Brake system

Abstract

To provide a brake system which has a plurality of sensors and which can secure redundancy even if two or more of the sensors fail.SOLUTION: A brake system for controlling a brake circuit 10 comprises: four or more sensors 21, 22, 23, 24 which output detection signals dependent on an amount of operation of a brake pedal; and an electronic control device 30 including a first electronic control device 31 to which three or more sensors except for one specific sensor are connected, and a second electronic control device 32 to which the specific sensor and a common sensor are connected, the electronic control device 30 controlling the brake circuit on the basis of the amount of operation detected by the sensors. When the first electronic control device does not determine that a sensor in a normal state exists among the three or more sensors and when the second electronic control device determines that both of the two sensors are in a normal state, the electronic control device controls the brake circuit on the basis of an amount of operation detected by at least one either one of the specific sensor and the common sensor.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to braking systems. [Background technology]

[0002] Conventionally, a vehicle brake system is known that includes a pedal measurement unit that measures a brake pedal and a computer device that determines a brake target value based on the measurement results measured by the pedal measurement unit (see, for example, Patent Document 1). The pedal measurement unit included in this vehicle brake system includes a first measurement device and a second measurement device that are configured independently of each other and supply signals corresponding to pedal operation, and a monitor element that inspects the measurement values ​​measured by the first measurement device and the second measurement device. The monitor element compares the brake pedal measurement result it measures with the brake pedal measurement results measured by the first measurement device and the second measurement device, respectively, to determine whether the measurement results of the first measurement device and the second measurement device are normal or abnormal.

[0003] The computer device determines the brake target value based on the measurement result of the first measurement device and the measurement result of the second measurement device that is determined by the monitor element to be functioning normally. This ensures redundancy as a brake system that controls the brake circuit that brakes the vehicle. Hereinafter, the measurement device that measures the brake pedal is also called a sensor. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 3894951 Summary of the Invention [Problem to be solved by the invention]

[0005] However, if a brake system has three sensors and two of the three sensors fail and become abnormal, it is not possible to identify the normal detection signal by simply comparing the detection signals of the three sensors without identifying the abnormal sensor, and in this case, it is not possible to ensure redundancy as a brake system.

[0006] An object of the present disclosure is to provide a brake system having a plurality of sensors that can ensure redundancy even if two or more sensors fail. [Means for solving the problem]

[0007] The invention described in claim 1 is A brake system for controlling a brake circuit (10) that brakes a vehicle, comprising: four or more sensors (21, 22, 23, 24) for detecting an amount of operation of a brake pedal (91) operated by a driver and generating and outputting a detection signal corresponding to the detected amount of operation; an electronic control device (30) including a first electronic control device (31) to which three or more sensors (21, 22, 24) excluding one predetermined sensor (23) of the four or more sensors are connected, and a second electronic control device (32) to which two sensors, namely the predetermined sensor and one common sensor (24) of the three or more sensors, are connected, and which controls a brake circuit based on an operation amount detected by the four or more sensors; The first electronic control unit is capable of determining that there is a sensor in a normal state among the three or more sensors based on the operation amounts detected by each of the three or more sensors, The second electronic control unit is capable of determining that both of the two sensors are in a normal state based on the operation amounts detected by the two sensors, The electronic control device is If the first electronic control unit does not determine that any of the three or more sensors is in a normal state, and the second electronic control unit determines that both of the two sensors are in a normal state, the brake circuit is controlled based on the amount of operation detected by at least one of the specified sensor and the common sensor.

[0008] According to this, even if two of the three or more sensors connected to the first electronic control unit are in an abnormal state, the brake circuit can be controlled based on the operation amount detected by the predetermined sensor connected to the second electronic control unit and the common sensor, thereby ensuring redundancy as a brake system.

[0009] The reference symbols in parentheses attached to each component indicate an example of the correspondence between the component and specific components described in the embodiments described below. [Brief description of the drawings]

[0010] [Figure 1] 1 is a schematic configuration diagram of a brake system according to an embodiment of the present invention; [Diagram 2] 1 is an external view of a brake pedal device according to an embodiment of the present invention; [Diagram 3] 6 is a flowchart showing a control process for updating a first difference flag, a second difference flag, and a third difference flag, which is executed by a first ECU in the present embodiment. [Figure 4] 5 is a flowchart showing a majority decision process executed by a first ECU in the present embodiment. [Diagram 5] 5 is a diagram showing an example of an operation amount detected by each sensor when a first sensor, a second sensor, and a fourth sensor are in a normal state. FIG. [Figure 6] 6 is a diagram illustrating an example of an operation amount detected by each sensor when the first sensor is in an abnormal state. FIG. [Figure 7] 10 is a diagram illustrating an example of an operation amount detected by each sensor when at least two of a first sensor, a second sensor, and a fourth sensor are in an abnormal state. FIG. [Figure 8]13 is a diagram showing another example of the manipulated variables detected by each sensor when at least two of the first sensor, the second sensor, and the fourth sensor are in an abnormal state. FIG. [Figure 9] 4 is a table showing the amount of brake pedal operation determined by the first ECU. [Figure 10] 10 is a flowchart showing a control process for updating a fourth difference flag, which is executed by a second ECU in the present embodiment. [Figure 11] 5 is a flowchart showing a sensor abnormality determination process executed by a second ECU of the present embodiment. [Figure 12] 4 is a table showing the amount of brake pedal operation determined by the second ECU. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] An embodiment of the present disclosure will be described with reference to Figs. 1 to 12. A brake system 1 of the present disclosure is a brake-by-wire system that controls the brakes of a vehicle based on the amount of operation of a brake pedal 91 shown in Fig. 2. As shown in Fig. 1, the brake system 1 includes a brake circuit 10 that brakes a vehicle, and wheel cylinders W1 to W4 whose operation is controlled by the brake circuit 10. As shown in Figs. 1 and 2, the brake system 1 includes a brake pedal device 90 having a brake pedal 91, a first sensor 21 to a fourth sensor 24 that detect the amount of operation of the brake pedal 91, and an electronic control device 30 that drives and controls the brake circuit 10. Furthermore, the brake system 1 includes a power supply unit 40 that supplies power to the brake circuit 10 and the electronic control device 30. The first sensor 21 to the fourth sensor 24 are provided in the brake pedal device 90. Hereinafter, the electronic control device 30 is also referred to as an ECU 30. ECU is an abbreviation for Electronic Control Unit. The ECU is also sometimes referred to as a BCU (Brake Control Unit).

[0012] The wheel cylinders W1 to W4 are disposed on the wheels of the vehicle, respectively, and each of the wheel cylinders W1 to W4 is fitted with a brake pad (not shown).

[0013] The brake circuit 10 can employ various mechanisms. For example, the brake circuit 10 of this embodiment generates brake fluid pressure in the wheel cylinders W1 to W4 to generate a braking force that decelerates the vehicle. The brake circuit 10 may employ an electric brake that brakes each wheel by driving an electric motor to press a brake pad against a disc brake rotor. The brake circuit 10 can also perform normal control, ABS control, VSC control, and the like, in response to a control signal from the ECU 30. ABS is an abbreviation for Anti-lock Braking System, and VSC is an abbreviation for Vehicle Stability Control.

[0014] The brake circuit 10 has a first brake circuit 11 and a second brake circuit 12 which are configured independently of each other. The first brake circuit 11 generates brake fluid pressure in a left front wheel cylinder W1 arranged on the left front wheel and a right front wheel cylinder W2 arranged on the right front wheel. The second brake circuit 12 generates brake fluid pressure in a left rear wheel cylinder W3 arranged on the left rear wheel and a right rear wheel cylinder W4 arranged on the right rear wheel.

[0015] The first brake circuit 11 and the second brake circuit 12 are supplied with driving power from a power supply unit 40. Furthermore, each of the first brake circuit 11 and the second brake circuit 12 is connected to the ECU 30 and controlled by a control signal transmitted from the ECU 30.

[0016] The power supply unit 40 has a first power supply unit 41 and a second power supply unit 42 which are configured independently of each other. The first power supply unit 41 is connected to the first brake circuit 11 and supplies power to the first brake circuit 11. The second power supply unit 42 is connected to the second brake circuit 12 and supplies power to the second brake circuit 12. In this way, the brake system 1 of the present embodiment has a redundant power supply to the brake circuit 10 by providing different configurations for the power supply source to the first brake circuit 11 and the power supply source to the second brake circuit 12.

[0017] The ECU 30 is composed of a microcomputer including a processor that performs control processing and arithmetic processing, a storage unit such as a ROM and a RAM that stores programs and data, and the like, and peripheral circuits thereof. The storage unit is composed of a non-transient substantial storage medium. The ECU 30 has a first ECU 31 and a second ECU 32. The first ECU 31 and the second ECU 32 perform various control processing and arithmetic processing based on the programs stored in the storage unit, and control the operation of the brake circuit 10.

[0018] The first ECU 31 has three first ECU receivers 311 that receive detection signals transmitted from the first sensor 21, the second sensor 22, and the fourth sensor 24, respectively, and a first ECU processor 312 that processes the detection signals received by the three first ECU receivers 311. The first ECU 31 also has a first ECU switch 313 that turns on and off the connection between the first ECU 31 and the brake circuit 10. The first ECU 31 has three first ECU receivers 311 that are provided independently of one another, and the first sensor 21, the second sensor 22, and the fourth sensor 24 are directly connected to the three first ECU receivers 311. The first ECU 31 also has a first brake circuit 11 and a second brake circuit 12 connected to it via the first ECU switch 313. The first ECU 31 is connected to a first power supply unit 41, and is supplied with driving power from the first power supply unit 41. In this embodiment, the first ECU 31 functions as a first electronic control unit.

[0019] The second ECU 32 has two second ECU receivers 321 that receive detection signals transmitted from the third sensor 23 and the fourth sensor 24, and a second ECU processor 322 that processes the detection signals received by the two second ECU receivers 321. The 2ECU 30 also has a second ECU switch 323 that turns on and off the connection between the second ECU 32 and the brake circuit 10. The second ECU 32 has two second ECU receivers 321 that are provided independently of each other, and the third sensor 23 and the fourth sensor 24 are directly connected to the two second ECU receivers 321. The second ECU 32 is also connected to the first brake circuit 11 and the second brake circuit 12 via the second ECU switch 323. The second ECU 32 is connected to a second power supply unit 42, and is supplied with driving power from the second power supply unit 42. In this manner, the first ECU 31 and the second ECU 32 are supplied with driving power from different power supply units 41, 42. In this embodiment, the second ECU 32 functions as a second electronic control unit.

[0020] The first ECU 31 and the second ECU 32 are configured to be able to communicate with each other. The first ECU 31 is configured to be able to transmit the processing contents of the first ECU processing unit 312 to the second ECU 32, and to be able to receive the processing contents of the second ECU processing unit 322 in the second ECU 32. On the other hand, the second ECU 32 is configured to be able to transmit the processing contents of the second ECU processing unit 322 to the first ECU 31, and to be able to receive the processing contents of the first ECU processing unit 312 in the first ECU 31.

[0021] Fig. 2 shows a pendant type brake pedal device 90 as an example. In the pendant type brake pedal device 90, a pedal 911 that is depressed by the driver out of the brake pedal 91 is disposed below the axis CL of the swing in the vertical direction when the brake pedal device 90 is mounted on the vehicle. The arrow in Fig. 2 indicates the up-down direction when the brake pedal device 90 is mounted on the vehicle.

[0022] The brake pedal device 90 includes a brake pedal 91 and a housing 92. The housing 92 is fixed to a dash panel by bolts (not shown) or the like. The brake pedal 91 is formed in a plate shape and disposed at an angle to the vehicle floor. Specifically, the brake pedal 91 is disposed at an angle such that its upper end is in the front of the vehicle and its lower end is in the rear of the vehicle. A pedal 911 that is depressed by the driver is provided at a lower portion of the brake pedal 91.

[0023] The brake pedal 91 is fixed to a rotating shaft (not shown) provided inside the housing 92. Therefore, the brake pedal 91 is provided so as to be swingable about a predetermined axis CL of the rotating shaft provided inside the housing 92. In this specification, swinging refers to a rotational movement in the forward and reverse directions within a predetermined angle range about the predetermined axis CL.

[0024] Although not shown in FIG. 2, inside the housing 92, a reaction force generating mechanism that generates a reaction force against the depressing force applied to the brake pedal 91 by the driver and the like are provided.

[0025] The first sensor 21 to the fourth sensor 24 shown in FIG. 1 are provided in a brake pedal device 90, detect the amount of operation of a brake pedal 91 depressed by the driver, generate a detection signal corresponding to the detected amount of operation, and output the detection signal to the ECU 30.

[0026] The first sensor 21 has a first sensor transmitter 211 that transmits a sensor output signal generated within the sensor itself. The first sensor transmitter 211 is connected to a first ECU receiver 311. The first sensor 21 transmits a generated detection signal from the first sensor transmitter 211 to the first ECU receiver 311.

[0027] The second sensor 22 has a second sensor transmitter 221 that transmits a sensor output signal generated within the second sensor 22. The second sensor transmitter 221 is connected to the first ECU receiver 311. The second sensor 22 transmits the generated detection signal from the second sensor transmitter 221 to the first ECU receiver 311.

[0028] The third sensor 23 has a third sensor transmitter 231 that transmits a sensor output signal generated within the third sensor 23. The third sensor transmitter 231 is connected to the second ECU receiver 321. The third sensor 23 transmits the generated detection signal from the third sensor transmitter 231 to the second ECU receiver 321.

[0029] The fourth sensor 24 has two fourth sensor transmitters 241 that transmit a sensor output signal generated within the sensor. One of the two fourth sensor transmitters 241 is connected to the first ECU receiver 311, and the other is connected to the second ECU receiver 321. The fourth sensor 24 distributes one detection signal generated within the sensor into two by duplicating the signal in an integrated circuit within the sensor, and generates two detection signals. These two detection signals are the same signal. The fourth sensor 24 transmits one of the two generated detection signals from one of the fourth sensor transmitters 241 to the first ECU receiver 311. The fourth sensor 24 transmits the other of the two generated detection signals from the other of the fourth sensor transmitters 241 to the second ECU receiver 321.

[0030] The first sensor 21 to the fourth sensor 24 may be sensors that detect different physical quantities, as long as they are capable of detecting unique comparable physical quantities. In this embodiment, from the viewpoint of redundancy, the first sensor 21 to the fourth sensor 24 are sensors that detect three types of physical quantities (for example, a pedal rocking angle, a pedal stroke amount, and a pedal pressure) as the pedal operation amount using different detection methods. Specifically, for example, a magnetic sensor using a Hall element or a magnetic resistance element is used as the sensor that detects the pedal rocking angle. For example, an inductive sensor is used as the sensor that detects the pedal stroke amount. For example, a pressure sensor is used as the sensor that detects the pressure when the brake pedal 91 is depressed. For example, when the first sensor 21 is configured as a magnetic sensor, it is disposed inside the housing 92. For example, when the second sensor 22 is configured as an inductive sensor, it is disposed outside the housing 92. For example, when the fourth sensor 24 is configured as a pressure sensor, it is disposed inside the pedal 911.

[0031] The first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 are configured by combining three sensors that perform detection using different detection methods. In other words, the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 include at least two sensors that perform detection using different detection methods. Furthermore, the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 are configured by combining two sensors that perform detection using different detection methods. For example, the third sensor 23 may be configured by the same magnetic sensor as the first sensor 21, and in this case, is disposed inside the housing 92.

[0032] The types of the first sensor 21 to the fourth sensor 24 are not limited to those described above, and various sensors such as a photoelectric sensor and a distortion sensor can be used. The names of the first sensor 21 to the fourth sensor 24 do not limit the mounting position or type of the sensors in the brake pedal device 90. The names of the first ECU 31 and the second ECU 32 do not limit the mounting position or the like.

[0033] The communication method between the first sensor 21 to the fourth sensor 24 and the first ECU 31 and the second ECU 32 may be analog communication, digital communication, optical communication, or the like. Examples of digital communication include SPI, I2C, UART, and SENT. SPI is an abbreviation for Serial Peripheral Interface. I2C is an abbreviation for Inter-Integrated Circuit. UART is an abbreviation for Universal Asynchronous Receiver / Transmitter. SENT is an abbreviation for Single Edge Nibble Transmission.

[0034] The first sensor 21 and the second sensor 22 are operated by being supplied with power from the first ECU 31. The third sensor 23 and the fourth sensor 24 are operated by being supplied with power from the second ECU 32. Even if the first ECU 31 breaks down, the fourth sensor 24 can continue to operate because it is supplied with power from the second ECU 32. However, if the second ECU 32 breaks down and the power supply from the second ECU 32 stops, it becomes impossible for the fourth sensor 24 to continue to operate. In this embodiment, a voltage of 5V is applied to the first sensor 21 and the second sensor 22 from the first ECU 31. A voltage of 5V is applied to the third sensor 23 and the fourth sensor 24 from the second ECU 32.

[0035] Next, the operation of the brake system 1 controlled by the first ECU 31 and the second ECU 32 of this embodiment will be described with reference to Figures 3 to 12. When the driver depresses the brake pedal 91, each of the first sensor 21 to the fourth sensor 24 detects the amount of operation of the brake pedal 91, generates a detection signal according to the detected amount of operation, and outputs the detection signal to the first ECU 31 and the second ECU 32 to which the sensor is connected.

[0036] Specifically, the first sensor 21 outputs a detection signal corresponding to the detected amount of operation of the brake pedal 91 to the first ECU receiving unit 311 of the first ECU 31. The second sensor 22 outputs a detection signal corresponding to the detected amount of operation of the brake pedal 91 to the first ECU receiving unit 311 of the first ECU 31. The third sensor 23 outputs a detection signal corresponding to the detected amount of operation of the brake pedal 91 to the second ECU receiving unit 321 of the second ECU 32. The fourth sensor 24 outputs a detection signal corresponding to the detected amount of operation of the brake pedal 91 to the first ECU receiving unit 311 of the first ECU 31 and the second ECU receiving unit 321 of the second ECU 32.

[0037] When detection signals corresponding to the operation amount of the brake pedal 91 are input from the first sensor 21 to the fourth sensor 24, the first ECU 31 and the second ECU 32 calculate a target deceleration of the vehicle in a target deceleration determination process described below based on the input detection signals. Then, the first ECU 31 and the second ECU 32 output information on the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12, thereby controlling the first brake circuit 11 and the second brake circuit 12.

[0038] When information on the target deceleration is input, the first brake circuit 11 generates brake fluid pressure corresponding to the target deceleration in the left front wheel cylinder W1 and the right front wheel cylinder W2. When information on the target deceleration is input, the second brake circuit 12 generates brake fluid pressure corresponding to the target deceleration in the left rear wheel cylinder W3 and the right rear wheel cylinder W4. In this way, the brake system 1 generates braking forces for decelerating the vehicle in the left front wheel, right front wheel, left rear wheel, and right rear wheel.

[0039] Next, the target deceleration determination process will be described. The first ECU 31 and the second ECU 32 start the control process when, for example, a running switch such as an ignition switch or a power switch of the vehicle is turned on. Then, when the first ECU 31 receives detection signals transmitted by the first sensor 21, the second sensor 22, and the fourth sensor 24, the first ECU 31 repeatedly executes the control process shown in FIG. 3 and FIG. 4 at predetermined control intervals in the target deceleration determination process. Also, when the second ECU 32 receives detection signals transmitted by the second sensor 22 and the fourth sensor 24, the second ECU 32 repeatedly executes the control process shown in FIG. 10 and FIG. 11 at predetermined control intervals in the target deceleration determination process. Hereinafter, the detection signal transmitted by the first sensor 21 is also called the first signal S1, the detection signal transmitted by the second sensor 22 is also called the second signal S2, the detection signal transmitted by the third sensor 23 is also called the third signal S3, and the detection signal transmitted by the fourth sensor 24 is also called the fourth signal S4.

[0040] Incidentally, in the brake system 1 of this embodiment, the ECU 30 is configured to include the first ECU 31 and the second ECU 32, thereby ensuring redundancy as a system. That is, the brake system 1 of this embodiment is configured so that the first ECU 31 can calculate the target deceleration, and the second ECU 32 can calculate the target deceleration. Therefore, for example, when the first ECU 31 fails and the target deceleration cannot be calculated, the second ECU 32 can calculate the target deceleration. However, the first ECU 31 and the second ECU 32 are set such that the first ECU 31, which has a larger number of sensors connected thereto, is set as the main control device, and the second ECU 32 is set as the backup control device. Therefore, when both the first ECU 31 and the second ECU 32 can normally calculate the target deceleration, the first ECU 31 holds the control initiative of the brake system 1, and the target deceleration is calculated by the first ECU 31.

[0041] First, a description will be given of the control process executed by the first ECU 31. First, in step S10, the first ECU 31 determines whether its own operating state is normal or abnormal. The normal state is a state in which the first ECU 31 can normally receive the first signal S1, the second signal S2, and the fourth signal S4, and can normally supply power to the first sensor 21 and the second sensor 22.

[0042] The normal state is a state in which the first ECU processing unit 312 can perform normal processing operations based on the first signal S1, the second signal S2, and the fourth signal S4 when the first ECU processing unit 312 receives the first signal S1, the second signal S2, and the fourth signal S4. On the other hand, the abnormal state is a state in which the first signal S1, the second signal S2, and the fourth signal S4 cannot be received, power cannot be supplied to the first sensor 21 and the second sensor 22, and the first ECU processing unit 312 cannot operate normally, or a combination of these. In step S11, the first ECU 31 outputs information on its own determined operating state to the second ECU 32. In step S12, the first ECU 31 obtains information on the operating state of the second ECU 32 from the second ECU 32, which is determined in the control processing of the second ECU 32, which will be described later.

[0043] When the first ECU 31 is in a normal state, in step S13, the first ECU 31 acquires the first signal S1 transmitted from the first sensor 21, the second signal S2 transmitted from the second sensor 22, and the fourth signal S4 transmitted from the fourth sensor 24. Although not shown, when the first ECU 31 is in an abnormal state, all the processes after step S13 are skipped.

[0044] When the first ECU 31 acquires the first signal S1, the second signal S2, and the fourth signal S4, in step S14, the first ECU processing unit 312 calculates the operation amount of the brake pedal 91 based on the first signal S1, the second signal S2, and the fourth signal S4, respectively. Specifically, when the first ECU processing unit 312 acquires the first signal S1, it calculates the operation amount of the brake pedal 91 detected by the first sensor 21 based on the first signal S1 and a predetermined control map. When the first ECU processing unit 312 acquires the second signal S2, it calculates the operation amount of the brake pedal 91 detected by the second sensor 22 based on the second signal S2 and a predetermined control map. Furthermore, when the first ECU processing unit 312 acquires the fourth signal S4, it calculates the operation amount of the brake pedal 91 detected by the fourth sensor 24 based on the fourth signal S4 and a predetermined control map.

[0045] Hereinafter, the operation amount of the brake pedal 91 calculated based on the first signal S1 is also referred to as a first operation amount Fs1, and the operation amount of the brake pedal 91 calculated based on the second signal S2 is also referred to as a second operation amount Fs2. Also, the operation amount of the brake pedal 91 calculated based on the fourth signal S4 is also referred to as a fourth operation amount Fs4. And, as described later, the operation amount of the brake pedal 91 calculated by the second ECU 32 based on the third signal S3 is also referred to as a third operation amount Fs3.

[0046] In step S15, the first ECU processing unit 312 determines whether or not the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 include a malfunction, based on the calculated first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4. That is, the first ECU processing unit 312 detects whether all of the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 are in a normal state, and whether one or more sensors are in an abnormal state. Furthermore, when there is one sensor in an abnormal state, the first ECU processing unit 312 detects one sensor in an abnormal state, and when there are more than one sensor in an abnormal state, detects a sensor that may be in an abnormal state.

[0047] Specifically, in step S15, the first ECU processing unit 312 judges whether the first operation amount Fs1 and the second operation amount Fs2 are normal or abnormal, and judges whether a first difference value Δs1, which is a difference value between the first operation amount Fs1 and the second operation amount Fs2, is smaller than an allowable error. The first operation amount Fs1 and the second operation amount Fs2 are judged to be normal, for example, when they are equal to or larger than a minimum value of the operation amount assumed in advance and equal to or smaller than a maximum value of the assumed amount assumed in advance. In contrast, the first operation amount Fs1 and the second operation amount Fs2 are judged to be abnormal, for example, when they are smaller than a minimum value of the operation amount assumed in advance or larger than a maximum value of the assumed amount assumed in advance. It is to be noted that the third operation amount Fs3 and the fourth operation amount Fs4 described later are also judged to be normal or abnormal.

[0048] The first difference value Δs1 is a value obtained by subtracting the second operation amount Fs2 from the first operation amount Fs1, and is calculated as an absolute value. The allowable error of the first difference value Δs1 is determined, for example, within a range in which the detection error of the first sensor 21 itself and the detection error of the second sensor 22 itself overlap.

[0049] In addition, the second difference value Δs2, which is a difference value between the first operation amount Fs1 and the fourth operation amount Fs4, and the third difference value Δs3, which is a difference value between the second operation amount Fs2 and the fourth operation amount Fs4, which will be described later, are also obtained by the same calculation method. The fourth difference value Δs4, which is a difference value between the third operation amount Fs3 and the fourth operation amount Fs4, is also obtained by the same calculation method. In addition, the allowable error of the second difference value Δs2 is determined, for example, in a range where the detection error of the first sensor 21 itself and the detection error of the fourth sensor 24 itself overlap. The allowable error of the third difference value Δs3 is determined, for example, by the detection errors of the second sensor 22 and the fourth sensor 24 themselves. The allowable error of the fourth difference value Δs4 is determined, for example, in a range where the detection error of the third sensor 23 itself and the detection error of the fourth sensor 24 itself overlap.

[0050] If the first operation amount Fs1 is not abnormal, the second operation amount Fs2 is not abnormal, and the first difference value Δs1 is smaller than the allowable error, the first ECU processing unit 312 sets the first difference flag, which indicates whether the first difference value Δs1 is normal or abnormal, to normal in step S16. On the other hand, if at least one of the following applies: the first operation amount Fs1 is abnormal, the second operation amount Fs2 is abnormal, and the first difference value Δs1 is equal to or larger than the allowable error, the first ECU processing unit 312 sets the first difference flag to abnormal in step S17.

[0051] Subsequently, in step S18, the first ECU processing unit 312 determines whether the first operation input Fs1 and the fourth operation input Fs4 are normal or abnormal, and determines whether the second difference value Δs2 is smaller than the allowable error.

[0052] If the first operation amount Fs1 is not abnormal, the fourth operation amount Fs4 is not abnormal, and the second difference value Δs2 is smaller than the allowable error, the first ECU processing unit 312 sets the second difference flag, which indicates whether the second difference value Δs2 is normal or abnormal, to normal in step S19. On the other hand, if at least one of the following applies: the first operation amount Fs1 is abnormal, the fourth operation amount Fs4 is in an abnormal state, and the second difference value Δs2 is equal to or larger than the allowable error, the first ECU processing unit 312 sets the second difference flag to abnormal in step S20.

[0053] Subsequently, in step S21, the first ECU processing unit 312 determines whether the second operation input Fs2 and the fourth operation input Fs4 are normal or abnormal, and determines whether the third difference value Δs3 is smaller than the allowable error.

[0054] If the second operation amount Fs2 is not abnormal, the fourth operation amount Fs4 is not abnormal, and the third difference value Δs3 is smaller than the allowable error, the first ECU processing unit 312 sets the third difference flag, which indicates whether the third difference value Δs3 is normal or abnormal, to normal in step S22. On the other hand, if at least one of the following applies: the second operation amount Fs2 is abnormal, the fourth operation amount Fs4 is abnormal, and the third difference value Δs3 is equal to or larger than the allowable error, the first ECU processing unit 312 sets the third difference flag to abnormal in step S23.

[0055] The respective allowable errors for determining whether the first difference value Δs1, the second difference value Δs2, and the third difference value Δs3 are smaller than the allowable error may be different from each other or may be the same. For example, the allowable error for determining whether the first difference value Δs1 is smaller than the allowable error and the allowable error for determining whether the second difference value Δs2 is smaller than the allowable error may be different from each other or may be the same. Also, the allowable error for determining whether the second difference value Δs2 is smaller than the allowable error and the allowable error for determining whether the third difference value Δs3 is smaller than the allowable error may be different from each other or may be the same.

[0056] After updating the states of the first difference flag, the second difference flag, and the third difference flag in steps S10 to S23, the first ECU processing unit 312 performs majority decision processing. The majority decision processing is processing for determining whether or not the first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4 can be used to calculate the target deceleration. In other words, the majority decision processing is processing for determining whether or not it can be confirmed that a sensor in a normal state exists among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31.

[0057] Specifically, in step S30, it is determined whether the first difference flag, the second difference flag, and the third difference flag are normal. Here, FIG. 5 shows an example in which the first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4 are relatively close to each other, and the first difference flag, the second difference flag, and the third difference flag are all normal. The horizontal axis in FIG. 5 indicates the first sensor 21, the second sensor 22, and the fourth sensor 24, respectively. The vertical axis indicates the operation amount of the brake pedal 91 calculated based on the detection signals transmitted from the first sensor 21, the second sensor 22, and the fourth sensor 24, respectively. The vertical and horizontal axes indicate the same in FIG. 6 to FIG. 8, which will be referred to in the following description.

[0058] In this embodiment, the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 are configured by combining three sensors that detect the operation amount of the brake pedal 91 using different detection methods. Therefore, the possibility that the three first sensor 21, the second sensor 22, and the fourth sensor 24, which have different detection methods from each other, will simultaneously fail due to an external factor is relatively low.

[0059] Therefore, when the first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4 are relatively close or substantially similar values ​​and the first difference flag, the second difference flag, and the third difference flag are all normal, it is highly likely that the first sensor 21, the second sensor 22, and the fourth sensor 24 are not malfunctioning. That is, it is highly likely that the first sensor 21, the second sensor 22, and the fourth sensor 24 are in a normal state. And, it is highly likely that the first operation amount Fs1, the second operation amount Fs2, and the third operation amount Fs3 calculated based on the detection signals transmitted from the first sensor 21, the second sensor 22, and the fourth sensor 24 in the normal state are normal values.

[0060] Therefore, in step S30, when the first difference flag, the second difference flag, and the third difference flag are all normal, the first ECU processing unit 312 determines that the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 are all normal. That is, the first ECU processing unit 312 determines that a sensor in a normal state exists among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31, and identifies the sensor in a normal state. Then, in step S31, the first ECU processing unit 312 sets the majority flag indicating the majority decision processing result to normal, indicating that all connected sensors are normal, and transmits information that the majority flag is normal to the second ECU 32.

[0061] Then, in step S32, the first ECU processing unit 312 determines the operation amount of the brake pedal 91, which is the brake control command value, based on the detection signal transmitted from a sensor determined to be in a normal state among the first sensor 21, the second sensor 22, and the fourth sensor 24. In this embodiment, when there are multiple sensors determined to be normal, the operation amount of the brake pedal 91 is determined based on the detection signal transmitted from the sensor with the highest predetermined priority among the multiple sensors determined to be normal. For example, the priority in this embodiment is the first sensor 21, the second sensor 22, and the fourth sensor 24 in order of assumed high detection accuracy among the first sensor 21, the second sensor 22, and the fourth sensor 24, which detect the operation amount of the brake pedal 91 by different detection methods.

[0062] Therefore, when the majority flag is determined to be normal in step S31, in step S32, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 to be the first operation amount Fs1 calculated based on the operation amount detected by the first sensor 21. Then, the first ECU processing unit 312 calculates a target deceleration of the vehicle based on the first operation amount Fs1, which is the determined operation amount of the brake pedal 91, and a predetermined control map.

[0063] The priority for determining the amount of operation of the brake pedal 91 is not limited to this order, and may be determined in an order different from the order of the first sensor 21, the second sensor 22, and the fourth sensor 24, for example, the second sensor 22, the fourth sensor 24, and the first sensor 21. The priority for determining the amount of operation of the brake pedal 91 may also be determined in the order of the fourth sensor 24, the first sensor 21, and the second sensor 22, or the first sensor 21, the fourth sensor 24, and the second sensor 22, etc.

[0064] In addition, the priority for determining the amount of operation of the brake pedal 91 may be set in an order other than the order in which detection accuracy is assumed to be high, for example, in the order in which failure frequency is assumed to be low, or in the order in which it is least susceptible to influences from the external environment, etc.

[0065] The operation amount of the brake pedal 91 may be determined by a method other than the priority of the sensors. For example, the operation amount of the brake pedal 91 may be determined to be the maximum value or the minimum value among the operation amounts calculated based on the detection signals transmitted from the sensors determined to be in the normal state. Furthermore, when the first sensor 21, the second sensor 22, and the fourth sensor 24 are all in the normal state, the operation amount of the brake pedal 91 may be determined to be a value other than the maximum value and the minimum value among the operation amounts calculated from the detection signals transmitted from all the sensors.

[0066] For example, the operation amount of the brake pedal 91 may be determined based on the detection signals transmitted from each of the sensors determined to be in the normal state and a predetermined function. As an example of using a function, the operation amount of the brake pedal 91 may be determined to be an average value of the operation amounts calculated based on the detection signals transmitted from each of the sensors determined to be in the normal state. Furthermore, the operation amount of the brake pedal 91 may be determined based on the operation amount detected by a sensor other than the sensor that detects the maximum and minimum values, among the operation amounts calculated based on the detection signals transmitted from each of the sensors determined to be in the normal state.

[0067] In addition, in the first ECU 31 and the second ECU 32 of this embodiment, the first ECU 31, which has a larger number of sensors connected thereto, is set as a main control device, and the second ECU 32 is set as a backup control device. Therefore, when the target deceleration of the vehicle can be calculated on the first ECU 31 side, the target deceleration of the vehicle is set to the target deceleration calculated by the first ECU 31. Then, the first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. Also, the second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. Then, the first ECU 31 controls the first brake circuit 11 and the second brake circuit 12 by outputting information on the target deceleration calculated in step S32 to the first brake circuit 11 and the second brake circuit 12.

[0068] When it is determined in step S30 that all of the first difference flag, the second difference flag, and the third difference flag are not normal, the first ECU processing unit 312 executes the process of step S33.

[0069] In step S33, the first ECU processing unit 312 determines whether the first difference flag is abnormal, the second difference flag is abnormal, and the third difference flag is normal. Here, FIG. 6 shows an example in which the second operation amount Fs2 and the fourth operation amount Fs4 are relatively close to each other and the third difference value Δs3 is smaller than the allowable error. In the example shown in FIG. 6, the value of the first operation amount Fs1 is relatively far from the values ​​of the second operation amount Fs2 and the fourth operation amount Fs4, and the first difference value Δs1 and the second difference value Δs2 are equal to or larger than the allowable error. In such a case, the first difference flag and the second difference flag are abnormal, and the third difference flag is normal.

[0070] In addition, when two of the three operation amounts are relatively close or substantially similar values ​​and the remaining operation amount is significantly different from the two operation amounts, it is highly likely that one of the first sensor 21, the second sensor 22, and the fourth sensor 24 is malfunctioning. In addition, it is highly likely that the two sensors are not malfunctioning. That is, it is highly likely that two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in a normal state, and that the operation amounts of the brake pedal 91 calculated based on the detection signals transmitted from these two sensors in the normal state are normal values. In contrast, it is highly likely that the remaining sensor is in an abnormal state, and that the operation amount of the brake pedal 91 calculated based on the detection signals transmitted from this remaining sensor in the abnormal state is an abnormal value.

[0071] Therefore, when two of the first difference flag, the second difference flag, and the third difference flag are abnormal, the first ECU processing unit 312 determines that one of the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 is in an abnormal state. Specifically, the first ECU processing unit 312 determines that the sensor that detected the common operation amount used to calculate the two abnormal difference flags is in an abnormal state. Then, the first ECU processing unit 312 determines that the sensor that was not determined to be in an abnormal state is in a normal state.

[0072] That is, the first ECU processing unit 312 determines that a sensor in a normal state is present among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31, and identifies the sensor in a normal state. For example, in the example shown in Fig. 6, the first ECU processing unit 312 determines that the first sensor 21 that detected the first operation amount Fs1 used to calculate the first difference flag and the second difference flag that are abnormal is in an abnormal state. In addition, the first ECU processing unit 312 determines that the second sensor 22 and the fourth sensor 24 are in a normal state.

[0073] Then, in step S 34 , the majority flag is set to first sensor abnormality indicating that the first sensor 21 is in an abnormal state, and information indicating that the majority flag indicates first sensor abnormality is transmitted to the second ECU 32 .

[0074] Then, in step S35, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 based on the detection signals transmitted from the second sensor 22 and the fourth sensor 24 that are determined to be in the normal state among the first sensor 21, the second sensor 22, and the fourth sensor 24. Specifically, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 to be the second operation amount Fs2 based on a predetermined priority.

[0075] The first ECU processing unit 312 then calculates a target deceleration of the vehicle based on the second operation amount Fs2, which is the determined operation amount of the brake pedal 91, and a predetermined control map. The first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. The second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. The first ECU 31 then controls the first brake circuit 11 and the second brake circuit 12 by outputting information on the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0076] Furthermore, if it is not determined in step S33 that the first difference flag is abnormal, the second difference flag is abnormal, and the third difference flag is normal, the first ECU processing unit 312 executes the process of step S36.

[0077] In step S36, the first ECU processing unit 312 determines whether the first difference flag is abnormal, the third difference flag is abnormal, and the second difference flag is normal. If the first difference flag is abnormal, the third difference flag is abnormal, and the second difference flag is normal, the first ECU processing unit 312 determines that the second sensor 22 that detected the second operation amount Fs2 used to calculate the first difference flag and the third difference flag is in an abnormal state. The first ECU processing unit 312 also determines that the first sensor 21 and the fourth sensor 24 are in a normal state.

[0078] That is, the first ECU processing unit 312 determines that any of the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 is in a normal state, and identifies the sensor in a normal state.

[0079] Then, in step S37, the majority flag indicating majority decision processing is set to second sensor abnormality indicating that the second sensor 22 is in an abnormal state, and information indicating that the majority flag indicates second sensor abnormality is transmitted to the second ECU 32.

[0080] Then, in step S38, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 based on the detection signals transmitted from the first sensor 21 and the fourth sensor 24 that are determined to be in the normal state among the first sensor 21, the second sensor 22, and the fourth sensor 24. Specifically, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 to be the first operation amount Fs1 based on a predetermined priority.

[0081] The first ECU processing unit 312 then calculates a target deceleration of the vehicle based on a first operation amount Fs1, which is the determined operation amount of the brake pedal 91, and a predetermined control map. The first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. The second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. The first ECU 31 then controls the first brake circuit 11 and the second brake circuit 12 by outputting information on the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0082] Furthermore, if it is not determined in step S36 that the first difference flag is abnormal, the third difference flag is abnormal, and the second difference flag is normal, the first ECU processing unit 312 executes the process of step S39.

[0083] In step S39, the first ECU processing unit 312 determines whether the second difference flag is abnormal, the third difference flag is abnormal, and the first difference flag is normal. If the second difference flag is abnormal, the third difference flag is abnormal, and the first difference flag is normal, the first ECU processing unit 312 determines that the fourth sensor 24 that detected the fourth operation amount Fs4 used to calculate the second difference flag and the third difference flag is in an abnormal state. The first ECU processing unit 312 also determines that the first sensor 21 and the second sensor 22 are in a normal state.

[0084] That is, the first ECU processing unit 312 determines that any of the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 is in a normal state, and identifies the sensor in a normal state.

[0085] Then, in step S40, the majority flag is set to fourth sensor abnormality, which indicates that the fourth sensor 24 is in an abnormal state, and information indicating that the majority flag is fourth sensor abnormality is transmitted to the second ECU 32.

[0086] Then, in step S41, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 based on the detection signals transmitted from the first sensor 21 and the second sensor 22 that are determined to be in a normal state among the first sensor 21, the second sensor 22, and the fourth sensor 24. Specifically, the first ECU processing unit 312 determines the operation amount of the brake pedal 91 to be the first operation amount Fs1 based on a predetermined priority.

[0087] The first ECU processing unit 312 then calculates a target deceleration of the vehicle based on a first operation amount Fs1, which is the determined operation amount of the brake pedal 91, and a predetermined control map. The first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. The second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. The first ECU 31 then controls the first brake circuit 11 and the second brake circuit 12 by outputting information on the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0088] Furthermore, if it is not determined in step S39 that the second difference flag is abnormal, the third difference flag is abnormal, and the first difference flag is normal, the first ECU processing unit 312 executes the process of step S42. The process of step S42 is executed when all three difference flags of the first difference flag, the second difference flag, and the third difference flag are abnormal, or when any two difference flags are abnormal.

[0089] An example of a case where the first operation input Fs1, the second operation input Fs2, and the fourth operation input Fs4 are relatively significantly different from one another and the first difference value Δs1, the second difference value Δs2, and the third difference value Δs3 are all equal to or greater than the allowable error is shown in Fig. 7. In such a case, the first difference flag, the second difference flag, and the third difference flag all become abnormal.

[0090] When the three manipulated variables are significantly different from each other, there is a high possibility that all or any two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are malfunctioning. That is, there is a high possibility that all or any two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state.

[0091] If all of the first sensor 21, the second sensor 22 and the fourth sensor 24 are in an abnormal state, the amount of operation of the brake pedal 91 calculated based on the detection signals transmitted from these three sensors in an abnormal state is likely to be an abnormal value.

[0092] Furthermore, when two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, the operation amount of the brake pedal 91 calculated based on the detection signal transmitted from the one sensor in a normal state is likely to be a normal value. However, when the values ​​of the first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4 are relatively significantly different from each other, it is not possible to identify the sensor in a normal state by only comparing the first operation amount Fs1, the second operation amount Fs2, and the fourth operation amount Fs4.

[0093] Therefore, when all of the first difference flag, the second difference flag, and the third difference flag are abnormal, the first ECU processing unit 312 determines that multiple sensors among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 are in an abnormal state. In other words, the first ECU processing unit 312 does not determine that any sensor in a normal state exists among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31, and does not identify a sensor in a normal state.

[0094] Then, in step S42, the first ECU processing unit 312 sets the majority flag to majority failure, which indicates that a normal sensor cannot be identified, and transmits information indicating that the majority flag is majority failure to the second ECU 32. Then, the first ECU processing unit 312 ends the processing without determining the operation amount of the brake pedal 91. In other words, the first ECU processing unit 312 does not output information on the target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0095] 8 shows an example in which the second operation input Fs2 is relatively close to the first operation input Fs1 and the fourth operation input Fs4, and the first difference value Δs1 and the third difference value Δs3 are smaller than the allowable error. In the example shown in FIG. 8, the value of the first operation input Fs1 is relatively far from the value of the fourth operation input Fs4, and the first difference value Δs1 is equal to or larger than the allowable error. In such a case, the first difference flag and the third difference flag are normal, and the second difference flag is abnormal.

[0096] In this manner, when two of the three difference flags are normal and the remaining difference flag is abnormal, there is a high possibility that one or two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are malfunctioning. In other words, there is a high possibility that one or two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, and the operation amount of the brake pedal 91 calculated based on the detection signals transmitted from the two sensors in the abnormal state is an abnormal value.

[0097] However, even if the operation amounts of the brake pedal 91 calculated based on the detection signals of the first sensor 21, the second sensor 22, and the fourth sensor 24 are compared, it is not possible to identify the number of sensors in an abnormal state or the sensors in an abnormal state.

[0098] Therefore, when two of the three difference flags are normal and the remaining difference flag is abnormal, the first ECU processing unit 312 determines that one or more of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state. In other words, the first ECU processing unit 312 does not determine that any sensor in a normal state exists among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31, and does not identify a sensor in a normal state.

[0099] Therefore, in step S42, the first ECU processing unit 312 sets the majority flag to majority failure and transmits information that the majority flag is majority failure to the second ECU 32. Then, the first ECU processing unit 312 ends the processing without determining the operation amount of the brake pedal 91. In other words, the first ECU processing unit 312 does not output information on the target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0100] As described above, in the majority decision process executed in steps S30 to S42, the operation amount of the brake pedal 91 is determined as shown in the table in Fig. 9. Basically, in the brake system 1 of this embodiment, when a sensor in a normal state can be identified by the first ECU 31 set on the main side, the operation amount of the brake pedal 91 is determined based on the detection signal of the sensor with the highest priority among the sensors in a normal state. In other words, when the majority decision process does not result in a failure of the majority decision, the target deceleration can be calculated regardless of whether the second ECU 32 is in a normal state or an abnormal state.

[0101] However, if the majority decision process of the first ECU 31 determines that the majority decision has failed and it is not possible to identify a sensor that is in a normal state, the first ECU 31 cannot determine the operation amount of the brake pedal 91. Therefore, when the second ECU 32 is in a normal state, the operation amount of the brake pedal 91 is determined by the control process executed by the second ECU 32.

[0102] Next, the control process executed by the second ECU 32 will be described with reference to Figures 10 and 11. First, in step S50, the second ECU 32 determines whether its own operating state is normal or abnormal. The normal state is a state in which the second ECU 32 can normally receive the third signal S3 and the fourth signal S4 and can normally supply power to the third sensor 23 and the fourth sensor 24.

[0103] The normal state is a state in which the second ECU processing unit 322 can execute normal processing operations based on the third signal S3 and the fourth signal S4 when the third signal S3 and the fourth signal S4 are received. In contrast, the abnormal state is a state in which the third signal S3 and the fourth signal S4 cannot be received, power cannot be supplied to the third sensor 23 and the fourth sensor 24, and the second ECU processing unit 322 cannot execute normal processing operations. In step S51, the second ECU 32 outputs information on its own determined operating state to the first ECU 31. In step S52, the second ECU 32 acquires information on the operating state of the first ECU 31 determined in the processing of step S11 of the first ECU 31 from the first ECU 31.

[0104] In step S53, the second ECU 32 obtains information on the majority flag set in the majority decision process of the first ECU 31.

[0105] When the second ECU 32 is in a normal state, in step S54, the second ECU 32 acquires the third signal S3 transmitted from the third sensor 23 and the fourth signal S4 transmitted from the fourth sensor 24. Although not shown, when the second ECU 32 is in an abnormal state, all the processes after step S54 are skipped.

[0106] In step S54, when the second ECU 32 acquires the third signal S3 and the fourth signal S4, the second ECU processing unit 322 calculates the operation amount of the brake pedal 91 based on the third signal S3 and the fourth signal S4, respectively. Specifically, when the second ECU processing unit 322 acquires the third signal S3, it calculates a third operation amount Fs3 based on the third signal S3 and a predetermined control map. Furthermore, when the second ECU processing unit 322 acquires the fourth signal S4, it calculates a fourth operation amount Fs4 based on the fourth signal S4 and a predetermined control map. The fourth operation amount Fs4 calculated by the second ECU processing unit 322 in step S54 is equal to the fourth operation amount Fs4 calculated by the first ECU processing unit 312 in step S14.

[0107] In step S55, the second ECU processing unit 322 performs a sensor abnormality determination process in the second ECU 32 based on the calculated third operation amount Fs3 and fourth operation amount Fs4. The sensor abnormality determination in the second ECU 32 is executed to determine whether both the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 are in a normal state and whether at least one of them is in an abnormal state.

[0108] Specifically, in step S55, the second ECU processing unit 322 determines whether the third operating amount Fs3 and the fourth operating amount Fs4 are normal or abnormal, and also determines whether the fourth difference value Δs4, which is the difference value between the fourth operating amount Fs3 and the fourth operating amount Fs4, is smaller than the allowable error.

[0109] In this embodiment, the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 are configured by combining two sensors that use different detection methods to detect the operation amount of the brake pedal 91. Therefore, the third sensor 23 and the fourth sensor 24, which use different detection methods, are less likely to simultaneously fail due to an external factor.

[0110] For this reason, when the third operation amount Fs3 and the fourth operation amount Fs4 are relatively close or substantially similar values ​​and the fourth difference value Δs4 is smaller than the allowable error, it is highly likely that the third sensor 23 and the fourth sensor 24 are not malfunctioning. In other words, it is highly likely that the third sensor 23 and the fourth sensor 24 are in a normal state and that the operation amounts of the two brake pedals 91 calculated based on the detection signals transmitted from the third sensor 23 and the fourth sensor 24 in the normal state are normal values.

[0111] Therefore, when the third operation amount Fs3 and the fourth operation amount Fs4 are normal and the fourth difference value Δs4 is smaller than the allowable error, the second ECU processing unit 322 determines that both the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 are in a normal state. That is, the second ECU processing unit 322 determines that a sensor in a normal state is present among the third sensor 23 and the fourth sensor 24 connected to the second ECU 32, and identifies the sensor in a normal state.

[0112] In contrast, when the value of the third operation amount Fs3 and the value of the fourth operation amount Fs4 deviate relatively greatly from each other and the fourth difference value Δs4 is equal to or greater than the allowable error, there is a high possibility that at least one of the third sensor 23 and the fourth sensor 24 is malfunctioning. That is, there is a high possibility that at least one of the third sensor 23 and the fourth sensor 24 is in an abnormal state and at least one of the operation amounts of the two brake pedals 91 calculated based on the detection signals transmitted from the third sensor 23 and the fourth sensor 24 is an abnormal value.

[0113] Furthermore, when the fourth difference value Δs4 is equal to or larger than the allowable error, there is a possibility that both of the third sensor 23 and the fourth sensor 24 are malfunctioning. Then, there is a possibility that both of the operation amounts of the brake pedal 91 calculated based on the detection signals transmitted from the third sensor 23 and the fourth sensor 24 are abnormal values.

[0114] Therefore, when the third operation amount Fs3 and the fourth operation amount Fs4 are abnormal or the fourth difference value Δs4 is equal to or greater than the allowable error, the second ECU processing unit 322 determines that at least one of the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 is in an abnormal state. In other words, the second ECU processing unit 322 does not determine that any sensor in a normal state is present among the third sensor 23 and the fourth sensor 24 connected to the second ECU 32, and does not identify a sensor in a normal state.

[0115] Therefore, if the third operation amount Fs3 and the fourth operation amount Fs4 are not abnormal and the fourth difference value Δs4 is smaller than the allowable error, in step S56, the second ECU processing unit 322 sets the fourth difference flag, which indicates that the third sensor 23 and the fourth sensor 24 are normal, to normal. Then, the second ECU processing unit 322 executes the process of step S58.

[0116] On the other hand, if it is not determined that the third operation amount Fs3 is not abnormal, the fourth operation amount Fs4 is not abnormal, and the fourth difference value Δs4 is not smaller than the allowable error, the second ECU processing unit 322 sets the fourth difference flag to abnormal in step S57. Then, the second ECU processing unit 322 skips the processes of steps S58 and S59.

[0117] In addition, the magnitude of the allowable error used by the first ECU 31 when performing the majority decision process and the magnitude of the allowable error used by the second ECU 32 when performing the sensor abnormality determination process may be different from each other or may be the same.

[0118] In step S58, the second ECU processing unit 322 determines whether or not the fourth sensor 24 has been determined to be in an abnormal state or has been determined to possibly be in an abnormal state, based on the information of the majority flag transmitted from the first ECU 31. The process of step S58 is executed to determine whether or not the fourth sensor 24 was in a normal state in the majority decision process executed by the first ECU 31 before the point in time when step S58 is executed.

[0119] The second ECU processing unit 322 executes the process of step S59 when it determines that the information of the majority flag transmitted from the first ECU 31 is not the fourth sensor abnormality and is not a majority failure. In other words, when it determines that the information of the majority flag transmitted from the first ECU 31 is normal, the first sensor abnormality, or the second sensor abnormality, it executes the process of step S59.

[0120] In step S59, the second ECU processing unit 322 turns on a normal experience flag indicating that the fourth sensor 24 has been determined to be in a normal state in the majority decision process of the first ECU 31 executed after the ignition switch of the vehicle is turned on. The normal experience flag is a flag for determining whether the state of the fourth sensor 24 after the ignition switch of the vehicle is turned on was a normal state or an abnormal state.

[0121] Then, if the fourth sensor 24 is in a normal state in the majority decision process of the first ECU 31 executed after the ignition switch of the vehicle is turned on, the normal experience flag maintains the on state until the ignition switch is turned off. In other words, the normal experience flag maintains the on state when it is confirmed by the majority decision process of the first ECU 31 that the state of the fourth sensor 24 was in a normal state after the ignition switch of the vehicle is turned on.

[0122] The determination process of step S58 is executed when both the third sensor 23 and the fourth sensor 24 are determined to be in a normal state in the determination process of step S55. Therefore, the normal experience flag indicates that not only the state of the fourth sensor 24 was in a normal state after the ignition switch of the vehicle was turned on, but also the state of the third sensor 23 was in a normal state.

[0123] Although not shown, the normal experience flag is a flag whose initial value is set to off when the ignition switch of the vehicle is turned on. Therefore, if either the third sensor 23 or the fourth sensor 24 is in an abnormal state when the ignition switch of the vehicle is turned on, a negative determination is made in step S55, and the normal experience flag is maintained in the off state until the ignition switch is turned off. Also, if it is not determined that the fourth sensor 24 was in a normal state in the majority decision process of the first ECU 31 executed after the ignition switch of the vehicle is turned on, the normal experience flag is maintained in the off state until the ignition switch is turned off.

[0124] In step S60, the second ECU processing unit 322 determines whether or not the first ECU 31 is in a normal state based on the information on the operation state of the first ECU 31 transmitted from the first ECU 31. In addition, in step S61, the second ECU processing unit 322 determines whether the information on the majority flag transmitted from the first ECU 31 indicates a majority failure.

[0125] When the first ECU 31 is in a normal state and the majority flag information is determined not to be a majority failure, the target deceleration of the vehicle is calculated by the first ECU 31. This is because the first ECU 31 can receive normal detection signals from at least two of the first sensor 21, the second sensor 22, and the fourth sensor 24 that are in a normal state. Therefore, the first ECU 31 can calculate the operation amount of the brake pedal 91 based on the detection signals from the sensors in the normal state. Therefore, when a negative determination is not made in steps S60 and S61, the second ECU processing unit 322 ends the process without determining the operation amount of the brake pedal 91. That is, the second ECU processing unit 322 does not output information on the target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0126] On the other hand, if the first ECU 31 is not determined to be in a normal state and the majority flag information is not determined to be a majority failure, the first ECU 31 cannot calculate the target deceleration of the vehicle. This is because the first ECU 31 cannot identify a sensor in the first sensor 21, the second sensor 22, and the fourth sensor 24 that is in a normal state. In this case, the first ECU 31 cannot calculate the operation amount of the brake pedal 91 based on the detection signals from the first sensor 21, the second sensor 22, and the fourth sensor 24. Therefore, if a negative determination is made in step S60 or step S61, the control initiative is transferred from the first ECU 31 to the second ECU 32. Then, the second ECU processing unit 322 executes the following process shown in FIG. 11.

[0127] In step S70, the second ECU processing unit 322 determines whether the fourth difference flag is normal. That is, in step S70, the second ECU processing unit 322 determines whether both the third sensor 23 and the fourth sensor 24 are in a normal state. When it is determined in step S71 that the fourth difference flag is normal, the second ECU processing unit 322 determines the operation amount of the brake pedal 91 based on the detection signals transmitted from the third sensor 23 and the fourth sensor 24. In this embodiment, the third sensor 23 is set to have a higher priority than the fourth sensor 24. Therefore, the second ECU processing unit 322 determines the operation amount of the brake pedal 91 to be the third operation amount Fs3 based on the detection signal transmitted from the third sensor 23, which has a higher priority than the fourth sensor 24.

[0128] The third sensor 23 may be set to have a lower priority than the fourth sensor 24. In this case, the second ECU processing unit 322 determines the operation amount of the brake pedal 91 to be the fourth operation amount Fs4, based on the detection signal transmitted from the fourth sensor 24.

[0129] The second ECU processing unit 322 then calculates a target deceleration of the vehicle based on a third operation amount Fs3, which is the determined operation amount of the brake pedal 91, and a predetermined control map. The second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. The first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. The second ECU 32 controls the first brake circuit 11 and the second brake circuit 12 by outputting information of the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0130] On the other hand, if it is determined in step S70 that the fourth difference flag is not normal, the second ECU processing unit 322 determines in step S72 whether or not the normal experience flag is on.

[0131] When it is determined in step S72 that the normal experience flag is on, in step S73, the second ECU processing unit 322 determines the operation amount of the brake pedal 91 based on the detection signal transmitted from the third sensor 23. Then, the second ECU processing unit 322 calculates a target deceleration of the vehicle based on a third operation amount Fs3, which is the determined operation amount of the brake pedal 91, and a predetermined control map. Then, the second ECU 32 is connected to the first brake circuit 11 and the second brake circuit 12 by the second ECU switch 323. Also, the first ECU 31 is connected to the first brake circuit 11 and the second brake circuit 12 by the first ECU switch 313. Then, the second ECU 32 controls the first brake circuit 11 and the second brake circuit 12 by outputting information on the calculated target deceleration to the first brake circuit 11 and the second brake circuit 12.

[0132] The reason why, when it is determined in step S72 that the normal experience flag is on, the operation amount of the brake pedal 91 is determined based on the detection signal transmitted from the third sensor 23 will be described.

[0133] The normal experience flag is turned on when the fourth sensor 24 is determined to be in a normal state in the majority decision process of the first ECU 31 executed after the ignition switch of the vehicle is turned on. The process of step S58 for determining whether the normal experience flag can be changed from the initial value OFF to ON is executed when it is determined in step S55 that both the third sensor 23 and the fourth sensor 24 are in a normal state. Therefore, the normal experience flag being on indicates that the state of the fourth sensor 24 was determined to be in a normal state by the first ECU 31 and the second ECU 32 after the ignition switch of the vehicle was turned on. Then, when the normal experience flag is turned on, the normal experience flag is maintained in the on state while the ignition switch of the vehicle is on.

[0134] In addition, when the majority decision is determined to be a failure in the majority decision process, the control initiative is transferred from the first ECU 31 to the second ECU 32. In this embodiment, the first sensor 21, the second sensor 22, and the fourth sensor 24 are connected to the first ECU 31. In this configuration in which multiple sensors are connected to the first ECU 31, the possibility that the first sensor 21, the second sensor 22, and the fourth sensor 24 will simultaneously fail due to an external factor is relatively small. In particular, in this embodiment, the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 have different detection methods. Therefore, the possibility that the three first sensors 21, the second sensor 22, and the fourth sensor 24, which have different detection methods from each other, will simultaneously fail due to an external factor is very low. In other words, the possibility that the majority decision will be determined to be a failure in the majority decision process of the first ECU 31 due to multiple sensors among the three first sensors 21, the second sensor 22, and the fourth sensor 24 failing at the same time is very low.

[0135] Therefore, if the majority flag is not determined to be a majority failure in step S61, it is assumed that two of the first sensor 21, the second sensor 22, and the fourth sensor 24 became abnormal at different times. For example, it is assumed that the majority flag is no longer determined to be a majority failure in step S61 because the second sensor 22 or the fourth sensor 24 became abnormal after a predetermined period of time has elapsed since the first sensor 21 became abnormal. As another example, it is assumed that the majority flag is no longer determined to be a majority failure in step S61 because the first sensor 21 or the second sensor 22 became abnormal after a predetermined period of time has elapsed since the fourth sensor 24 became abnormal.

[0136] For example, assume that the fourth sensor 24 becomes abnormal after a predetermined period of time has elapsed since the first sensor 21 became abnormal, and the majority flag is no longer determined to be a majority failure in step S61. In this case, the fourth sensor 24 becomes abnormal, and a negative determination is made in step S55. In this case, the fourth difference flag is changed to abnormal in the process of step S57. However, the normal experience flag remains on.

[0137] Further, the third sensor 23 and the fourth sensor 24 are connected to the second ECU 32, and the possibility that the third sensor 23 and the fourth sensor 24 will simultaneously fail is relatively low. In particular, in this embodiment, the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 are configured by combining two sensors that detect the operation amount of the brake pedal 91 by different detection methods. Therefore, the possibility that the two third sensor 23 and the fourth sensor 24, which have different detection methods, will simultaneously fail due to an external factor is extremely low.

[0138] Therefore, when a negative determination is made in step S55, which is executed in the same control period as the control period in which a negative determination was made in step S61, with the normal experience flag in an on state, it is assumed that only the fourth sensor 24 has become abnormal. In other words, when the fourth difference flag is not determined to be normal in step S70, it can be assumed that, of the third sensor 23 and the fourth sensor 24, the fourth sensor 24 has become abnormal, but the third sensor 23 is in a normal state.

[0139] In other words, after the first ECU 31 and the second ECU 32 have determined that the fourth sensor 24 is in a normal state, the first ECU 31 is no longer able to determine that any of the first sensor 21, the second sensor 22, and the fourth sensor 24 is in a normal state. Also, after the first ECU 31 and the second ECU 32 have determined that the fourth sensor 24 is in a normal state, the second ECU 32 is no longer able to determine that either the third sensor 23 or the fourth sensor 24 is in a normal state.

[0140] In such a case, it can be assumed that the fourth sensor 24 commonly connected to the first ECU 31 and the second ECU 32 is in an abnormal state, and thus the majority decision process is judged to have failed, and the sensor abnormality judgment is judged to have an abnormality. Of the two sensors connected to the second ECU 32, the third sensor 23, which is different from the fourth sensor 24 assumed to have become in an abnormal state, can be assumed to be in a normal state.

[0141] As described above, when it is determined in step S72 that the normal experience flag is on, the second ECU processing unit 322 can determine the operation amount of the brake pedal 91 based on the detection signal transmitted from the third sensor 23.

[0142] Also, assume that the fourth sensor 24 is the first to become abnormal among the first sensor 21, the second sensor 22, and the fourth sensor 24. In this case, when the fourth sensor 24 becomes abnormal, a negative determination is made in step S55, and the fourth difference flag is changed to abnormal in the processing of step S57. However, the normal experience flag remains on. Then, assume that the first sensor 21 or the second sensor 22 becomes abnormal after a predetermined period has elapsed since the fourth sensor 24 became abnormal, and therefore the majority flag is no longer determined to be a majority failure in step S61.

[0143] In this way, even if two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, if the normal experience flag is on, the third sensor 23 is assumed to be in a normal state. In other words, even if two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, if the state of the third sensor 23 is in a normal state after the ignition switch of the vehicle is turned on, the third sensor 23 is assumed to be in a normal state.

[0144] Therefore, when it is determined in step S72 that the normal experience flag is on, the second ECU processing unit 322 can determine the operation amount of the brake pedal 91 based on the detection signal transmitted from the third sensor 23.

[0145] On the other hand, if it is not determined in step S72 that the normal experience flag is on, the second ECU 32 does not determine the operation amount of the brake pedal 91. Then, in step S74, the second ECU 32 outputs a control signal for executing a predetermined fail-safe operation to the first brake circuit 11 and the second brake circuit 12. This is because it is not possible to confirm that the state of the fourth sensor 24 commonly connected to the first ECU 31 and the second ECU 32 is normal after the ignition switch of the vehicle is turned on.

[0146] For example, if the process of step S74 is executed immediately after the ignition switch of the vehicle is turned on, the fail-safe operation may be to display a warning of an abnormal brake state on a display provided on the instrument panel, or to prohibit the vehicle from traveling. Also, for example, if the process of step S74 is executed while the vehicle is traveling, the fail-safe operation may be to display a warning of an abnormal brake state on a display provided on the instrument panel, or to limit the traveling speed of the vehicle.

[0147] As described above, in the determination process executed in steps S50 to S74, the operation amount of the brake pedal 91 is determined as shown in the table in Fig. 12. Basically, in the brake system 1 of this embodiment, when the operation amount of the brake pedal 91 can be determined by the first ECU 31 set on the main side, the operation amount of the brake pedal 91 is determined by the control process of the first ECU 31. However, when the majority decision is determined to be unsuccessful in the majority decision process and the third sensor 23 and the fourth sensor 24 are determined to be in a normal state by the second ECU 32, the operation amount of the brake pedal 91 is determined based on the detection signal of the third sensor 23, which has a higher priority.

[0148] In addition, if the majority decision process determines that the majority decision has failed and the fourth difference flag is not determined to be normal, if the normal experience flag is on, the amount of operation of the brake pedal 91 is determined based on the detection signal of the third sensor 23.

[0149] As described above, when the majority decision process of the first ECU 31 does not determine that there is a sensor in a normal state, and the sensor abnormality decision process of the second ECU 32 determines that the sensor is normal, the brake system 1 controls the brake circuit 10 based on the third operating amount Fs3.

[0150] According to this, even if two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, the brake circuit 10 can be controlled based on the third operation amount Fs3. Therefore, redundancy of the brake system 1 can be ensured.

[0151] In addition, the first sensor 21, the second sensor 22, and the fourth sensor 24 which detect the amount of operation of the brake pedal 91 are directly connected to the first ECU 31, and the third sensor 23 and the fourth sensor 24 are directly connected to the second ECU 32. Therefore, compared to a configuration in which the detection signals of the first sensor 21 to the fourth sensor 24 are transmitted and received by mutual communication between the first ECU 31 and the second ECU 32, it is possible to suppress the occurrence of a delay in synchronization of the detection signals in the control processing of each of the first ECU 31 and the second ECU 32.

[0152] Among the first sensor 21 to the fourth sensor 24, the fourth sensor 24 is connected to the first ECU 31 and the second ECU 32, and outputs the operation amount of the brake pedal 91 detected by the third sensor 23 to the first ECU 31 and the second ECU 32. This makes it possible to reduce the number of sensors provided in the brake system 1, as compared to a configuration that does not include a sensor commonly connected to the first ECU 31 and the second ECU 32. This makes it possible to suppress an increase in size of the housing of the brake system 1 and an increase in costs.

[0153] Furthermore, according to the above embodiment, the following effects can be obtained.

[0154] (1) In the above embodiment, after the first ECU 31 and the second ECU 32 determine that the fourth sensor 24 is in a normal state, if the first ECU 31 does not determine that any of the first sensor 21, the second sensor 22, and the fourth sensor 24 is in a normal state, and the second ECU 32 does not determine that any of the third sensor 23 and the fourth sensor 24 is in a normal state, the first brake circuit 11 and the second brake circuit 12 are controlled based on the operating amount detected by the third sensor 23.

[0155] Here, since it is unlikely that multiple sensors will be in an abnormal state at the same time, it is highly likely that the number of sensors in an abnormal state will increase by one for multiple sensors among the first sensor 21, the second sensor 22, and the fourth sensor 24 connected to the first ECU 31 to be in an abnormal state. Also, for all of the third sensor 23 and the fourth sensor 24 connected to the second ECU 32 to be in an abnormal state, it is highly likely that one sensor will be in an abnormal state a predetermined period after the other sensor is in an abnormal state.

[0156] Therefore, after the first ECU 31 and the second ECU 32 have determined that the fourth sensor 24 is in a normal state, if the majority vote determination process determines that the majority vote has failed and the sensor abnormality determination process determines that the fourth sensor 24 is abnormal, it can be assumed that the third sensor 23 is in a normal state.

[0157] Therefore, even if the first ECU 31 cannot determine that any of the first sensor 21, the second sensor 22, and the fourth sensor 24 is in a normal state, the operation amount of the brake pedal 91 can be determined based on the detection signal transmitted from the third sensor 23. Even if two of the first sensor 21, the second sensor 22, and the fourth sensor 24 are in an abnormal state, the brake circuit 10 can be controlled based on the third operation amount Fs3. Therefore, redundancy of the brake system 1 can be ensured.

[0158] (2) In the above embodiment, the first ECU 31 determines whether the fourth sensor 24 is in a normal state based on whether the differences between the amounts of operation detected by the first sensor 21, the second sensor 22, and the fourth sensor 24 are within a tolerance. Then, the second ECU 32 determines whether the fourth sensor 24 is in a normal state based on whether the differences between the amounts of operation detected by the third sensor 23 and the fourth sensor 24 are within a tolerance.

[0159] According to this, whether the fourth sensor 24 is in a normal state or an abnormal state can be determined based on the determination results made by the first ECU 31 and the second ECU 32, so that the accuracy of the determination can be improved.

[0160] (3) In the above embodiment, the first ECU 31 and the second ECU 32 are configured to be capable of communicating with each other and to be able to transmit and receive information about normal and abnormal states of each other. Furthermore, when one of the first ECU 31 and the second ECU 32 is in an abnormal state, the other ECU controls the first brake circuit 11 and the second brake circuit 12 based on the operation amount detected by the other ECU.

[0161] According to this, even if the first ECU 31 is in an abnormal state, so long as the second ECU 32 is in a normal state, the first brake circuit 11 and the second brake circuit 12 can be controlled based on the operation amount of the brake pedal 91 detected by the third sensor 23 and the fourth sensor 24. Also, even if the second ECU 32 is in an abnormal state, so long as the first ECU 31 is in a normal state, the first brake circuit 11 and the second brake circuit 12 can be controlled based on the operation amount of the brake pedal 91 detected by the first sensor 21, the second sensor 22, and the fourth sensor 24.

[0162] (4) In the above embodiment, when both the first ECU 31 and the second ECU 32 are in a normal state, the first brake circuit 11 and the second brake circuit 12 are controlled based on the detection signal transmitted to the first ECU 31.

[0163] According to this, when both the first ECU 31 and the second ECU 32 are in a normal state, the processing speed can be increased compared to a configuration in which the first brake circuit 11 and the second brake circuit 12 are controlled based on the operating amounts calculated by the first ECU 31 and the second ECU 32, respectively.

[0164] (5) In the above embodiment, the first sensor 21, the second sensor 22, and the fourth sensor 24 include at least two sensors that have different detection methods for detecting the amount of operation of the brake pedal 91. In addition, the third sensor 23 and the fourth sensor 24 have different detection methods for detecting the amount of operation of the brake pedal 91.

[0165] With this, even if, for example, one of the first sensor 21, the second sensor 22, and the fourth sensor 24 cannot detect the amount of operation of the brake pedal 91 due to the external environment or the like, the other two sensors can detect the amount of operation of the brake pedal 91. Also, even if, for example, one of the third sensor 23 and the fourth sensor 24 cannot detect the amount of operation of the brake pedal 91 due to the external environment or the like, the other sensor can detect the amount of operation of the brake pedal 91.

[0166] (Other embodiments) Representative embodiments of the present disclosure have been described above, but the present disclosure is not limited to the above-described embodiments and can be modified in various ways, for example, as described below.

[0167] In the above embodiment, an example in which the number of sensors connected to the first ECU 31 is three has been described, but the present invention is not limited thereto. For example, the first ECU 31 may be configured to have four or more sensors connected thereto. In this case, the first ECU 31 executes majority decision processing based on detection signals transmitted from the four or more sensors to determine that a sensor in a normal state is present among the four or more sensors.

[0168] In the above embodiment, an example has been described in which the first ECU 31 and the second ECU 32 are configured to be capable of communicating with each other and to be capable of transmitting and receiving information on normal and abnormal states of each other, but the present invention is not limited to this.

[0169] For example, the first ECU 31 and the second ECU 32 may be configured to be unable to transmit and receive information about the normal state and the abnormal state of each other. In this case, the first ECU 31 and the second ECU 32 may transmit the determined operation amounts to the first brake circuit 11 and the second brake circuit 12 independently of each other.

[0170] The first brake circuit 11 and the second brake circuit 12 may be configured to perform a fail-safe operation when they cannot receive a determined operation amount from either the first ECU 31 or the second ECU 32. Alternatively, when they receive a determined operation amount from at least one of the first ECU 31 and the second ECU 32, the first brake circuit 11 and the second brake circuit 12 may operate based on the received operation amount.

[0171] In the above embodiment, an example has been described in which, when one of the first ECU 31 and the second ECU 32 is in an abnormal state, the first brake circuit 11 and the second brake circuit 12 are controlled based on the operation amount detected by the other ECU, but this is not limiting. For example, a configuration may be used in which, when one of the first ECU 31 and the second ECU 32 is in an abnormal state, the other ECU outputs a control signal to the first brake circuit 11 and the second brake circuit 12 to perform a fail-safe operation.

[0172] In the above embodiment, an example has been described in which the first brake circuit 11 and the second brake circuit 12 are controlled based on the operation amount transmitted to the first ECU 31 when both the first ECU 31 and the second ECU 32 are in a normal state, but the present invention is not limited to this. A configuration in which the first brake circuit 11 and the second brake circuit 12 are controlled based on the operation amount transmitted to the second ECU 32 when both the first ECU 31 and the second ECU 32 are in a normal state may also be used.

[0173] In the above embodiment, when the first ECU 31 is in a normal state, the target deceleration is calculated based on the operation amount detected by a sensor determined to be in a normal state among a plurality of sensors connected to the first ECU 31, but the present invention is not limited to this. For example, when the first ECU 31 is in a normal state and the second ECU 32 is in a normal state, the target deceleration may be calculated based on the operation amount detected by one or more sensors determined to be in a normal state among the first sensor 21 to the fourth sensor 24. For example, when all of the first sensor 21 to the fourth sensor 24 are determined to be in a normal state, the target deceleration may be calculated based on the average value of the operation amount detected by each of the first sensor 21 to the fourth sensor 24.

[0174] In the above embodiment, the first sensor 21, the second sensor 22, and the fourth sensor 24 have different detection methods for detecting the amount of operation of the brake pedal 91, but the present invention is not limited to this. Also, the third sensor 23 and the fourth sensor 24 have different detection methods for detecting the amount of operation of the brake pedal 91, but the present invention is not limited to this.

[0175] For example, the first sensor 21, the second sensor 22, and the fourth sensor 24 may be configured to use the same detection method for detecting the amount of operation of the brake pedal 91. Also, the first sensor 21, the second sensor 22, and the fourth sensor 24 may be configured such that two of the three sensors use the same detection method for detecting the amount of operation of the brake pedal 91, and the remaining sensor uses a different detection method. Furthermore, the third sensor 23 and the fourth sensor 24 may be configured to use the same detection method for detecting the amount of operation of the brake pedal 91.

[0176] In the above-described embodiments, it goes without saying that the elements constituting the embodiments are not necessarily essential, except in cases where it is particularly expressly stated that they are essential or where they are clearly considered to be essential in principle.

[0177] In the above-described embodiments, when numerical values ​​such as the number, values, amounts, ranges, etc. of components of the embodiments are mentioned, they are not limited to the specific numbers unless expressly stated as required or clearly limited to a specific number in principle.

[0178] In the above-described embodiments, when referring to the shapes, positional relationships, etc. of components, etc., there is no limitation to those shapes, positional relationships, etc., unless specifically stated or in principle limited to a specific shape, positional relationship, etc.

[0179] (Features of the present invention) [Claim 1] A brake system for controlling a brake circuit (10) that brakes a vehicle, comprising: four or more sensors (21, 22, 23, 24) for detecting an amount of operation of a brake pedal (91) operated by a driver and generating and outputting a detection signal corresponding to the detected amount of operation; an electronic control device (30) including a first electronic control device (31) to which three or more sensors (21, 22, 24) excluding one predetermined sensor (23) of the four or more sensors are connected, and a second electronic control device (32) to which two sensors, the predetermined sensor and one common sensor (24) of the three or more sensors, are connected, and which controls the brake circuit based on the operation amount detected by the four or more sensors, The first electronic control unit is capable of determining that a sensor in a normal state is present among the three or more sensors based on the operation amounts detected by each of the three or more sensors, The second electronic control unit is capable of determining that both of the two sensors are in a normal state based on the operation amounts detected by the two sensors, The electronic control device includes: A brake system that controls the brake circuit based on the operation amount detected by at least one of the specified sensor and the common sensor when the first electronic control unit does not determine that any of the three or more sensors is in a normal state and the second electronic control unit determines that both of the two sensors are in a normal state.

[0180] [Claim 2] The electronic control device includes: 2. The brake system according to claim 1, wherein after the first electronic control unit and the second electronic control unit have determined that the common sensor is in a normal state, if the first electronic control unit does not determine that any of the three or more sensors is in a normal state and the second electronic control unit does not determine that any of the two sensors is in a normal state, the brake system controls the brake circuit based on the operation amount detected by the specified sensor.

[0181] [Claim 3] The first electronic control unit determines whether the common sensor is in a normal state based on whether differences between the operation amounts detected by the three or more sensors are within a predetermined allowable error, 3. The brake system according to claim 2, wherein the second electronic control unit determines whether the common sensor is in a normal state based on whether a difference between the operation amounts detected by the two sensors is within a predetermined allowable error.

[0182] [Claim 4] The first electronic control unit and the second electronic control unit are configured to be capable of communicating with each other and to be capable of transmitting and receiving normal and abnormal states of each other, 4. The brake system according to claim 1, wherein when one of the first electronic control device and the second electronic control device is in an abnormal state, the brake circuit is controlled based on the operation amount transmitted to the other electronic control device.

[0183] [Claim 5] 5. A brake system according to claim 1, wherein, when both the first electronic control device and the second electronic control device are in a normal state, a brake circuit is controlled based on the operation amount transmitted to either the first electronic control device or the second electronic control device.

[0184] [Claim 6] The three or more sensors connected to the first electronic control unit include at least two sensors having different detection methods for detecting the operation amount of the brake pedal, 6. The brake system according to claim 1, wherein the two sensors connected to the second electronic control unit have different detection methods for detecting the amount of operation of the brake pedal. [Explanation of symbols]

[0185] 10 Brake Circuit 21 First Sensor 22 Second Sensor 23 3rd Sensor 24 4th Sensor 30 Electronic control device 31 First electronic control device 32 Second electronic control device

Claims

1. A brake system for controlling a brake circuit (10) for braking a vehicle, comprising: four or more sensors (21, 22, 23, 24) that detect an amount of operation of a brake pedal (91) operated by a driver and generate and output a detection signal corresponding to the detected amount of operation; an electronic control device (30) including a first electronic control device (31) to which three or more sensors (21, 22, 24) excluding one predetermined sensor (23) of the four or more sensors are connected, and a second electronic control device (32) to which two sensors, the predetermined sensor and one common sensor (24) of the three or more sensors, are connected, and which controls the brake circuit based on the operation amount detected by the four or more sensors; The first electronic control unit is capable of determining that a sensor in a normal state is present among the three or more sensors based on the operation amounts detected by each of the three or more sensors, The second electronic control unit is capable of determining that both of the two sensors are in a normal state based on the operation amounts detected by the two sensors, The electronic control device includes: When the first electronic control unit does not determine that any of the three or more sensors is in a normal state and the second electronic control unit determines that both of the two sensors are in a normal state, the brake system controls the brake circuit based on the operating amount detected by at least one of the specified sensor and the common sensor.

2. The electronic control device includes:

2. The brake system according to claim 1, wherein after the first electronic control unit and the second electronic control unit have determined that the common sensor is in a normal state, if the first electronic control unit does not determine that any of the three or more sensors is in a normal state and the second electronic control unit does not determine that any of the two sensors is in a normal state, the brake circuit is controlled based on the operation amount detected by the specified sensor.

3. the first electronic control unit determines whether the common sensor is in a normal state based on whether differences between the operation amounts detected by the three or more sensors are within a predetermined allowable error; 3. The brake system according to claim 2, wherein the second electronic control unit determines whether the common sensor is in a normal state based on whether a difference between the respective operation amounts detected by the two sensors is within a predetermined allowable error.

4. the first electronic control unit and the second electronic control unit are configured to be capable of communicating with each other and to be capable of transmitting and receiving normal and abnormal states of each other, 4. A brake system according to claim 1, wherein when one of the first electronic control device and the second electronic control device is in an abnormal state, the brake circuit is controlled based on the operation amount transmitted to the other electronic control device.

5. 5. The brake system according to claim 4, wherein when both the first electronic control unit and the second electronic control unit are in a normal state, the brake circuit is controlled based on the detection signal transmitted to either the first electronic control unit or the second electronic control unit.

6. The three or more sensors connected to the first electronic control unit include at least two sensors having different detection methods for detecting an operation amount of the brake pedal, 2. The brake system according to claim 1, wherein the two sensors connected to the second electronic control unit have different detection methods for detecting the operation amount of the brake pedal.

Images