular, the emergency braking device brakes in the event of a total failure of the power supply, even if the interruption device has not (yet) disconnected. In a preferred and advantageous development, the emergency braking device comprises at least one magnetorheological braking device.In particular, the magnetorheological braking device comprises at least one permanent magnet device. In particular, the permanent magnet device provides at least one defined magnetic field.

[0035] The magnetorheological braking device preferably comprises at least two brake components which can be rotated relative to one another. In particular, at least one of the brake components is rotatable by the steering unit. In particular, at least one other of the brake components is supported in a rotationally fixed manner. In particular, at least one gap which is at least partially filled with a magnetorheological medium is formed between the brake components. In particular, the medium can be influenced by means of a magnetic field of the permanent magnet device such that braking occurs with the emergency braking torque.

[0036] In particular, the magnetic field of the permanent magnet device can be reduced during normal operation by at least one electrical coil device, so that the braking effect is canceled. In particular, the electrical coil device is specifically controlled by the control device and / or the emergency shutdown device during normal operation in order to reduce the magnetic field of the permanent magnet device. In particular, the coil device generates a magnetic field during normal operation which is specifically opposite to the magnetic field of the permanent magnet device. As a result, a low basic torque of preferably less than 0.4 Nm, more preferably less than 0.3 Nm, can be provided during normal operation.

[0037] In particular, the coil device is supplied with power via a supply line, which is specifically interrupted by the interruption device in the event of a fault. In particular, the interruption device is suitable and designed to specifically interrupt the power supply to the coil device in the event of a fault. In particular, it is provided that, in the event of an interruption in the power supply, the coil device can no longer counteract the magnetic field of the permanent magnet device, thus providing the emergency braking torque.

[0038] The permanent magnet device can be provided by a remanence device or at least comprise such a device. In particular, the remanence device is suitable and designed to specifically magnetize at least one component of the braking device, so that this component then provides a magnetic field (in the manner of a switchable permanent magnet). In particular, the component can also be demagnetized again (in particular by an electrical coil device).

[0039] Additionally or alternatively, the emergency braking device may comprise or be designed as at least one mechanical friction brake with at least one energy accumulator. The emergency braking device may generally be designed as a mechanical, hydraulic, pneumatic, electrical, magnetic, and / or electromagnetic brake.

[0040] In particular, the emergency braking system must be actively maintained in the unbraked state using supplied energy. In particular, the braking system automatically transitions to the braked state without the use of supplied energy. This allows the emergency braking torque to be applied even in the event of a total power failure, for example.

[0041] The emergency braking device can comprise at least one energy storage device that provides the energy required to apply the emergency braking torque. The emergency braking device can comprise a mechanical, hydraulic, pneumatic, electrical, magnetic, and / or electromagnetic energy storage device. For example, a (mechanical) spring, a pressure accumulator, a rechargeable battery, a battery, and / or a capacitor, or the like, can be provided. The emergency braking torque can be adjusted by selecting the energy storage device.

[0042] The actuator device preferably comprises at least one (electric) motor device and / or at least one service brake device for generating a torque acting on the steering unit.

[0043] The motor device can preferably be used to return the steering unit to a neutral position. The resistance to deflection of the steering unit from the neutral position can preferably be adjusted, in particular continuously, by means of the motor device. The actuator device can comprise at least one (self-locking) transmission device coupled to the motor device.

[0044] The service brake device preferably serves to brake a movement of the steering unit with an (adjustable and / or fixed) braking torque. The service brake device preferably enables the generation of braking torques, in particular continuously adjustable ones, that counteract a deflection of the steering unit, in particular from the neutral position of the steering unit. In particular, the service brake device can be used to achieve end stops with a high braking torque, e.g., more than 15 Nm, preferably more than 20 Nm.

[0045] The actuator device preferably comprises both a motor device and a service brake device. This allows a relatively small motor device to be selected, which is used, for example, only to return the steering unit to the neutral position. For example, the motor device can have a nominal torque of less than 10 Nm, preferably less than 7 Nm, e.g., 5 Nm. The service brake device can be designed, for example, for a maximum service brake torque of 25 Nm.

[0046] In an advantageous embodiment, the service brake device can be designed as a clutch device or at least comprise one such. For example, such an embodiment is provided when the motor device is operatively connected to the steering device via a, in particular self-locking, gear device. In particular, the clutch device and the motor device are connected in series with one another and / or connected in series with the steering unit. In particular, at least one controllable magnetorheological clutch device is provided. In particular, a torque that can be transmitted between the motor device and the steering unit can be specifically varied by means of the clutch device. It is possible for the emergency brake device to be structurally integrated into the clutch device. In particular, the emergency brake device is provided at least partially by the clutch device.

[0047] The service brake device is preferably designed magnetorheologically or comprises at least one magnetorheological (service) brake device. Particularly preferably, the emergency brake device is structurally integrated into the service brake device of the actuator device. In particular, the emergency brake device is at least partially provided by the service brake device. In particular, the emergency brake device and the service brake device have at least two common brake components that can be rotated relative to one another and / or at least one common gap that is at least partially filled with a magnetorheological medium.

[0048] In particular, the service brake device has at least one coil device by means of which the magnetic field of the permanent magnet device of the emergency braking device is reduced or canceled during normal operation. In particular, an energy supply to the coil device of the service brake device can be interrupted in the event of a fault by means of the interruption device. It is possible for the emergency braking device to be provided by integrating a permanent magnet device into the service brake device. In particular, the service brake device is suitable and designed to generate a higher braking torque than the emergency braking device. It is possible and advantageous for the emergency braking device to be able to provide (only) a (fixed) lower braking torque than the service brake device.

[0049] The vehicle component can comprise at least one steering device for converting a steering command specified by the steering device into a chassis movement. In particular, the steering device (in particular its steering unit) and the steering device are only operatively connected in normal operation according to the steer-by-wire concept. In particular, the steering device has its own energy supply, which is at least partially independent of the energy supply of the steering device. In particular, the energy supply of the steering device is independent of the control device and / or the diagnostic device and / or the fault protection device and / or the actuator device. In particular, the steering device and the steering device each have at least one energy store of their own.

[0050] For example, two separate vehicle batteries and / or at least two other suitable separate energy storage devices are provided for this purpose.

[0051] The method according to the invention serves to operate the vehicle component according to the invention or one of its embodiments. In particular, the method is designed such that the steering input device described here can be operated accordingly.

[0052] The diagnostic data comprise, in particular, at least one characteristic variable which is also used by the control device to control the actuator device. The diagnostic data comprise, in particular, at least one characteristic variable which is provided by the sensor device. In particular, the diagnostic data comprise a plurality of such characteristics. Such characteristics are, for example, measured values, setpoints and / or signal values ​​transmitted by sensors and / or actuators.

[0053] The diagnostic device is particularly suitable and designed to detect a malfunction in which the actuator device can no longer provide the torque acting on the steering unit (so that the steering unit could thus be moved without resistance if no further measures are taken) and / or in which the actuator device generates an excessively high torque acting on the steering unit. In particular, the diagnostic device monitors at least one characteristic variable and / or other input data and determines diagnostic data therefrom and detects a malfunction depending on the diagnostic data.

[0054] In particular, at least one or more (vehicle) batteries and / or auxiliary batteries or the like are available as energy storage devices. A battery is also understood to mean an accumulator.

[0055] The sensor device (preferably its sensor units) and / or the control device and / or the diagnostic device and / or the steering device are, in particular, supplied with energy at least partially independently of the switching position of the interruption device. In particular, these components can each be equipped at least partially with at least one energy storage device and / or a separate supply line.

[0056] In the context of the present invention, a malfunction of the drive device is understood in particular to mean that the actuator device can no longer generate any torque or the actuator device assumes an undesirable state in which too high a torque is generated (in extreme cases up to a blockage of the actuator device) or an inadmissible state (e.g. overheating of the actuator device) occurs. In particular, the steering unit would be movable without resistance in the event of a malfunction if no malfunction protection were provided. The torque acting on the steering unit can be designed as a drive torque or as a braking torque. The braking torque can be generated by braking or by driving in the opposite direction.

[0057] The steering unit can comprise at least one joystick or be designed as such. The joystick has at least one or only one (rotational) degree of freedom. A joystick with only one (rotational) degree of freedom can also be referred to as an operating lever. The joystick can be equipped with (at least) two or more degrees of freedom. In particular, the joystick can be pivoted about at least one axis. The pivot angle is, for example, (at most) + / - 45° or less starting from a neutral position. However, larger pivot angles are also possible. In particular, the emergency protection device is suitable and designed to act on the degrees of freedom of the joystick separately and / or jointly (or simultaneously).

[0058] The vehicle component presented here can be used in motor vehicles (e.g., cars, trucks, on-highway vehicles), aircraft, airplanes (including drones), ships, boats, and in agricultural and forestry technology, for example, in tractors or combine harvesters, harvesting machines, and other field machinery (off-highway vehicles). It can also be used in construction or mobile work machines, for example, forklifts or similar machines, or in simulators for simulating vehicle control (gaming, sim racing, computer peripherals, etc.). The vehicle component is particularly suitable for at least partially or fully autonomous vehicles. For example, the vehicle component can be used in a so-called people mover. Such vehicles are usually automatic or autonomous (public) means of transport and are also called "shuttle vehicles" or "shuttle buses."For manual (steering) operation, a steering unit (e.g. a joystick or a steering wheel) can be provided, which is operated by a driver or passenger.

[0059] Further advantages and features of the present invention will become apparent from the embodiments which are explained below with reference to the accompanying figures.

[0060] Showing:

[0061] Figure 1 is a purely schematic representation of a

[0062] Wiring diagram of a vehicle component according to the invention;

[0063] Figure 2 is a purely schematic detailed representation of the

[0064] Vehicle component with an alternative steering input device;

[0065] Figure 3 is a purely schematic detailed representation of the

[0066] Vehicle component with a different steering control device; and

[0067] Figure 4 is a purely schematic detailed representation of the

[0068] Vehicle component with a different steering input device.

[0069] Figure 1 shows a vehicle component 500 according to the invention with a steering input device 510 for controlling a vehicle according to the steer-by-wire concept. For this purpose, a steering wheel

[0070] 511 formed steering unit 501 is electrically or electronically connected to a steering device 520. The steering device

[0071] 512 can, for example, adjust the vehicle's wheels. Vehicle component 500 is operated here according to the method according to the invention.

[0072] The movement or position of the steering unit 501 is detected here by a sensor device 508 with, for example, two sensor units 518, 528. The sensor units 518, 528 are designed as rotation angle sensors. The sensor units 518, 528 are designed (doubly) redundantly and each have their own energy storage unit 538. The energy storage units 538 can be provided, for example, by separate or local batteries or by a (second) vehicle battery.

[0073] A control unit 503 (ECU) controls the steering unit 520 depending on the received sensor signals. The components shown here communicate with each other, for example, via a CAN bus system of the vehicle and / or via separate lines.

[0074] The steering input device 510 comprises an actuator device 502 with an electric motor device 512, which is connected to the steering unit 501 via a steering shaft 522. This generates a torque acting on the steering unit 501, so that the steering unit 501 can be actively rotated to the right or left, for example.

[0075] The actuator device 502 here comprises a magnetorheologically designed service brake device 542 to brake the mobility of the steering unit 501 in addition to the motor device 512. Such a service brake device 542 enables, for example, the use of a particularly compact or smaller motor device 512.

[0076] The actuator device 502 can be used to simulate forces such as those that would be felt on the steering unit 501 with a mechanical steering system. For this purpose, a torque acting on the steering unit 501 (so-called passive torque) is generated, which counteracts the manual movement. This torque can be generated here with the motor device 512 or the service brake device 542.

[0077] The actuator device 502 is controlled and supplied with energy via a power electronics device 507. The power electronics device 507 is, in turn, controlled by the control device 503. The energy is provided by an energy storage device 552 and, for example, one or more vehicle batteries. For example, the power electronics device 507 is powered directly by a vehicle battery.

[0078] The power electronics device 507 and the motor device 512 are connected here via two supply lines 532. For example, each supply line 532 supplies its own winding or motor, so that the motor device 512 is also designed redundantly.

[0079] To monitor the proper operation of the vehicle component 500, a diagnostic device 504 with two redundant diagnostic units 514, 524 is provided. In the embodiment shown here, the control device 503 and the diagnostic device 504 are integrated into a common control unit.

[0080] The diagnostic device 504 receives, for example, input data from the control device 503 and the sensor device 508. From this and possibly further input data, the diagnostic device 504 determines diagnostic data that describe the operating state. Thus, the diagnostic device 504 can determine whether a malfunction has occurred in which the actuator device 502 can no longer provide the torque acting on the steering unit 501 at the desired value (torque too high or too low).

[0081] In an embodiment not shown here, at least three sensor units 518, 528 can also be provided. This enables a 2-out-of-3 logic. If two sensor units 518, 528 detect the same measured value, the error can be assigned to the third sensor unit 518, 528, and further travel is possible.

[0082] To prevent the steering unit 501 from rotating without resistance in the event of a malfunction, a malfunction protection device 505 is provided that can be controlled by the diagnostic device 504. The malfunction protection device 505 comprises a malfunction braking device 515 with a magnetorheologically designed braking device 525. In a variant not shown in detail here, the malfunction braking device 515 can also comprise a mechanical friction brake 545.

[0083] If the emergency braking device 515 is sufficiently supplied with energy, its braking effect is canceled; it cannot slow the movement of the steering unit 501. If the energy supply fails, the emergency braking device 515 provides its braking effect and brakes the steering unit 501 with a targeted emergency braking torque. The emergency braking device 515 does not require a signal from the sensor device 508 or the control device 503, which makes the emergency protection device 505 particularly reliable and safe.

[0084] In order to be able to specifically interrupt the power supply to the emergency braking device 515 in the event of a malfunction, an interruption device 506 is provided that can be controlled by the diagnostic device 504. If the diagnostic device 504 detects a malfunction, it switches the interruption device 506 to a malfunction mode, thereby interrupting the power supply to the emergency braking device 515 and also to the entire actuator device 502.

[0085] The interruption device 506 interrupts a supply line 517, which leads from the energy storage device 552 to the power electronics device 507. A separate supply line 513, which comes from the energy storage device 552 and supplies the control device 503 and the diagnostic device 504, is not interrupted. The supply line 513 can also be designed redundantly.

[0086] Due to the interruption of the power supply to the power electronics device 507, the actuator device 502 is no longer active. Furthermore, the power supply to an electrical coil device 565 of the magnetorheological braking device 525 is interrupted. The service braking device 542 and the emergency braking device 515 (or its coil device 565) are connected to the power electronics device 507 via a supply line 555.

[0087] During normal operation, the coil device 560 serves to counteract a magnetic field of a permanent magnet device 535. When the coil device 565 is active during normal operation, the braking device 525 has no braking effect and does not influence the mobility of the steering unit 501.

[0088] Without the magnetic field of the coil device 565, the magnetic field of the permanent magnet device 535 causes the mobility of the steering unit 501 to be braked with the emergency braking torque. The permanent magnet device 535 has the advantage that the braking device 525 can reliably provide the desired emergency braking torque without any external power supply, even over a longer period of time.

[0089] In order to be able to control the steering device 520 with the desired steering command even in the event of a malfunction, the sensor units 518, 528 are each connected directly to the steering device 520 with their own active connection 548. This means that even if the control device 503 fails, the sensor signals can be passed on directly and the vehicle can continue to be steered safely. During normal operation, the sensor units 518, 528 send their signals to the control device 503, which processes the signals and then forwards them to the steering device 520 via its own active connection 530. To improve safety, two redundant active connections 530 are provided here.

[0090] The interruption device 506 here comprises two redundant interruption units 516, 526. Both interruption units 516, 526 are each capable of disconnecting the supply line 517 and thereby triggering braking with the emergency braking device 515.

[0091] The interruption units 516, 526 are each assigned to a diagnostic unit 514, 524. The diagnostic units 514, 524 are redundant and monitor each other. To do this, they evaluate, for example, the signals from the sensor units 514, 524. If the diagnostic units 514, 524 detect deviations in their own diagnostic data or the diagnostic data of the other diagnostic unit 514, 524, they switch their interruption unit 516, 526 to fault mode. The interruption units 516, 526 are each designed as a contactor, for example, as a MOSFET semiconductor contactor.

[0092] A particular advantage of the invention is that a duplicate version of the control device 503 or other central control components of the steering input device 510 can be dispensed with. Furthermore, the invention offers a particularly uncomplicated and at the same time reliable error evaluation and remedy in the event of a malfunction.

[0093] Figure 2 shows a steering input device 510, which can be used as an alternative to the previously described steering input device 510 in the vehicle component 500. In the steering input device 510 shown here, the emergency braking device 515 is structurally integrated into the service braking device 542 and is partially provided by it.

[0094] The service brake device 542 is designed magnetorheologically here and comprises two brake components 575, 585 that are rotatable relative to one another, between which a gap 595 is formed. The gap 595 is filled with a magnetorheological medium (not shown here). The service brake device 542 has an electrical coil device 565 for generating a magnetic field.

[0095] The magnetic field influences the medium in gap 595 in such a way that the relative rotation of the brake components 575, 585 is subjected to a defined braking torque. The service brake device 542, for example, is designed for a maximum braking torque of 25 Nm.

[0096] By combining it with the service brake device 542, the motor device 512 can be considerably lighter and more compact and, for example, only needs to implement the active return of the steering unit 501 to the neutral position. The service brake device 542 is used when higher braking torques are required, for example, to fix the steering unit 501 as an exit aid. Furthermore, the magnetorheologically designed service brake device 542 has the advantage that particularly precise and quickly implemented steering feedback can be set.

[0097] The emergency braking device 515 is designed here as a magnetorheological braking device 525. Apart from its permanent magnet device 535, the braking device 525 shares its essential functional components with the service braking device 542 (for example, the braking components 575, 585 and the gap 595, as well as the coil device 565). This allows for savings in weight, installation space, and components.

[0098] During normal operation, the coil device 565 specifically counteracts the magnetic field of the permanent magnet device 535. For example, the magnetic field is eliminated or specifically reduced to such an extent that the permanent magnet device 535 can support the magnetic field of the coil device 565 if necessary. If the service braking torque needs to be changed, the coil device 565 is controlled accordingly.

[0099] In the event of a malfunction, the processes described with reference to Figure 1 then occur, which, among other things, interrupt the power supply to the actuator device 502 and thus to the service brake device 542 and the motor device 512. As a result, the coil device 565 also receives no electrical power, so that its magnetic field can no longer influence the magnetic field of the permanent magnet device 535.

[0100] As a result, the magnetic field of the permanent magnet device 535 automatically influences the medium in the gap 595 such that the relative rotation of the brake components 575, 585 is braked with the desired emergency braking torque. This prevents the steering unit 501 from being moved without resistance. For example, the emergency braking torque here is 2 Nm. At the same time, the interruption of the power supply also ensures that the motor device 512 generates an undesirably high torque in the event of an emergency.

[0101] The steering input device 510 shown in Figure 3 can be used as an alternative to the previously described steering input devices 510 in the vehicle component 500. Here, the actuator device 502 is equipped with a magnetorheologically designed clutch device 562. The clutch device 562 and the motor device 512 are connected in series. Two sensor units 518, 528 of the sensor device 508 are also shown here purely schematically.

[0102] By means of the coupling device 562, the torque transmittable between the motor device 512 and the steering unit 501 can be specifically varied. The torque transmittable by the coupling device 562 is adjusted here by controlling an electrical coil device 562a. The magnetic field of the coil device 562a acts on a magnetorheological medium (not shown in detail here), thereby specifically slowing down the relative rotation of the coupling components. The more the mobility of the coupling components is slowed down, the higher the transmittable torque.

[0103] The actuator device 502 is equipped here with a self-locking gear device 572, for example, a worm gear. This self-locking mechanism allows the rotation of the steering unit 501 to be blocked independently of the motor device 512. The braking torque applied to the steering unit 501 or the torque required to move the steering unit 501 depend on the torque that can be transmitted by the coupling device 562.

[0104] The emergency braking device 515 is designed here as a magnetorheological braking device 525, which is partially provided by the clutch device 562. For this purpose, the permanent magnet device 535 is housed within the clutch device 562. During normal operation, the magnetic field of the coil device 562a counteracts the magnetic field of the permanent magnet device 535. As a result, the magnetic field of the permanent magnet device 535 can be eliminated or specifically reduced.

[0105] In the event of a malfunction, the sequences described with reference to Figure 1 then occur. This also interrupts the power supply to the clutch device 562 and the electrical coil device 562a (and thus to the malfunction braking device 515). This makes the magnetic field of the permanent magnet device 535 available to generate the malfunction braking torque. A torque equal to the malfunction braking torque can now be transmitted with the clutch device 562.

[0106] By supporting the self-locking gear mechanism 572, the emergency braking torque is available even if the motor mechanism 512 has failed or is no longer supplied with power. In other words, the clutch mechanism 562 can be supported by the self-locking gear mechanism 572, so that it can brake the mobility of the steering unit 501 with the emergency braking torque.

[0107] The steering input device 510 shown in Figure 4 can be used as an alternative to the previously described steering input devices 510 in the vehicle component 500. The steering input device 510 is equipped here with a steering unit 501 designed as a joystick 521. Otherwise, the variant shown here is essentially based on the steering input device 510 presented with reference to Figure 2.

[0108] The joystick 521 has only one (rotational) degree of freedom and can also be referred to as an operating lever. This allows for a simple yet reliable vehicle steering system. The swivel angle of the joystick 521 is, for example, (at most) + / - 45° starting from a neutral position. Alternatively, the joystick 521 can also be equipped with two or more degrees of freedom.

[0109] In the event of a malfunction, the variant shown here reacts essentially as described previously. In the event of a malfunction, the malfunction protection device 505 can act separately on both (all) degrees of freedom of the joystick 521. It can also be provided that the malfunction protection device 505 acts on both (all) degrees of freedom jointly or simultaneously. In this case, a malfunction also affects the behavior of the other degree of freedom, for example, since the power supply for both degrees of freedom is then interrupted.

[0110] List of reference symbols:

[0111] 500 Vehicle component 524 Diagnostic unit

[0112] 501 Steering unit 525 Braking device

[0113] 502 Actuator device 526 Interruption unit

[0114] 503 Control device 528 Sensor unit

[0115] 504 Diagnostic device 530 Active connection

[0116] 505 Emergency fuse 532 Supply line

[0117] 506 Interruption device 535 Permanent magnet

[0118] 507 Power electronics device 538 Energy storage

[0119] 508 Sensor device 542 Service brake device

[0120] 510 Steering preset device 545 Friction brake

[0121] 511 Steering wheel 548 Active connection

[0122] 512 Motor device 552 Energy storage

[0123] 513 supply line 555 supply line

[0124] 514 Diagnostic unit 562 Clutch device

[0125] 515 Accident braking device 562a Coil device

[0126] 516 Interruption unit 565 Coil device

[0127] 517 Supply line 572 Gearbox device

[0128] 518 Sensor unit 575 Brake component

[0129] 520 Steering device 585 Brake component

[0130] 521 Joystick 595 Gap

[0131] 522 steering shaft

[0132] 523 control unit

Claims

Claims:

1. Vehicle component (500) with a steering input device (510) for specifying a steering command according to the steer-by-wire concept, comprising at least one movable steering unit (501), in particular steering wheel (511), and at least one actuator device (502) for generating a torque acting on the steering unit (501) and at least one control device (503) for controlling the actuator device (502) in order to adjust the torque acting on the steering unit (501), and at least one diagnostic device (504) for detecting a malfunction of the steering presetting device (510), in which the actuator device (502) provides an inadmissible torque acting on the steering unit (501), and at least one malfunction protection device (505) which can be controlled by the diagnostic device (504) and which acts on the steering unit (501) in the event of a malfunction detected by the diagnostic device (504), so that the steering unit (501) cannot be moved without resistance, characterized in that the malfunction protection device (505) comprises at least one malfunction braking device (515) which is suitable and designed toto cancel its braking effect when a defined energy supply is present and to provide its braking effect when the defined energy supply is lost and to brake the mobility of the steering unit (501) with a targeted emergency braking torque, and that the emergency protection device (505) comprises at least one interruption device (506) that can be controlled by the diagnostic device (504), and that the diagnostic device (504) is suitable and designed to switch the interruption device (506) into an emergency mode, so that the energy supply to at least the emergency braking device (515) is interrupted and the emergency braking device (515) provides its emergency braking torque. Vehicle component (500) according to the preceding claim, wherein the interruption device (506) is suitable and designed to also interrupt the power supply to the actuator device (502) in the event of a malfunction. Vehicle component (500) according to one of the preceding claims, comprising at least one power electronics device (507) controllable by the control device (503), via which the malfunction braking device (515) and / or the actuator device (502) is supplied with electrical energy, and wherein the interruption device (506) interrupts the power supply to the power electronics device (507) and / or the components connected thereto in the event of a malfunction.Vehicle component (500) according to the preceding claim, wherein the control device (503) and the power electronics device (507) are each supplied with energy via at least one of their own supply lines (513, 517), and wherein the interruption device (506) interrupts the supply line (517) of the power electronics device (507) in the event of a fault, while the supply line (513) of the control device (503) is maintained. Vehicle component (500) according to one of the preceding claims, wherein the diagnostic device (504) and the interruption device (506) are supplied with energy together with the control device (503). Vehicle component (500) according to one of the preceding claims, wherein the diagnostic device (504) comprises at least two diagnostic units (514, 524), each of which is suitable and designed to at least partially process the same input data and to provide diagnostic data therefrom.Vehicle component (500) according to the preceding claim. wherein the diagnostic device (504) is suitable and designed to use the diagnostic data of the at least two diagnostic units (514, 524) to detect a malfunction, and wherein the diagnostic units (514, 524) mutually monitor their diagnostic data for this purpose, and / or wherein the diagnostic device (504) comprises at least one higher-level unit that evaluates the diagnostic data of the diagnostic units (514, 524). The vehicle component (500) according to one of the preceding claims, wherein the interruption device (506) comprises at least two interruption units (516, 526), ​​each of which can be switched to the malfunction mode independently of one another.Vehicle component (500) according to claims 6 and 8, wherein the interruption units (516, 526) are each assigned to at least one diagnostic unit (514, 524), and wherein the diagnostic units (514, 524) can each independently control their assigned interruption unit (516, 526) and switch it to fault mode. Vehicle component (500) according to claims 6 and 8, wherein the interruption units (516, 526) are each assigned to at least one diagnostic unit (514, 524), and wherein the diagnostic units (514, 524) are each suitable and designed to switch their assigned interruption unit (516, 526) to fault mode depending on a comparison of their diagnostic data with the diagnostic data of the at least one other diagnostic unit (514, 524).Vehicle component (500) according to one of the preceding claims, wherein the interruption device (506) comprises at least one contactor (536) and wherein the contactor (536) is preferably designed as a semiconductor contactor and / or electromechanical contactor. Vehicle component (500) according to one of the preceding claims, comprising at least one sensor device (508) operatively connected to the control device (503) with at least two redundant sensor units (518, 528) for detecting a parameter characteristic of the position (the angle of rotation) of the steering unit (501), and wherein at least the sensor units (518, 528) are supplied with energy independently of whether the interruption device (506) is in emergency mode or not. Vehicle component (500) according to the preceding claim, wherein at least the sensor units (518, 528) are supplied by means of at least one energy store (538) which is designed redundantly to an energy store (552) of the control device (503) and / or the actuator device (502). Vehicle component (500) according to one of the two preceding claims, wherein at least the sensor units (518, 528) are operatively connected to a steering device (520), bypassing the control device (503), so that their signal is available for the steering device (520) even in the event of a failure of the control device (503). Vehicle component (500) according to one of the preceding claims, wherein the emergency braking device (515) brakes independently of a direction of rotation of the steering unit (501).Vehicle component (500) according to one of the preceding claims, wherein the emergency braking device (515) is suitable and designed to provide its braking effect and to brake the mobility of the steering unit (501) even in the event of a power failure for the emergency protection device (505). Vehicle component (500) according to one of the preceding claims, wherein the emergency braking device (515). at least one magnetorheological braking device (525) with at least one permanent magnet device (535) and / or wherein the emergency braking device (515) comprises at least one mechanical friction brake (545) with at least one energy accumulator.Vehicle component (500) according to the preceding claim, wherein the braking device (525) comprises at least two brake components rotatable relative to one another, wherein at least one of the braking components is rotatable by the steering unit and wherein at least one other of the braking components is supported in a rotationally fixed manner, and wherein at least one gap at least partially filled with a magnetorheological medium is formed between the braking components, and wherein the medium can be influenced by a magnetic field of the permanent magnet device (535) such that braking is effected with the emergency braking torque, and wherein the magnetic field of the permanent magnet device (535) can be reduced during normal operation by an electrical coil device (565) so that the braking effect is canceled. Vehicle component (500) according to one of the preceding claims, comprising at least one steering device. (520) for converting a steering command specified by the steering input device (510) into a chassis movement, wherein the steering input device (510) and the steering device (520) are operatively connected only according to the steer-by-wire concept during normal operation, and the steering device (520) has its own power supply, which is at least partially independent of the power supply of the steering input device (510). Method for operating a vehicle component (500) according to one of the preceding claims.

Images