Electronic circuit

Abstract

The electronic circuit (22) includes an electronic control unit (16), a safety control device (24), and an electronic lock unit (26) having a delay unit (27) and a memory unit (28). The electronic control unit is configured to control the actuator using a normal actuation control signal (32). The safety control device generates a trigger signal (40) for the electronic lock unit. The delay unit receives the normal actuation control signal and transmits it to the memory unit with a time delay. The memory unit receives the trigger signal and stores the normal actuation control signal transmitted from the delay unit immediately upon receiving the trigger signal. The electronic lock unit controls the actuator based on the normal actuation control signal stored as an output signal from the memory unit immediately upon receiving the trigger signal and storing the normal actuation control signal transmitted with the time delay.

Description

[Technical Field]

[0001] The invention relates in particular to an electronic circuit for controlling a braking system of a motor vehicle.Further claims relate to a braking system comprising an electronic circuit. [Background technology]

[0002] DE 10 2018 104 143 A1 teaches a pressure-medium-operated brake system for a train of vehicles including a towing vehicle with a towing vehicle brake and a trailer vehicle with a trailer brake. The brake system further includes a parking brake module connected to an electronic control unit. The parking brake module includes a control valve, a redundant valve, and a shuttle valve. The valves are controllable via an electronic switching mechanism with a self-holding function so that, in the event of a malfunction or failure of the electronic control unit, the last error-free switching position of the control valve or redundant valve is maintained unless the electronic control unit is changed to an operationally safe idle state or the ignition system is switched off. Summary of the Invention [Problem to be solved by the invention]

[0003] The object of the present invention is to ensure a particularly reliable and simple fail-safe function for the actuator. This object is achieved by the subject matter of the independent patent claims. Advantageous embodiments are the subject matter of the dependent claims, the following description and the figures. [Means for solving the problem]

[0004] According to the present invention, an electronic circuit is proposed that ensures a safe state for functions that do not themselves indicate a safe state in the event of an electronic failure. To this end, an electronic signal memory is provided as part of a system that enables functions that do not themselves indicate a safe state in the event of a control unit failure, electrical error, or other error. Certain functions do not indicate a safe state in the event of electrical error and power failure. To solve this problem, the electronic circuit according to the present invention can retain the last valid state of a function to ensure a safe state when the main control device of the electronic brake system fails. The electronic signal memory, which can also be referred to as a lock unit, is a separate unit. This unit can ensure a safe state in the event of a failure of other control units by responding to input signals from other parts of the system and using delay and memory units to store the last valid states of the described functions. The electronic signal memory recognizes such a failure (or is notified about it by another device, such as a watchdog) and converts the dangerous function to a safe state within a certain time. The fail-safe state depends on the last valid state (energized / de-energized), not necessarily the de-energized state. Therefore, the present invention provides additional circuitry to maintain the last valid state in the event of a malfunction.

[0005] According to the present invention, an electronic hardware lock is proposed, which operates in a circuit or system including an electronic control unit that provides control signals to the actuator and the hardware lock, among other things. An interface can be provided for triggering locking in case of a malfunction. Furthermore, an interface can be provided for externally resetting the lock. In case of an error in the electronic control unit, the actuator is controlled by the electronic hardware lock. In particular, in case of a failure of the electronic control unit, the electronic hardware lock retains the last valid state of the function (controlled by the actuator) to ensure a safe state. This is logic separated from the main control device, which receives control signals from the electronic control unit for the actuator.

[0006] The control signal from the electronic control unit to the actuator is first delayed by a predetermined time by the delay unit. In the event of an error, the delayed signal is stored in a memory unit and used there to retain the last valid state of the actuator until the memory unit is reset by the main controller or via an external reset interface. A hardware lock requires only one delay unit and one memory block to retain the last valid state and ensure a safe state. In this sense, according to a first aspect of the present invention, an electronic circuit is provided. The electronic circuit includes an electronic control unit, a safety control device, and an electronic lock unit having a delay unit and a memory unit. The memory unit can be, in particular, an electronic 1-bit memory unit. The lock unit can, in particular, be implemented by hardware ("hardware latch" or "HW latch").

[0007] The electronic control unit is configured to control at least one actuator in a predetermined manner using the normal operation control signal during normal operation. The feature "controlled in a predetermined manner" can be understood, for example, as follows: the actuator is energized by the electronic control unit according to a first selection, resulting in the actuator being moved to a predetermined state; or the actuator is de-energized by the electronic control unit according to a second selection, resulting in the actuator being moved to a predetermined state. For example, the actuator can be a hydraulic or pneumatic valve, and in particular can be configured as an electromagnetically actuable directional control valve. Such a directional control valve, for example, is moved to an open state when the directional control valve is energized and is biased (e.g., by a spring) to a closed state when the directional control valve is de-energized. Alternatively, the directional control valve can be moved to a closed state when the directional control valve is energized and is biased to an open state when the directional control valve is de-energized, depending on the relevant application of the electromagnetically actuable directional control valve. The directional control valve may in particular be a redundant valve for a parking brake module of the motor vehicle. Alternatively or additionally, the redundant valve for the parking brake module may control the parking brake function of a trailer (optionally) attached to the motor vehicle.

[0008] The safety control device is configured to generate a trigger signal for the electronic locking unit, without the electronic control unit influencing the generation of the trigger signal. The safety control device therefore operates independently of the electronic control unit and, in particular, its functionality can be monitored, for example, by means of a so-called watchdog. If functionality is impaired, for example in the case of an error, the safety control device can generate a trigger signal.

[0009] The delay unit is configured to receive the normal operation control signal and transmit it to the memory unit with a time delay. Thus, the memory unit receives the normal operation control signal each time that is the time delay in the past. The memory unit is configured to receive a trigger signal generated by the safety control device. Furthermore, the memory unit is configured to store the normal operation control signal transmitted from the delay unit with the time delay as soon as the memory unit receives the trigger signal. The electronic lock unit is configured to control the actuator based on the normal operation control signal stored as an output signal of the memory unit as soon as the memory unit receives the trigger signal and stores the normal operation control signal transmitted with the time delay.

[0010] Instead of monitoring the low-side (ground) control signal for at least one actuator, particularly for multiple valves, the positive-side (supply) pin of the actuator can be monitored. The low-side connection (ground) to the actuator is often used to enable PWM control (pulse-width modulation). PWM control reduces the dissipated heat energy and thus prevents the actuator from overheating. However, since a PWM signal consists of alternating high and low phases in its active state, it does not provide a reliable static control signal (and is therefore not a valid input for a hardware lock). To solve this problem, it has been proposed to connect an electronic hardware lock to the non-PWM-controlled high-side (supply) of the actuator, making the low-side of the actuator available for PWM control. In this sense, according to a further embodiment, the electronic control unit is configured to control the high-side switch of the actuator in a defined manner using the normal operating control signal (especially in normal operation when no error case exists). In the event of an error, the high-side switch of the actuator can be activated, for example, by a safety control device. The memory unit of the lock unit can be configured to control the low-side switch of the switch (in the event of an error) using the stored normal operating control signal. The electronic control unit can then be set to control the low-side switch of the actuator by pulse width modulation (especially in normal operation when no error cases are present).

[0011] The high-side switch can be understood to be, in particular, a transistor that, depending on its switching position, connects or disconnects a supply rail with a high voltage (typically 24 volts in industrial applications) to a load. If the actuator is an electromagnetically actuable directional control valve, the high-side switch can be configured to, in particular, connect the magnetic circuit of the directional control valve with the positive pole of an electrical energy storage device when the high-side switch is in the closed switching position and to disconnect the magnetic circuit of the directional control valve from the positive pole of the electrical energy storage device when the high-side switch is in the open switching position. Alternatively or additionally, the high-side switch can be configured to, in particular, connect the magnetic circuit of the directional control valve with an output terminal of an ignition switch located behind the positive pole of the electrical energy storage device when the high-side switch is in the closed switching position and to disconnect the magnetic circuit of the directional control valve from the connection terminal of the ignition switch when the high-side switch is in the open switching position.

[0012] A low-side switch may be understood in particular as a switch that switches an electrical load on or off by switching the ground side (low side) of the load supply depending on its switching position. When the actuator is an electromagnetically actuable directional control valve, the low-side switch may be set in particular to connect ("earth") the magnetic circuit of the directional control valve to ground when the low-side switch is in a closed switching position, and to isolate the magnetic circuit of the directional control valve from ground when the low-side switch is in an open switching position.

[0013] Regarding the generation of the trigger signal, the safety control device can be configured to generate a status signal that takes either a normal operating value ("1") or an error value ("0"). The normal operating value ("1") indicates that the actuator is controlled in a defined manner. In contrast, the error value ("0") indicates that the actuator is not controlled in a defined manner. When the value of the status signal changes from the normal operating value ("1") to the error value ("0"), this is shown graphically in the time course, leading to a falling edge (from "1" to "0"). In this case, by inverting the error signal ("0"), a rising edge (from "0" to "1") in the time course can be generated, thereby locking the memory unit to maintain a safe state of the actuator. This inverted error signal ("1") thus functions as a trigger signal. In this case, the memory unit stores the logic state ("1") of the normal operating control signal that existed in the past, for example, at least 25 milliseconds ago, due to the time-delayed transmission by the delay unit. In this sense, according to one embodiment, the safety control device includes an inverter. The inverter is configured to convert the error value into a normal operating value and transmit this normal operating value as a trigger signal to the memory unit. Typically, upon triggering, the memory unit stores the output value of the delay unit present at that time, which corresponds to the last valid state (the so-called "last known valid state") of the normal operating control signal before the error value ("0") occurred. The delay time is appropriately selected to ensure that the signal of the delay unit reflects the state before the error occurred.

[0014] The lock unit can be deactivated, in particular externally. The memory unit can be reset when the memory unit receives a reset signal. Resetting the memory unit in particular involves the output signal of the memory unit assuming a transfer value. In this case, the lock unit returns control of the actuator to the electronic control unit again. In this sense, according to a further embodiment, the memory unit is configured to receive a reset signal. The lock unit is configured to control the actuator using the stored normal operating control signal as long as the memory unit receives the reset signal. The lock unit then ceases to control the actuator. The electronic control unit is then configured to take over control of the actuator again as soon as the memory unit receives the reset signal.

[0015] The electronic lock can be reset via an external interface (reset unit) or by, for example, switching off the power supply. Other methods of external deactivation are also conceivable, for example by an external hardwired switch. According to a further embodiment, the reset signal can be generated by a reset unit separate from the lock unit. An external "reset unit" can therefore act in addition to or alternatively to the remaining reset methods. Furthermore, the reset unit can intervene at any point in the lock unit, for example by using a separate input in the memory unit or by using a separate logic block. By triggering a reset by switching off the power supply, the lock unit consequently assumes a defined state (in this case, the value "0"). This also sets the redundant logic to a defined state. This represents an added value or functional expansion compared to a "reset unit".

[0016] The safety control device with its own inverter can be regarded, for example, as a reset unit. In particular, the memory unit, which is configured as a 1-bit memory, can be reset when the status signal generated by the safety control device assumes a normal operating value ("1") at any time, i.e., when the electronic control unit is again in a state where it controls the actuator in a defined manner. The normal operating value is inverted by the inverter to become an error value. In this sense, according to a further embodiment, the inverter is configured to convert the normal operating value ("1") into an error value ("0") and send this error value ("0") to the memory unit as a reset signal.

[0017] When the status signal generated by the safety control device assumes an error value (“0”), this error value (“0”) can indicate the following: the actuator is not (yet) controlled by the electronic control unit in the manner normally defined by the operating control signal because the electronic control unit is booting or in the start phase. In this case, the electronic control unit can read the state of the locking unit by measuring the analog feedback of the high-side switch and the low-side switch of the actuator. In principle, it is also possible to consider measuring various signals to determine the state of the locking unit. By way of example, the first or second fail-safe control signal, the selective fail-safe control signal, or the output signal to the low-side switch are mentioned here, but these are not exhaustive. This allows the electronic control unit to recognize the state of the locking unit and maintain that state after the start process is completed. In this sense, according to a further embodiment, the error value (“0”) indicates that the actuator is not (yet) controlled by the electronic control unit in the manner normally defined by the operating control signal because the electronic control unit is in the start phase. In this case, the electronic control unit is configured to measure the analog feedback of the actuator's high-side and low-side switches and derive the locking unit's operating state accordingly. This occurs while the electronic control unit is in the start phase and when the safety control device generates a status signal that assumes an error value ("0"). The electronic control unit is further configured to control the actuator based on the measured analog feedback, so that the locking unit maintains its operating state after the electronic control unit completes the start phase. In principle, the locking unit's operating state can be changed after the start phase has ended by a reset signal. From a functional standpoint, it must be guaranteed that the actuator's operating state is taken over or maintained.

[0018] The safety control device may in particular comprise a watchdog connected on the input side to the electronic control unit and on the output side to the inverter, so that the watchdog, on the one hand, monitors the correct functioning of the electronic control unit and, on the other hand, can generate a corresponding status signal which is inverted by the inverter as described above.

[0019] According to a further embodiment, the delay unit is configured to transmit a normal activation control signal to the memory unit with a time delay of at least 25 milliseconds. The time delay of at least 25 milliseconds specifically refers to a time span that begins when the delay unit receives the normal activation signal and ends when the delay unit transmits the normal activation signal to the memory unit. A signal at the input of the delay unit is delayed by at least 25 milliseconds and output via the output of the delay unit. The logic value or other characteristics of the input signal are not changed. The delay may vary with temperature. An implementation of the delay unit may include, among other things, an RC low-pass filter and two sequential Schmitt trigger inverters.

[0020] According to a second aspect of the present invention, there is provided a braking system for a motor vehicle, the braking system including an electronically controllable parking brake module having a first directional control valve designed as a control valve, a second directional control valve designed as a redundant valve, and a pressure-controlled shuttle valve, the braking system further including an electronic circuit according to the first aspect of the present invention.

[0021] The braking system is characterized in particular by: an electronic control unit of the electronic circuit configured to control the redundant valve as an actuator in a predetermined manner using a normal operating control signal; The safety control device is configured to generate a trigger signal for the electronic locking unit without the electronic control unit having any influence on the generation of the trigger signal. The delay unit of the locking unit of the electronic circuit is receiving a normal operating control signal; It is normally configured to send an operational control signal with a time delay to a memory unit in the lock unit's electronic circuitry. The memory unit is receiving a trigger signal generated by a safety control device; Upon receiving the trigger signal, the memory unit is configured to store the normal operating control signal sent from the delay unit with a time delay. The electronic lock unit of the electronic circuit is configured to control the redundant valve using the normal operation control signal stored as an output signal of the memory unit as soon as the memory unit receives the trigger signal and stores the normal operation control signal.

[0022] To increase redundancy, the electronic circuit may further include a further delay unit and a further memory unit, where: The electronic control unit is configured to control the control valve as a further actuator in a defined manner using a further normal operating control signal. Further delay units include: receiving a further normal operating control signal; A further normal operating control signal is arranged to be sent with a time delay to a further memory unit. The further memory unit may be receiving a trigger signal generated by a safety control device; The further memory unit is configured to store, with a time delay, the further normal operating control signal sent from the further delay unit upon receiving the trigger signal. The electronic locking unit is configured to control the control valve using the further normal operating control signal stored as an output signal of the further memory unit as soon as the further memory unit receives the trigger signal and stores the further normal operating control signal.

[0023] All of the embodiments described above in relation to the electronic circuit, their technical effects and associated advantages may also be applied to the braking system according to the second aspect of the invention, as will become particularly apparent from the following description of the drawings.

[0024] In the following, embodiments of the invention will be explained in more detail with reference to schematic drawings, in which identical or similar elements are provided with the same reference numbers. [Brief explanation of the drawings]

[0025] [Figure 1] 1 is a plan view of a portion of a braking system for an automobile and trailer vehicle; [Figure 2] 2 is a detailed diagram of an embodiment of an electronic circuit according to the invention for the brake system according to FIG. 1; [Figure 3] 3 is a diagram of an exemplary signal flow of the electronic circuit according to FIG. 2; [Figure 4] FIG. 2 is a circuit diagram of a power supply unit of an electronic control unit of the brake system according to FIG. 1; [Figure 5] 3 is a diagram of the redundant logic of the electronic circuit and power supply of the electronic lock unit according to FIG. 2. [Figure 6] 2 is a diagram of a further embodiment of an electronic circuit according to the invention for the brake system according to FIG. 1; DETAILED DESCRIPTION OF THE INVENTION

[0026] 1 shows a portion of a brake system 1 for a motor vehicle 2, not shown in detail. The motor vehicle 2 is, for example, an agricultural commercial vehicle, in particular a tractor. The brake system 1 performs, in particular, the parking brake or service brake functions of the wheels 13 of the motor vehicle 2 and of the trailer brakes of a trailer vehicle 4, which is only shown in FIG. 1 . The functions detailed below are, in the illustrated exemplary embodiment, part of a tractor brake system platform, the so-called EBP platform. The EBP platform is to ensure safe operation of the brake system 1 in the event of various failure scenarios.

[0027] The brake system 1 comprises an electronically controllable parking brake module 5. The parking brake module 5 comprises a first directional control valve designed as a control valve 6, a second directional control valve designed as a redundant valve 7, and a pressure-controlled shuttle valve 8. The parking brake module 5 is supplied with compressed air on the input side by a compressed air supply device 9. The compressed air supply device 9 comprises a first compressed air tank 10, a second compressed air tank 11, and a third compressed air tank 12. In the illustrated embodiment, the control valve 6 and the redundant valve 7 are each connected on the inlet side to the third compressed air tank 12 of the compressed air supply device 9. However, this is purely exemplary. The valve spools of the control valve 6 and the redundant valve 7 are each pre-biased by a spring to a closed switching position. In the closed switching position, pressure from the compressed air supply device 9 is not conducted through the control valve 6 and the redundant valve 7 ("normally closed"). One or more of the valve spools can also be replaced by a valve seat, respectively. The valve seat can be closed or opened, for example, by a plunger that is moved by magnetic force. Alternatively, actuation of the plunger, for example, moved by means of a lever, is also conceivable.

[0028] On the output side, the control valve 6 and the redundant valve 7 are each connected to a shuttle valve 8. As a result, the higher pressure of both valves 6, 7 is output via the shuttle valve 8 and supplies pressure to the spring-loaded parking brake valves 14 assigned to two respective wheels 13 and to the trailer brakes 3. If the control valve 6 fails, the pressure of the redundant valve 7 can still be used as long as the redundant valve 7 is not faulty. If the redundant valve 7 fails, the pressure of the control valve 6 can still be used as long as the control valve 6 is not faulty. A pressure sensor 15 measures the pressure output via the shuttle valve 8 and transmits the measured pressure to an electronic control unit 16 of the brake system 1.

[0029] When at least one of the valve spools of both valves 6, 7 is in its open switching position, a predetermined pressure can be conducted through the control valve 6 and / or the redundant valve 7 and output via the shuttle valve 8. The spring-loaded parking brake valve 14 and the trailer brake 3 are then actuated so that the parking brake is released against the preload of the spring. The wheels 13 of the motor vehicle 2 and / or the trailer vehicle 4 are not then locked. In contrast, when both valve spools of the two valves 6, 7 are in their closed switching positions, pressure is not conducted through the control valve 6 and the redundant valve 7 and is not output via the shuttle valve 8. The spring-loaded parking brake valve 14 and the trailer brake 3 are then not actuated as described above but are instead activated. The wheels 13 of the motor vehicle 2 and / or the trailer vehicle 4 are then locked. In this regard, the electronically controllable parking brake module 5 can be said to have an inverted switching characteristic. Thus, the parking brake of the motor vehicle 2 and the trailer brake 3 are activated, for example, when no pressure is output via the shuttle valve 8 and are released when a sufficiently high pressure is output via the shuttle valve 8. In some cases, the trailer brakes can be configured without a spring accumulator. Activation therefore takes place via a further valve, for example a so-called trailer control valve. This valve again reverses the signal coming from the shuttle valve 8. Pressure is therefore supplied to the trailer brakes 3 from the compressed air tank. In other words, in the latter embodiment, the trailer brakes 3 are activated via the trailer's service brakes and not via a spring accumulator.

[0030] The electronic control unit 16 of the brake system 1 is connected via a CAN BUS 17 to an electronic (main) control unit 18 of the vehicle 2. The electronic (main) control unit 18 of the vehicle 2 is, in the illustrated embodiment, connected in particular to a human-machine interface 19. By means of the human-machine interface 19, the driver or user of the vehicle 2 can, in the illustrated embodiment, operate both parking brake valves 14 of the vehicle 2 and / or the trailer brakes 3 of the trailer vehicle 4.

[0031] In particular, it is necessary to prevent the wheels of the motor vehicle 2 or the trailer vehicle 4 from becoming stuck due to the loss of pressure supply to the parking brake valve 14 and the trailer brake 3 while the motor vehicle 2 or the trailer vehicle 4 is moving. This pressure supply function is controlled by the electronic control unit 16 of the brake system 1 during normal operation of the brake system 1. For this purpose, the electronic control unit 16 of the brake system 1 is connected to the control valve 6 via a first electronic control line 20 and to the redundant valve 7 via a second electronic control line 21. When the electronic control unit 16 of the brake system 1 energizes the control valve 6 and the redundant valve 7 via the electronic control lines 20 and 21, the valve spools of the control valve 6 and the redundant valve 7 are moved from the closed switching position to the open switching position against the preload of the springs. In the open switching position, pressure from the compressed air supply device 9 is directed through the control valve 6 and the redundant valve 7. The higher of the two pressures is directed to the parking brake valve 14 and / or the trailer brake 3 via the shuttle valve 8. As a result, the wheels of the motor vehicle 2 and / or the trailer vehicle 4 are not locked.

[0032] However, if the electronic control unit 16 of the brake system 1 malfunctions, this function is controlled by an electronic circuit 22, which will be described in more detail below. In the embodiment according to FIG. 1, the electronic circuit 22 is accommodated in a common housing 23 with the electronic control unit 16 of the brake system 1. According to FIG. 2, the electronic circuit 22 comprises the electronic control unit 16 of the brake system 1, a safety control device 24 having an inverter 25, and a watchdog timer 60. Furthermore, the electronic circuit 22 includes an electronic locking unit 26. The electronic locking unit 26 has a first electronic delay unit 27 and a first memory unit 28 configured as an electronic one-bit memory unit. Furthermore, the electronic circuit 22 includes a redundancy logic 29 for the redundant valve 7. The redundancy logic 29 for the redundant valve 7 further includes a further inverter 30 and a first OR gate 31. A high-side switch HSS and a low-side switch LSS are also connected to the redundant valve 7.

[0033] In its normal operating state, the electronic control unit 16 of the brake system 1 generates a first normal operating control signal 32 for the high-side switch. Using the first normal operating control signal 32, the electronic control unit 16 of the brake system 1 can activate and deactivate the high-side switch HSS. As a result, the valve spool of the redundant valve 7 is moved to an open switching position (the high-side switch HSS is activated or closed, and the low-side switch LSS is simultaneously activated) or a closed switching position (the high-side switch HSS is deactivated or opened), as described above. In this regard, it can be said that the electronic control unit 16 is configured to control the redundant valve 7 in a defined manner using the first normal operating control signal 32. The first normal operating control signal 32 is a direct current (DC) signal due to the nature of the FSC-AC concept used here. 3, the first normal operation control signal 32 takes the value "1" when the electronic control unit 16 of the brake system 1 energizes the high-side switch HSS, thus activating or closing it. On the other hand, the first normal operation control signal 32 takes the value "0" when the electronic control unit 16 of the brake system 1 does not energize the high-side switch HSS, thus deactivating or opening it. The electronic control unit 16 of the brake system 1 sends the first normal operation control signal 32 as an input signal to the first OR gate 31 of the redundancy logic 29. Similarly, the electronic control unit 16 of the brake system 1 can also control the control valve 6 via its high-side switch (not shown in FIG. 2).

[0034] Furthermore, the electronic control unit 16 of the brake system 1 generates a second normal operation control signal 35 for the low-side switch LSS of the redundant valve 7 in its normal operating state. Using the second normal operation control signal 35, the electronic control unit 16 of the brake system 1 can activate and deactivate the low-side switch LSS. As a result, the valve spool of the redundant valve 7 is moved to an open switching position (the low-side switch LSS is activated or closed and the high-side switch HSS is simultaneously closed) or a closed switching position (the high-low switch LSS is deactivated or opened), as described above. The redundant valve 7 can be operated using a DC signal or using pulse width modulation (PWM), since this signal is not an input signal for the locking unit 26, which will be described in more detail below.

[0035] The safety control device 24 operates independently of the electronic control unit 16 of the brake system 1. A watchdog 60 of the safety control device 24 monitors the function of the electronic control unit 16 of the brake system 1. In the illustrated embodiment, the safety control device 24 can output a binary status signal 33 based on the result of the watchdog 60's monitoring of the electronic control unit 16 of the brake system 1. A normal operating value of "1" of the status signal indicates that the electronic control unit 16 of the brake system 1 is functioning normally. As a result, the safety control device 24 can conclude that the redundant valve 7 is being controlled in a predetermined manner. In contrast, an error value of "0" of the status signal indicates the presence of at least one of the following error cases: the electronic control unit 16 of the brake system 1 is not functioning normally, the electronic control unit 16 of the brake system 1 is in the start phase, the safety control device 24 is not functioning normally, or the safety control device 24 is in the initialization or start phase. When at least one of these error cases exists, the safety control device 24 can conclude that the redundant valve 7 is not being controlled in a predetermined manner.

[0036] The safety control device 24 transmits the generated status signal 33 to a further inverter 30 of the redundant logic 29. The further inverter 30 of the redundant logic 29 converts the status signal 33 transmitted from the safety control device 24 to the further inverter 30 of the redundant logic 29 into an inverted status signal 34. When the status signal 33 transmitted from the safety control device 24 to the further inverter 30 of the redundant logic 29 has a normal operating value of "1", the further inverter 30 converts the status signal 33 so that the inverted status signal 34 has an error value of "0", and transmits the inverted status signal 34 having the error value "0" to a first OR gate 31 of the redundant logic 29 as an input signal. In contrast, when the status signal 33 sent from the safety control device 24 to the further inverter 30 of the redundant logic 29 takes on an error value of "0", the further inverter 30 converts the status signal 33 so that the inverted status signal 34 takes on a normal operating value of "1", and sends the inverted status signal 34 having the normal operating value of "1" as an input signal to the first OR gate 31 of the redundant logic 29.

[0037] Thus, the first OR gate 31 of the redundancy logic 29 receives two input signals: a first normal operating control signal 32 (from the electronic control unit 16 of the brake system 1) and an inverted status signal 34 (from a further inverter 30 of the redundancy logic 29). The first OR gate 31 is configured to output one of the two aforementioned input values ​​32, 34, each of which assumes a value greater than or equal to 1. When none of the aforementioned error cases exists, the status signal 33 assumes a value of “1” and the inverted status signal 34 assumes a value of “0.” The first normal operating control signal 32 assumes the value “1” in this case because the electronic control unit 16 of the brake system 1 energizes and thereby activates or closes the high-side switch HSS. However, it should be noted that the normal operating control signal 32 can also have the value “0” even when no error case exists, for example, when the actuator should not be energized. This would be the case, for example, when the parking brake is engaged or activated. Therefore, in this case, the first OR gate 31 outputs a first normal operation control signal 32 having a value of "1" to control the high-side switch HSS of the redundant valve 7. On the other hand, when one of the above-mentioned error cases exists, the status signal 33 takes the value "0" and the inverted status signal 34 takes the value "1." The first normal operation control signal 32 takes the value "0" in this case when the electronic control unit 16 of the brake system 1, for example, has a malfunction and does not normally energize, activate, or close the high-side switch HSS. Therefore, in this case, the first OR gate 31 outputs an inverted status signal 34 having a value of "1" to control the high-side switch HSS of the redundant valve 7. When the safety control device 24 triggers the fail-safe state of the electronic control unit 16, the redundancy logic 29 thus ensures that the high-side switch HSS of the redundant valve 7 is always activated.

[0038] The electronic control unit 16 of the brake system 1 sends a first normal operating control signal 32 as an input signal to a first delay unit 27. With a time delay of at least 25 milliseconds (marked "Delay" on the corresponding signal waveform in FIG. 3 ), the first delay unit 27 outputs the first normal operating control signal 32 as an output signal 36 and sends this output signal 36 to a signal input 37 of a first memory unit 28. The logic level ("1" or "0") or other characteristics of the first normal operating control signal 32 are not changed. The time delay may vary depending on temperature. An implementation of the first delay unit 27 may include, among other things, an RC low-pass filter and two sequential Schmitt trigger inverters (not shown).

[0039] The safety control device 24 transmits the generated status signal 33 to an inverter 25 of the safety control device 24. The inverter 25 of the safety control device 24 (like the inverter 30 of the redundancy logic 29) converts the status signal 33 received by the safety control device 24 into an inverted status signal 34. When the status signal 33 transmitted from the safety control device 24 to its inverter 25 has a normal operating value of "1", the inverter 25 converts the status signal 33 so that the inverted status signal 34 has an error value of "0", and transmits the inverted status signal 34 with the error value "0" to the trigger connection 38 and the reset connection 39 of the first memory unit 28. When the status signal 33 sent from the safety control device 24 to the inverter 25 takes on an error value of "0", the inverter 25 converts the status signal 33 so that the inverted status signal 34 takes on a normal operating value of "1", and sends the inverted status signal 34 having the normal operating value of "1" to the trigger connection 38 and the reset connection 39 of the first memory unit 28.

[0040] The inverted status signal 34 generated by the inverter 25 of the safety control device 24 has a normal operation value of "1" and is provided as a trigger signal 40 to the first memory unit 28. The trigger signal 40 is generated by the safety control device 24 without the electronic control unit 16 of the brake system 1 influencing the generation of this trigger signal 40. When the first memory unit 28 receives the trigger signal 40 generated by the safety control device 24, the trigger signal 40 triggers the first memory unit 28 to store the normal operation control signal 36 sent with a time delay by the delay unit 27. This triggering occurs precisely when the inverted status signal 34 changes its value from "0" to "1." In the time sequence according to FIG. 3, this is represented by two rising edges 41 of the inverted status signal 34. The fail-safe state is thereby triggered by the safety control device 24.

[0041] The first memory unit 28 outputs the stored normal operating control signal 36, delayed in time by at least 25 milliseconds, as a first fail-safe control signal 42. The first fail-safe control signal 42 is the normal operating control signal 36 from the past, i.e., the normal operating control signal 36 that is at least 25 milliseconds older in time. This point in time is always before the rising edge 41 in Figure 3. For this point in time, none of the above cases exist, and the redundant valve 7 was controlled in a manner determined by the electronic control unit 16 of the brake system 1 using the normal operating control signal 36.

[0042] The first memory unit 28 outputs a first fail-safe control signal 42 via its signal output 43, which is then sent via a second OR gate 44 and a third OR gate 45 as an output signal 46 to the low-side switch LSS of the redundant valve 7 to control the low-side switch so that the redundant valve 7 maintains the state it was in before the error case occurred on the rising edge 41. In this example, the low-side switch LSS is activated or closed, resulting in the redundant valve 7 being energized and its valve spool moving to the open switching position. Thus, as soon as the first memory unit 28 receives the trigger signal 40 and stores the delayed normal operation control signal 36, the electronic locking unit 26 controls the redundant valve 7 based on the normal operation control signal 36 stored as the first output signal 42 of the first memory unit 28.

[0043] 3 shows that the value of the normal activation control signal 32 drops from "1" to "0" when an error occurs. The watchdog 60 of the safety control device 24 recognizes this error case after a few milliseconds. This also means that the rising edge 41 of the inverted status signal 34 occurs only a few milliseconds after the error case occurs, but this is not critical. On the one hand, this period of a few milliseconds between the occurrence of the error case and the rising edge 41 of the inverted status signal 34 is significantly shorter than the time delay during which the normal activation control signal 32 is transmitted from the delay unit 27 to the memory unit 28. On the other hand, this period of a few milliseconds between the occurrence of the error case and the rising edge 41 of the inverted status signal 34 is not long enough to activate the parking brake or trailer brake of the vehicle 2. A time in the range of 100 milliseconds or more would be required for this.

[0044] The second OR gate 44 has a first input 47 and a second input 48. The first input 47 of the second OR gate 44 is connected to the output 43 of the first memory unit 28. The second input 48 of the second OR gate 44 is connected to the output 49 of the second memory unit 50 of the locking unit 26. In the illustrated embodiment, the second memory unit 50 is identical to the first memory unit 28. The second memory unit 50 cooperates with a second delay unit 51 of the locking unit 26 and the safety control device 24, similar to the first delay unit 26 and the first memory unit 28. In the illustrated embodiment, the second delay unit 51 is configured identically to the first delay unit 27.

[0045] The functional differences lie in the signal inputs and outputs, in particular the input signals for the second delay unit 51, which will be explained in more detail below. Thus, in the following normal operating state of the brake system 1, the electronic control unit 16 generates a third normal operating control signal 52 for the high-side switch (not shown in FIG. 2, compare FIG. 6) of the control valve 6 as well as for the high-side switch HSS of the redundant valve 7. This third normal operating control signal 52 is transmitted by the second delay unit 51 to the second memory unit 50 as a time-delayed second normal operating control signal 53 with a time delay of at least 25 milliseconds.

[0046] The safety control device 24 monitors the electronic control unit 16 of the brake system 1 and, based on this monitoring, determines whether the control valve 6 is controlled in a predetermined manner, as described above in relation to the control of the redundant valve 7, and outputs a corresponding status signal 33 that is inverted by the inverter 25. The second memory unit 50 can store a time-delayed second normal operation control signal 53 and output it as a second fail-safe control signal 54, similar to what was described above in relation to the first storage unit 28.

[0047] The second failsafe control signal 54 is applied to a second input 48 of the second OR gate 44. The first failsafe control signal 42 (already described above) is applied to a first input 47 of the second OR gate 44. The second OR gate 44 outputs one or more of the two failsafe control signals 42, 54 as a selective failsafe control signal 55. The third OR gate 45 has a first input 56 and a second input 57. The first input 56 of the third OR gate 45 is connected to the electronic control unit 16 of the brake system 1 and receives the second normally operating control signal 35 for the low-side switch LSS of the redundant valve 7. The second input 57 of the third OR gate 45 is connected to an output 58 of the second OR gate 44 and receives the selective failsafe control signal 55. The third OR gate 45 outputs one or more of the two control signals 35, 55 as an output signal 46 to the low-side switch LSS of the redundant valve 7.

[0048] When the memory units 28, 50 receive the reset signal 59, both memory units 28, 50 are reset ("reset"). In the illustrated embodiment, the reset signal 59 is generated by the safety control device 24. The inverter 25 of the locking unit 26 converts the received normal operating value "1" to an error value "0" and transmits this error value "0" as the reset signal 59 to the memory units 28, 50. The output values ​​of both memory units 28, 50 are reset to the transfer value corresponding to the value "0" ("default"). In this case, the locking unit 26 returns control of the redundant valve 7 and the control valve 6 to the electronic control unit 16 again. Alternatively, the reset signal 59 can be generated by a reset unit 63 separate from the locking unit 26. This is shown in dashed lines in FIG. 2. The external reset unit 63 is configured to reset the memory units 28 of the locking unit 26, for example, by turning off the power. The external reset unit 63 can also be implemented by an external hardwired switch. A hardwired switch can be used to power in particular both memory units 28, 50 off for the reset process and on again for reactivation. Alternatively or in addition to the reset process being initiated by means of the external reset unit 63, this can be initiated by the methods described above, as already mentioned at the beginning.

[0049] When the status signal generated by the safety control device 24 assumes the error value "0," this error value "0" can indicate, for example, that the electronic control unit 16 is booting or in the start phase and therefore the redundant valve 7 is not yet controlled by the electronic control unit 16 in the manner defined by the first normal operation control signal 32. In this case, the electronic control unit 16 can read the state of the locking unit 26 by measuring the analog feedback of the high-side switch HSS and the low-side switch LSS of the redundant valve 7. This allows the electronic control unit 16 to recognize the state of the locking unit 26 and maintain that state after the start process of the electronic control unit 16 of the brake system 1 is completed.

[0050] FIG. 4 shows the power supply unit 61 for the electronic control unit 16 of the brake system 1. The power supply unit 61 provides two independent power terminals, TRM-30A and TRM-30B, to the electronic control unit 16 of the brake system 1. The power terminals, TRM-30A and TRM-30B, are connected to separate grounds, TRM-31A-GND and TRM-31B-GNDB, respectively. Both power terminals, TRM-30A and TRM-30B, are coupled to UB-VERS via passive reverse polarity protection 62. Each terminal, TRM-30A and TRM-30B, also supplies multiple valves. The details of the power supplies to the valves are not shown in FIG. 4. A wake-up signal is required to activate the computing system and all other internal circuitry. The electronic control unit 16 of the brake system 1 can be activated via the vehicle ignition input, TRM-15, supplied by the vehicle ignition supply, TRM-15. The corresponding input circuit TRM-15-INPUT provides an enable signal for the limiting unit ("limiter"). The limiting unit 64 protects the underlying circuit from overvoltage and simultaneously acts as a gate. When the limiting unit 64 is released, the electronic control unit 16 of the vehicle 2 is activated. When the electronic control unit 16 of the vehicle 2 is fully started, it can remain activated via a self-hold signal, even if the enable signal of the input circuit TRM-15-INPUT is canceled. This is necessary to perform an orderly shutdown procedure with the vehicle ignition TRM-15 switched off. When the limiting unit 64 is activated, the voltage referred to as UES is equal to UB-VERS, except in an overvoltage situation.

[0051] FIG. 5 shows that the internal circuits of the redundant logic 29 and locking unit 26 are supplied by the input voltages UES and TRM-15-SUPPLE, respectively. At least one voltage must be present for the redundant parking brake function to remain available. The redundant valve 7 itself is supplied by a separate power supply terminal TRM-31B-GNDB, which is referenced to ground TRM-31B-GNDB. When both supply voltages (UES and TRM-15-SUPPLE) are absent, the redundant parking brake function is unavailable. This occurs when an error in the computing system occurs, in which case the self-hold signal is not present and the vehicle ignition supply TRM-15-SUPPLE is switched off. In this case, the internal circuits of the redundant logic 29 and locking unit 26 are no longer energized and can no longer perform any functions. Safety regulations may further require that the driver of the vehicle 2 must be able to activate or establish the parking brake from his or her seat at any time. In the case of an error, this is possible by switching off the vehicle ignition TRM-15 shown in Figure 6. When the vehicle ignition TRM-15 is switched off in the case of an error, the parking brake is applied. The locking units 26 and 29 then no longer receive power. This means that the control or redundant valves 6, 7 are not energized and are therefore closed. As a result, the control or redundant valves 6, 7 do not transmit any pressure, and as a result, the parking brake is applied. [Explanation of symbols]

[0052] Delay Time delay HSS High Side Switch Limiter Limiting Unit LSS Low-side switch TRM-15 Vehicle Ignition Input TRM-15-input input circuit TRM-15-Supply Vehicle Ignition Supply TRM-30A power supply terminal TRM-30A-GNDB Ground TRM‐30B power terminal TRM-30B-GNDB Ground 1. Brake system 2. Automobiles 3 Trailer brake 4 Trailer vehicles 5 Parking Brake Module 6. Control valve 7 Redundant valves 8 Shuttle Valve 9 Compressed air supply equipment 10. No. 1 compressed air tank 11 Second compressed air tank 12. Third compressed air tank 13 wheels 14 Parking brake valve 15 Pressure Sensor 16. Brake system electronic control unit 17 CAN BUS 18 Automotive Electronic Control Unit 19 Human-machine interface 20. First electronic control line 21 Second electronic control line 22 Electronic circuit 23 Brake system electronic control unit housing 24 Safety Control Devices 25 inverter 26 Lock Unit 27 First Delay Unit 28 First Memory Unit 29 Redundant Logic 30 Redundant logic inverter 31 1st OR Gate 32 First normal operation control signal 33 Status Signal 34 Inverted Status Signal 35 Second normal operation control signal 36 Output signal of the first delay unit 37 Signal input for the first memory unit 38 Trigger connection of first memory unit 39 Reset connection of first memory unit 40 Trigger Signal 41 Rising edge of inverted status signal 42 First fail-safe control signal 43 Signal output of the first memory unit 44 2nd OR Gate 45 3rd OR Gate 46 Output signal to low-side switch 47 1st input of 2nd OR gate 48 Second input of the second OR gate 49 Second memory unit output 50 Second Memory Unit 51 Second Delay Unit 52 Third normal operation control signal 53 Time-delayed second normal operation control signal 54 Second fail-safe signal 55 Selective Fail-Safe Control Signal 56 1st input of the 3rd OR gate 57 2nd input of the 3rd OR gate 58 Output of the second OR gate 59 Reset Signal 60 Watchdog 61 Power supply unit 62 Reverse polarity protection 63 Reset Unit 64 Limit Units

Claims

1. An electronic circuit (22) comprising: an electronic control unit (16); Safety control device (24) an electronic locking unit (26) having a delay unit (27) and a memory unit (28); the electronic control unit (16) is configured to control at least one actuator (7) in a defined manner using a normal operating control signal (32); The safety control device (24) is configured to generate a trigger signal (40) for the electronic locking unit (26), without the electronic control unit (16) having any influence on the generation of the trigger signal (40); The delay unit (27) receiving the normal operation control signal (32); configured to transmit the normal operation control signal (32) to the memory unit (28) with a time delay; The memory unit (28) configured to receive the trigger signal (40) generated by the safety control device (24); the memory unit (28) is configured to store the normal operation control signal (36) sent from the delay unit (27) together with the time delay upon receiving the trigger signal (40); The electronic circuit (22) is configured to control the actuator (7) based on the normal operation control signal (36) stored as an output signal (42) of the memory unit (28) as soon as the memory unit (28) receives the trigger signal (40) and stores the normal operation control signal (36) transmitted with the time delay.

2. 2. An electronic circuit (22) according to claim 1, The electronic control unit (16) controls the high-side switch (HSS) of the actuator (7) in a predetermined manner using the normal operation control signal (32); The electronic lock unit (26), an electronic circuit (22) configured to control a low side switch (LSS) of the actuator (7) using the stored normal operation control signal (36).

3. 3. The electronic circuit (22) of claim 2, wherein the electronic control unit (16) is configured to control the low-side switch (LSS) of the actuator by pulse width modulation.

4. An electronic circuit (22) according to any one of claims 1 to 3, The safety control device (24) is configured to generate a status signal (33) that takes either a normal operating value ("1") or an error value ("0"); The normal operating value ("1") indicates that the actuator (7) is controlled in a defined manner; The error value ("0") indicates that the actuator (7) is not controlled in a defined manner; The safety control device (24) includes an inverter (25); The inverter (25) is configured to convert the error value ("0") to the normal operating value ("1") and transmit the normal operating value ("1") as the trigger signal (40) to the memory unit (28).

5. 5. An electronic circuit (22) according to claim 4, comprising: The memory unit (28) is configured to receive a reset signal (59); the lock unit (26) is configured to control the actuator (7) using the stored normal operating control signal (36) as long as the memory unit (28) receives a reset signal; The electronic circuit (22) is configured such that the electronic control unit (16) retakes control of the actuator (7) as soon as the memory unit (28) receives the reset signal (59).

6. 6. The electronic circuit (22) according to claim 5, wherein the reset signal (59) is generated by a reset unit (63) separate from the lock unit (26).

7. 7. The electronic circuit (22) of claim 6, wherein the inverter (25) is configured to convert a normal operating value ("1") into an error value ("0") and transmit the error value ("0") as the reset signal (59) to the memory unit (28).

8. An electronic circuit (22) according to any one of claims 4 to 7, the error value ("0") indicates that the electronic control unit (16) is in a start phase and therefore the actuator (7) is not controlled by the electronic control unit (16) in a manner defined by the normal operation control signal (32); The electronic control unit (16) measuring analog feedback of the high-side switch (HSS) and the low-side switch (LSS) of the actuator (7) while the electronic control unit (16) is in the start phase and when the safety control device (24) generates the status signal (33) to assume the error value ("0"), and deriving the operating state of the locking unit (26) accordingly; An electronic circuit (22) that controls the actuator (7) based on the measured analog feedback, so that the locking unit (26) is configured to maintain its operating state after the electronic control unit (16) has completed the start phase.

9. 9. The electronic circuit (22) according to claim 1, wherein the safety control device (24) includes a watchdog (60) connected on an input side to the electronic control unit (16) and connected on an output side to the inverter (25).

10. 10. The electronic circuit (22) according to any one of claims 1 to 9, wherein the delay unit (24) is configured to transmit the normal operation control signal (32) to the memory unit (28) with a time delay of at least 25 milliseconds.

11. A brake system (1) for a motor vehicle (2), said brake system (1) comprising: a first directional control valve designed as a control valve (6); a second directional control valve designed as a redundant valve (7); an electronically controllable parking brake module (5) having a pressure-controlled shuttle valve (8); an electronic circuit (22) according to any one of claims 1 to 10; an electronic control unit (16) of the electronic circuit (22) configured to control the redundant valve (7) as an actuator in a predetermined manner using a normal operating control signal (32); a safety control device (24) configured to generate a trigger signal (40) for the electronic locking unit (26), without the electronic control unit (16) influencing the generation of the trigger signal (40); The delay unit (27) of the lock unit (26) of the electronic circuit (22) comprises: receiving the normal operation control signal (32); configured to transmit the normal operation control signal (32) with a time delay to a memory unit (28) of the electronic circuit (22); The memory unit (28) configured to receive the trigger signal (40) generated by the safety control device (24); the memory unit (28) is configured to store the normal operation control signal (36) sent from the delay unit (27) together with the time delay upon receiving the trigger signal (40); The electronic locking unit (26) of the electronic circuit (22) is configured to control the redundant valve (7) using the normal operation control signal (36) stored as an output signal (42) of the memory unit (28) as soon as the memory unit (28) receives the trigger signal (40) and stores the normal operation control signal (36).

12. 12. A braking system (1) according to claim 11, wherein the electronic circuit (22) further comprises a further delay unit (51) and a further memory unit (50), the electronic control unit (16) is configured to control the control valve (6) as a further actuator in a defined manner using a further normal operating control signal (52); The further delay unit (51) receiving said further normal operating control signal (52); configured to transmit said further normal operation control signal (52) with a time delay to said further memory unit (50); The further memory unit (50) receiving the trigger signal (40) generated by the safety control device (24); the further memory unit (50) is configured to store the further normal operating control signal (53) sent from the further delay unit (51) together with the time delay upon receiving the trigger signal (40); The electronic locking unit (26) is configured to control the control valve (7) using the further normal operating control signal (53) stored as an output signal of the further memory unit (50) as soon as the further memory unit (50) receives the trigger signal (40) and stores the further normal operating control signal (53).

Images