Electric brake system failure operation

Abstract

A brake control unit (50) is provided that includes a primary control branch (510), a backup control branch (520), and a mode control utility (530), the mode control utility (530) being configured to select an operating mode of the brake control unit from a plurality of possible operating modes including at least a normal operating mode and a degraded operating mode according to an integrity diagnostic indication, the primary control branch (510) and the backup control branch (520) each being controlled by a respective control module and configured to generate an external brake control signal (I) at a respective inverter. B ) in response to the brake motor drive signal (D 10 , D 20 ), the primary control module (511) includes at least first and second mutually cooperating primary control components (511A, 511B) configured to provide an integrity diagnostic indication and to diagnose (QA) each other's integrity status, and generates a test signal (S T ) in response to the backup control branch response signal (S R ) to diagnose the integrity status of the backup control branch (520).

Description

[Technical field]

[0001] The present disclosure relates to electric braking systems, methods of controlling systems, controllers or software for such systems, and vehicles equipped with braking systems. [Background technology]

[0002] Brake-by-wire is usually used to describe braking systems in which the actuation device and the transmission device are decoupled from each other. In a conventional hydraulic braking system, the brake pedal is the actuation device and the hydraulics are the transmission device. Here, a distinction is made between electrohydraulic brakes, electropneumatic brakes (trucks) and electric brakes. Since no fluid technology system is used, simply without hydraulics or pneumatics, the braking becomes a so-called "dry" brake-by-wire application. One of the reasons for wanting to use this technology is the slowness of the media currently used in braking systems. With the help of a purely electromechanical solution, shorter response times can be achieved, which may also be reflected in the achievable stopping distances. Another advantage is the increased manufacturability of brake-by-wire technology in comparison, since it is expensive to create components used in hydraulic systems such as the master cylinder, the brake booster, the antilock components or, more generally, the brake modulating components.

[0003] Electric vehicle brakes typically have an electromechanical actuator configured to press friction brake linings against a brake body that is fixed to rotate relative to the vehicle wheels. The brake body is usually a brake disc or brake drum. The actuator typically has an electric motor and a rotation-to-translation conversion gear that converts the rotational drive motion of the electric motor into translational motion to press the friction brake linings against the brake body. Worm gears such as spindle gears and roller worm drives are often used as rotation-to-translation conversion gears. It is also possible to convert rotational motion into translational motion using pivot cams, etc. A reducer such as a planetary gear is often interposed between the electric motor and the rotation-to-translation conversion gear. Self-boosting electromechanical vehicle brakes have a self-boosting device that converts the friction force applied against the friction brake linings that the rotating brake body presses against the brake body to brake into a contact pressure that presses the friction brake lining against the brake body in addition to the contact pressure applied by the actuator. Wedge, ramp, and lever mechanisms are suitable for self-boosting.

[0004] Control units for electric vehicle braking must be reliable in that the risk of failure is minimized and that the occurrence of a failure does not have immediate serious consequences. The risk of failure has both systematic and random aspects. The failure probability of electronic components is highly dependent on the conditions during development and manufacturing. It is possible to reduce the probability by providing an appropriate development methodology, adequate testing and validation, and redundancy. However, failures due to random errors cannot be completely eliminated. The probability of random failures is determined by the metric PMHF (Probability Metric of Random Hardware Failures). This metric is defined as the probability density (h -1 ) The relevant metric is expressed in FIT units. Electronic components of various ASIL classes (Automotive Safety Integrity Levels) are available. ASIL-D is a PMHF value <10 corresponding to 10 FIT. -8 h -1ASIL-C is the highest rank. PMHF value is <10 -7 h -1 This is equivalent to 100 FIT.

[0005] The potential impact of the failure is further determined by the aspects "severity", "exposure" and "controllability", as is evident from the following example, where a brake control unit is provided that controls the electric brakes of each wheel in response to an external brake control signal from the driver. An example of a failure may be when the brake control unit is unable to control any of the electric brakes when it receives a brake control signal. This is dangerous as it may cause the vehicle to yaw or sway excessively. The severity is rated as S3, as the vehicle may become unstable and veer into the oncoming lane, possibly resulting in a collision with other traffic or obstacles. The exposure is rated as E4, as this is a very common driving scenario. Roads usually have multiple lanes, only highways may have separated lanes on opposite sides. The controllability aspect is rated as C3. The driver can control the vehicle's movement to some extent by manipulating the steering to correct the yaw due to the brake system failure, but this is very difficult, especially at medium and high speeds. A known approach to mitigate the potential impact of a random failure is to provide the brake control unit as a so-called "one-out-of-two (1oo2) system". This type of brake control unit has dual control channels, each with its own automatic diagnostic unit. This approach reduces the potential impact of random failures, but at the expense of higher material costs. Summary of the Invention [Problem to be solved by the invention]

[0006] There is therefore a need to reduce the potential impact of random failures in a more cost-effective manner. [Means for solving the problem]

[0007] Aspects of the present disclosure relate to a brake control unit that includes a primary control branch, a backup control branch, a diagnostic utility, and a mode control utility.

[0008] The primary control branch includes a primary inverter and a primary control module that controls the operation of the primary inverter.

[0009] The backup control branch includes a backup inverter and a backup control module that controls the operation of the backup inverter.

[0010] The diagnostic utility is configured to determine an integrity state of both control branches. The integrity state indicates whether the control branch meets the integrity requirement. The integrity requirement is not met by the control branch if the operation of the control branch is determined to be non-functional (i.e., non-functional or erroneous functionality). The integrity requirement of the control branch is not met if it is not functional, but also if it is likely or certain to malfunction when set to an operational state.

[0011] The mode control utility is configured to select an operating mode for the brake control unit from a plurality of possible operating modes including at least one of a normal operating mode and a degraded operating mode according to the determination.

[0012] In a normal operating mode, the primary control branch is configured to generate a brake motor drive signal at an inverter controlled by the control module in response to an external brake control signal.

[0013] In a degraded mode of operation, the backup control branch is configured to generate a brake motor drive signal at an inverter controlled by the control module in response to an external brake control signal.

[0014] The primary control module includes at least first and second mutually cooperating primary control components that are part of said diagnostic utility in that they are configured to diagnose an integrity status of each other. The primary control module also includes a diagnostic utility configured to diagnose an integrity status of the backup control branch by verifying a response signal of the backup control branch responsive to a test signal.

[0015] In some embodiments, the first and second mutually cooperating primary control components diagnose each other's integrity status by a Q&A watchdog procedure, where the first primary control component periodically sends an interrogation message, which requests the second primary control component to perform a certain set of arithmetic operations on the token value communicated in the interrogation message and to respond with a next response message to communicate the resulting token value within a predefined time interval. If the resulting token value deviates from an expected token value or is not received within a time interval specified by the first primary control component, the first control component determines that the second control component does not meet the integrity requirement. In some exemplary embodiments, the second control component is also configured to determine that the first control component does not meet the integrity requirement if it does not receive an interrogation message within a predefined time interval. In some embodiments, the Q&A watchdog procedure is mutually executed in that both primary control components are configured to verify each other's operation in this way. In some embodiments, the first and second mutually cooperating primary control components each perform a respective function of calculating a control signal for the primary inverter according to an external brake control signal. The cooperating control components are used in a cost-effective manner since each has a distinct contribution to the operation of the primary control module.

[0016] In some embodiments, one of these primary control components is a microcontroller that directly or indirectly controls the drive signal of the inverter as part of a feedback loop responsive to the motor angle sensor, while in this exemplary embodiment, the other of the primary control components is a power management controller.

[0017] In further embodiments, a similar Q&A watchdog procedure is applied to multiple primary control components. In this way, not only can an error condition be signaled, but it can also be more reliably determined which of the primary control components actually lacks integrity. In a further exemplary embodiment with a primary control module having first, second, and third primary control components, if both the second and third primary control components diagnose a lack of integrity in the first primary control component and further verify each other's integrity, then it is possible that the first primary control component actually has a potential defect.

[0018] As with the prior art approach, the potential impact of a failure is significantly reduced. During normal operation, the brake motor is controlled by a primary brake control branch. This primary control branch is equipped with an automatic diagnostic utility, so that the primary control branch functions with high integrity. If a failure nevertheless occurs in the primary control branch, the mode control utility allows the backup control branch to take over control. The primary control module further comprises a diagnostic utility configured to diagnose the integrity status of the backup control branch by verifying a response signal of the backup control branch in response to a test signal. This allows the primary control module to verify that the backup control branch is indeed available to take over brake control in the event of a failure of the primary control branch. Due to the fact that a failure of the primary control branch does not directly affect the vehicle's behavior, the potential impact is significantly reduced. Various, not mutually exclusive options are possible for the mode control utility. According to one option, the mode control utility warns the driver when it changes the operation of the brake control unit to a reduced operating mode. This allows the driver to take appropriate measures, for example, to drive to a garage or to reduce the speed of the vehicle. Alternative or additional optional means provide means for directly modifying the operation of the vehicle to impose safer operating conditions or prevent further operation, as described in more detail below. Due to the fact that the backup control branch is only provided to temporarily control the brakes in the event of failure of the primary control branch, and that its integrity is checked periodically or continuously during normal operation, a lower level of integrity is sufficient for the backup control branch. For example, Q&A watchdog diagnostics are not required. The brake motor controlled by the brake control unit requires only one set of coils and is driven by the primary control branch in normal operating mode and by the backup control branch in degraded operating mode.

[0019] In some embodiments, the mode control utility is configured to maintain operation of the backup control module during the normal operating mode, and the diagnostic utility is configured to compare the response signal of the backup control branch with a reference response signal and report a lack of integrity of the backup control branch if it determines a substantial difference between the response signal and the reference response signal. This reduces the risk of the backup control branch becoming unavailable in the event of a failure of the primary control branch, even in the absence of an automatic diagnostic means for the backup control branch. The test signal is, for example, an external brake control signal. If the diagnostic means for the primary control branch determines that the signal generated in the backup control branch deviates significantly from the corresponding signal in the primary control branch, it determines a lack of integrity of the backup control branch. For example, the response signal to be compared is indicative of the control signal provided by the backup control module to the backup inverter. In some embodiments, the diagnostic utility compares this with a reference response signal indicative of the control signal provided by the primary control module to the primary inverter.

[0020] In some embodiments, the mode control utility is configured to enable both the primary control branch and the backup control branch to generate a brake motor drive signal. In the exemplary embodiment, the brake control unit further comprises respective phase interrupt switches controlled by the mode control utility to select the brake motor drive signal from the primary control branch in the normal operating mode and to select the brake motor drive signal from the backup control branch in the degraded operating mode. In this case, a signal indicative of the brake motor drive signal from the backup control branch is suitable as the response signal. A signal indicative of the brake motor drive signal provided by the primary control branch is suitable as the reference signal. In these embodiments, diagnostics of the complete backup control branch are possible during the normal operating mode.

[0021] In some embodiments of the brake control unit, the set of potential operating modes further includes a power-up mode in which the diagnostic utility provides a control signal to the backup control branch to cause the backup control branch to generate a brake motor drive signal. In the power-up mode, the mode control utility temporarily enables the backup control branch to drive the brake motor with the brake motor drive signal. In the power-up mode, the diagnostic utility diagnoses the operation of the backup control branch by checking the operation of the brake motor in response to the brake motor drive signal. In these embodiments, it is periodically verified that the backup control unit is indeed successful in properly controlling the brake motor. In some embodiments, this diagnostic procedure is combined with other diagnostic procedures, for example, by comparing the response signal of the backup backup control branch to a reference signal during normal operation as described above.

[0022] In some embodiments, the plurality of potential operating modes includes a further degraded operating mode. In the further degraded operating mode, the mode control utility selects the primary control branch as the source of the brake motor drive signal. The mode control utility selects the further degraded operating mode if the diagnostic utility determines a lack of integrity in the backup control branch, but determines that the primary control branch meets the integrity requirements. Similar to the degraded modes described above, the mode control utility in some embodiments provides a signal to the driver and / or imposes safety limitations on other control functions of the vehicle. In the further degraded operating mode, the mode control utility in some embodiments completely disables operation of the backup control branch to avoid possible interference with operation of the primary control branch.

[0023] As previously mentioned, the backup control branch does not require a high level of integrity. Nevertheless, in some embodiments, limited auto-diagnostic functionality is provided, including one or more of checksum verification and out-of-range signal detection.

[0024] For example, at least a first and a second mutually cooperating primary control components configured to diagnose each other's integrity status may comprise a power management controller and a microcontroller responsible for feedback control of a motor. Thus, each primary control component in a primary control branch has a different function and further the ability to diagnose other components. Further expansion is possible if more than one primary control component is provided and each primary control component is configured to diagnose the integrity of each other.

[0025] The brake control units as described above and the electric brakes controlled by the brake control units form an electric brake control system. In some embodiments, an electric brake control system for a vehicle includes an electric brake for each wheel controlled by a respective brake control unit. In an exemplary embodiment, the brake control units cooperate with each other.

[0026] As mentioned above, some embodiments provide a means to directly modify the vehicle's operation. For example, an embodiment of the brake control unit is part of a vehicle control system having one or more additional control units for controlling additional vehicle functions, the brake control unit being configured to modify at least one of the operation modes of the one or more additional control units depending on its own operation mode. In an exemplary embodiment, the vehicle control system further comprises a speed control unit for controlling the speed of the vehicle. In a particular exemplary embodiment of this vehicle control system, if the operation mode of the brake control unit is not the normal operation mode, the brake control unit imposes an upper limit on the speed at which the speed control unit can drive the vehicle. This significantly reduces the potential impact in the event of a backup control branch failure. Limiting the driving speed in an exceptional case makes it easier for the driver to control the vehicle's behavior with steering. In some embodiments, the maximum driving speed is gradually reduced to the limited speed upon transition from the normal operation mode to the reduced operation mode so that the driver is not surprised and can respond appropriately. In some exemplary embodiments, the maximum driving speed is reduced from the previous maximum value to the limited maximum value in a time interval of one minute. If the current vehicle speed upon departure from the normal operation mode is below the limited maximum speed, there is no need to delay the maximum speed limit.

[0027] A driver who notices the warning signal and / or experiences the limited maximum speed is expected to drive the vehicle to a garage to have the brake control unit repaired or replaced once it is no longer in the normal operating mode. As an additional or alternative precaution, in some embodiments, the brake control unit is configured to cause the vehicle control system to discontinue operation of the vehicle upon determining that a predetermined time interval has elapsed and / or that the vehicle has been driven a predetermined distance since the operating mode was no longer in the normal operating mode. In some embodiments, the discontinuance is gradual, such as gradually reducing the maximum speed to zero. In other embodiments, the discontinuance occurs when the vehicle is stopped, i.e., if the driver parks and turns off the car, it will not be available for further use until the car is towed to a garage for repair or replacement of the brake control unit.

[0028] Provided herein is a method of controlling a brake motor of a vehicle, comprising generating a brake motor drive signal in response to an external brake control signal. The external brake control signal typically originates from a control element for driver control, such as a brake pedal or a manual control element. In an alternative embodiment, the external brake control signal is issued by a component within an automated driving system. In another alternative embodiment, the external brake control signal is issued under control by the driver or under control by a component of a semi-automated driving system. The methods provided herein more specifically include: providing a primary control branch, a backup control branch, and a mode control utility; The provided primary control branch comprises a primary inverter and a primary control module for controlling the operation of the primary inverter. The backup control branch provided comprises a backup inverter and a backup control module for controlling the operation of the backup inverter. - using a diagnostic utility to determine the integrity state of both control branches; the mode control utility selects an operating mode from a plurality of possible operating modes in accordance with the determination, the possible operating modes including at least one of a normal operating mode and a degraded operating mode. - enabling the primary control branch to exclusively generate the brake motor drive signal in response to an external brake control signal during a normal operating mode, wherein in the normal operating mode at least first and second mutually cooperating primary control components diagnose each other's integrity status, and wherein the primary control branch further diagnoses the integrity status of the backup control branch by verifying a response signal of said branch in response to a test signal. - enabling the backup control branch to exclusively generate the brake motor drive signal in response to an external brake control signal during a degraded mode of operation. - providing a primary control branch includes including at least first and second mutually cooperating primary control components that diagnose each other's integrity status during operation, the primary control branch further being provided for diagnosing an integrity status of the backup control branch by verifying a response signal of said branch in response to a test signal.

[0029] These and other aspects of the present disclosure will be described in more detail with reference to the drawings. [Brief description of the drawings]

[0030] [Figure 1] An electric brake system is shown. [Diagram 2] 2 illustrates a schematic of a brake control unit in one embodiment of an electric brake system. [Diagram 3] 2A and 2B are schematic diagrams illustrating exemplary operation mode diagrams for one embodiment of a brake control unit; [Figure 4] 1 illustrates generally an example of a vehicle control system including an embodiment of a brake control unit. [Diagram 5] 4 illustrates further examples of operating modes of an embodiment of a brake control unit. [Figure 6] 4 illustrates further examples of operating modes of an embodiment of a brake control unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0031] The terms used to describe certain embodiments are not intended to limit the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural, unless the context clearly dictates otherwise. The term "and / or" includes all combinations of one or more of the associated listed items. It will be understood that the terms "comprises" and / or "comprising" specify the presence of a stated feature, but do not exclude the presence or addition of one or more other features. When a particular step of a method is referred to as following another step, it will be further understood that it may directly follow said other step, unless otherwise specified, or that one or more intermediate steps may be performed before performing the particular step. Similarly, when a connection between structures or components is described, it will be understood that this connection may be established directly or through an intermediate structure or component, unless otherwise specified.

[0032] The present invention is described more fully hereinafter with reference to the accompanying drawings, in which embodiments of the invention are shown. In the drawings, absolute and relative sizes of systems, components, layers, and regions may be exaggerated for clarity. The embodiments may be described with reference to schematic and / or cross-sectional illustrations of possible idealized embodiments and intermediate structures of the invention. In the description and drawings, like numbers refer to like elements throughout. Relative terms and derivatives thereof should be construed to refer to the orientation as illustrated in the drawings currently being described or discussed. These relative terms are for convenience of description and do not require the system to be constructed or operated in a particular orientation, unless specifically specified.

[0033] FIG. 1 illustrates an electric brake system 150. As described herein, the brake system 150 includes or is coupled to an electric brake motor 12 that transmits mechanical energy to a brake mechanism 40 via a brake transmission 30. Typically, the electric brake motor 12 is configured to convert electrical power into mechanical power. An electric motor is understood as a machine that converts electrical energy into mechanical energy. For example, an electric motor operates through the interaction of a magnetic field in the motor with current flowing through windings to generate force in the form of rotation of an output shaft.

[0034] In some embodiments, the system comprises or is coupled to a brake mechanism 40 configured to brake or release the wheel brakes of the vehicle depending on the mechanical state of the brake mechanism 40. For example, the mechanical state of the brake mechanism 40 is configured to vary anywhere between a (maximum) braking state and a (fully) released state where no brakes are applied, or an intermediate state where at least some brakes are applied.

[0035] Typically, the brake transmission 30 is configured to transmit mechanical power from the electric brake motor 12 to the brake mechanism 40. In a preferred embodiment, the brake transmission 30 includes a self-locking mechanism as described herein. For example, the locking mechanism is configured to maintain the mechanical state of the brake mechanism 40 in the absence of power to the electric brake motor 12. In some embodiments, self-locking occurs when the brake transmission is static, i.e., not moving. For example, the brake transmission includes a worm gear. Without being bound by theory, the worm gear is considered self-locking and will not backdrive as long as the coefficient of friction between the gear and the worm is greater than the tangent of the lead angle of the worm. Of course, other self-locking mechanisms are also suitable.

[0036] In one embodiment, the brake system includes a piston type mechanism, although other mechanisms (e.g., floating type caliper brakes) are suitable. The brake in FIG. 1 is an example of a floating type caliper brake. Typically, the brake transmission includes a set of gears operatively connected to the output shaft of the brake motor 12. In some embodiments, the gears of the brake transmission are configured to drive a spindle housed in a spindle nut to move the piston. In one embodiment, the piston is guided, for example, by a guide pin, to drive the opening and closing movement of a caliper 41, which can be considered as part of the brake mechanism 40. For example, in one embodiment, two opposing brake pads are attached to the caliper. The mechanical energy transmitted to the brake mechanism 40 through the brake transmission 30 is ultimately used to bring the two brake pads closer together to perform or activate the braking action and move them away from each other to release or deactivate the brake. In some embodiments, the caliper 41 is fixed to a bracket that suspends the caliper 41 above the brake disc 42 of the wheel such that the brake disc is provided between the pads of the caliper. For example, the brake disc 42 is connected to at least one wheel of the vehicle, for example an axle that is directly connected to the wheel and the brake disc.

[0037] In some embodiments, for example as shown, the primary gear 11 is operatively connected to rotate with the brake transmission 30. For example, during wheel braking via the brake transmission, the primary gear 11 rotates in a braking direction "D1". For example, during wheel brake release, the primary gear 11 rotates in an opposite brake release direction "D2".

[0038] 2 shows a schematic of a brake control unit 50 comprising a primary control branch 510, a backup control branch 520, a diagnostic utility 515, and a mode control utility 530. The primary control branch 510 has a primary inverter 512 and a primary control module 511 that controls the operation of the primary inverter. The backup control branch 520 has a backup inverter 522 and a backup control module 521 that controls the operation of the backup inverter. The diagnostic utility 515 is operable to monitor the integrity status S of both control branches. INT The integrity status S determined by the diagnostic utility 515 is configured to determine INT The mode control utility 530 selects an operating mode for the brake control unit from a plurality of possible operating modes, including at least a normal operating mode and a degraded operating mode, in accordance with the enable signal En. 510 Activates the primary control branch 510 and outputs the external brake control signal I B 5, the primary inverter 512 controlled by the primary control module 511 is used to control the supplied power P dc1 From brake motor drive signal D 10 In this case, the brake motor drive signal D 10 Brake motor drive signal D o In the degraded mode of operation, the mode control utility 530 generates a separate enable signal, En 520 Activating the backup control branch 520 by the external brake control signal I B 5, the backup control module 521 is used to control the supplied power P dc2 From brake motor drive signal D 20 In this case, the brake motor drive signal D 20 Brake motor drive signal D o The brake motor drive signal D in normal operating mode is provided instead. 10 , or brake motor drive signal D in degraded operating mode 10Either of the two signals is the control signal D to the brake motor. o In some embodiments, the enable signal En 510 is used to activate / deactivate the entire primary control branch 510. In some embodiments, the enable signal has various signal components configured to allow the mode control utility 530 to selectively activate / deactivate portions of the primary control branch 510. Similarly, in some embodiments, the enable signal En 510 is used to activate / deactivate the entire backup control branch 520, and in another embodiment, an enable signal En 510 has various signal components for selectively activating / deactivating parts of the backup control branch 520. The mode control is 566a and En 563b and the mode control utility is configured to turn on and off the power provided to the primary inverter 512 and the backup inverter 522 using the control signals En 516 , En 526 5 to control the phase cutoff switches 516, 526.

[0039] The primary control module 511 includes at least first and second mutually cooperating primary control components. In the illustrated embodiment, the primary control module 511 includes a primary power management controller 511A and a primary feedback controller 511B as the first and second mutually cooperating primary control components. In the illustrated embodiment, the primary control module 511 also includes a pre-driver 511C as a third primary control component that also cooperates with the primary power management controller 511A and the primary feedback controller 511B.

[0040] The mutually cooperating primary power management controller 511A and the primary feedback controller 511B are part of the diagnostic utility 515 in that they are configured by respective watchdog components 515a, 515b to diagnose each other's integrity status. The watchdog components 515a, 515b execute a procedure and periodically send each other interrogation messages Q. The interrogation message requests that they perform a certain set of arithmetic operations on a token value conveyed in the interrogation message and respond with a response message A conveying the resulting token value within a predefined time interval. Either of the mutually cooperating control components is configured to signal the other's lack of integrity if the token value provided in the response message deviates from an expected token value or is not received within a specified time interval. In some embodiments, either of the mutually cooperating control components is configured to signal the other's lack of integrity if it does not receive an interrogation message within a specified time interval. The primary control module transmits a test signal S T In response to the response signal S R The external brake signal I B as a test signal and verifying that the backup control branch 520 responds to this signal in the same manner as the primary control branch 510, a very effective integrity verification is possible. Because the primary control branch 510 is high integrity and has automatic diagnostic capabilities, it is presumed that the control signal serves as a reliable reference for comparison with those of the backup control branch 520.

[0041] In the illustrated embodiment, the backup control module 521 also includes control components that cooperate with each other. These include a backup power management controller 521A, a backup feedback controller 521B, and a backup pre-driver 521C. Compared to the corresponding primary components, these backup components have a lower integrity level. The primary components 511A, 511B, and 511C are certified, for example, as ASIL-D, and the backup control components are certified, for example, as ASIL-A. Unlike the primary control components, the backup control components are not configured to perform watchdog procedures on each other. In another embodiment, a single backup control component is used for power management, feedback control, and pre-drive functions.

[0042] In some embodiments of the brake control unit 50, the backup control branch 520 is fully operational in the normal operating mode, except for the fact that it cannot drive the brake motor. The diagnostic utility 515 of the primary control module 511 can then continuously monitor the integrity of the backup control branch 520. In some embodiments, the diagnostic utility compares a response signal St from the backup control branch 520, indicative of the signal CI2 provided by the backup control module 521 to the backup inverter 522, with a reference signal indicative of the control signal provided by the primary control module 511 to the primary inverter 512. Optionally, the signal to be compared is the inverter control signal itself. According to another option, the signal to be compared is a duplicate or modified version thereof. In some embodiments, in the normal operating mode, the backup control branch 520 is periodically activated for a relatively short period of time during which it operates at a lower frequency or at its normal frequency.

[0043] In the embodiment shown in FIG. 2, the mode control utility of the brake control unit 50 is the control signal En 516 and En 5265. During normal operation mode, the primary control branch 510 and the backup control branch 520 are both configured to control their brake motor drive signals D 10 , D 20 However, the mode control utility 530 determines whether the primary control branch 510 generates its brake motor drive signal D via the primary phase cutoff switch 516. 10 The backup phase cutoff switch 526 is used to actually deliver the brake motor drive signal D 20 In this embodiment, the response signal S of the backup control branch 520, which is verified by the diagnostic utility 515, is blocked. R is the brake motor drive signal D provided by the backup control branch 520. 20 The reference response signal to which this response signal SR is compared is a signal indicative of the brake motor drive signal D provided by the primary control branch 510. 10 In some embodiments, the signal is, for example, a brake motor drive signal D 10、 D 20 The brake motor drive signal D is proportional to 10 , D 20 In this manner, the diagnostic utility 515c is configured to also verify the operation of the backup inverter 522. In other embodiments, the controlled phase cutoff switches 516 and 526 are not present, and instead the mode control utility 530 controls the control signal En to the input power switches 563A, 563B. 563a , En 563b In yet another embodiment, the mode control utility 530 is configured to selectively enable one of the primary inverter 512 and the backup inverter 522 using a control signal En 510 , En 520 5 is configured to selectively enable one of the primary inverter 512 and the backup inverter 522 by a respective control signal component in .

[0044] 2, EMI filters 517, 527 are provided in the power supply lines to the primary inverter 512 and the backup inverter 522, respectively. The EMI filter 517 in the power supply line to the primary inverter is configured for a high level of interference suppression. The EMI filter 527 in the power supply line to the backup inverter has a modest interference suppression function since the backup control branch 520 is intended to be used only temporarily and at relatively low power levels.

[0045] In the embodiment shown in FIG. 2, the power supply 560 has redundant elements to minimize the risk of power supply failure. In this exemplary embodiment, the power supply 560 comprises a main battery package 561A, a backup battery package 561B, and a power supply selector 562. The power supply selector 562 is configured to select the main battery package 561A by default and to select the backup battery package 561B upon detection of a failure of the main battery package 561A. Again, various mutually non-exclusive options are available. According to one option, upon detection of a failure of the main battery package 561A, the mode control utility 530 assumes a degraded mode of operation, such as prompting the driver to repair the power supply 560 and / or restricting the functionality of the vehicle. For example, limiting the maximum speed and / or disabling further use of the vehicle after a predefined time interval or after driving the vehicle a predefined number of kilometers after entering the degraded mode of operation. The backup battery pack 561B is intended for short-term use only, and therefore requires a smaller capacity compared to the main battery package 561A. Nevertheless, it helps prevent serious consequences in the event of a failure of the main battery package 561A. In some embodiments, the backup input power switch 563B is also controlled in normal operating mode to supply the backup controlled branch supply power P dc2 to the backup control branch 520, for example to enable end-to-end diagnostics. For example, in some embodiments, in a normal operating mode, the backup control branch supplies power Pdc2 is permanently available, allowing the diagnostic utility 515 to permanently verify the integrity status of the backup control branch 520. This causes the backup control branch 520 to operate as if it were actually being used, perhaps at a lower clock frequency, without being allowed to control the brake motor. In an alternative embodiment, a backup input power switch 563B is used to periodically power the backup control branch 520 during relatively short time intervals for performing end-to-end diagnostics, and to power it off outside of these relatively short time intervals.

[0046] 3 illustrates generally an exemplary operational mode diagram of the mode control utility 530 having multiple possible operational modes. A normal operational mode is designated M1 and a degraded operational mode is designated M2. The designation M0 indicates the operational state when the brake control unit 50 is powered off. In the illustrated example, the multiple possible operational modes include a power-on mode M01. Upon powering up the brake control unit 50, the mode control utility 530 initially assumes this transition mode M01, and the diagnostic utility 515 provides a control signal to the backup control branch 520 to cause the backup control branch 520 to generate a brake motor drive signal D 20 This allows the mode control utility 530 to temporarily generate the backup control branch 520 to generate the brake motor drive signal D 20 The diagnostic utility 515 enables the brake motor 12 to be driven by the brake motor drive signal D 205. Diagnose the operation of the backup control branch 520 by verifying the operation of the brake motor 12 in response to the motor angle signal. In some embodiments, the diagnostic utility 515 also performs this procedure on the primary control branch 510 during the power-up mode M01. If the diagnostic procedure in the operational mode indicates that both the primary control branch 510 and the backup control branch 520 have the required integrity state, the mode control utility 530 assumes a normal operating mode M1. If the primary control branch 510 is determined to lack integrity during the power-up mode or during operation in the normal operating mode M1, the mode control utility 530 assumes a degraded operating mode M2. In some embodiments, if the backup control branch 520 is determined to lack integrity during the power-up mode or during operation in the normal operating mode M1, the mode control utility 530 assumes a further degraded operating mode M3. In this mode of operation M3, the primary control branch 510 continues to provide the brake motor drive signal, but the backup control branch 520 is disabled, for example, by disconnecting it from the power source 560 using the backup input power switch 563B. Again, various non-mutually exclusive options are available for configuring the mode control utility to operate in the further degraded mode of operation M3. According to one option, the mode control utility 530 warns the driver to take appropriate steps, such as driving to a garage and / or reducing the speed of the vehicle. Depending on another or additional option, a means is provided to directly modify the operation of the vehicle to impose safer driving conditions or prevent further driving. In the embodiment shown, the possible modes of operation include a controlled power off mode M4. If, in any of the modes of operation M01, M1, M2, M3, it is determined that neither the primary control branch 510 nor the backup control branch 520 meet the integrity requirements, the mode control utility 530 may assume the controlled power off mode M4 and stop the vehicle.The remaining brakes that are still operational can then be used to apply a moderate braking force, allowing the driver to park the vehicle without posing a safety hazard. Also, in some embodiments, the brake unit that controls the brake motor opposite the one with the failed brake control unit 50 is disabled to avoid yaw forces.

[0047] FIG. 4 shows a schematic diagram of a brake control system 150 comprising an electric brake with a brake motor 12 and a brake control unit 50, for example as described with reference to FIG. 2, for driving the brake motor 12. In the example of FIG. 4, the brake control unit 50 is part of the vehicle control system 100 controlling various vehicle functions. The brake control unit 50 is configured to change the operation mode of at least one of said one or more additional control units 60, 70 according to its own operation mode. In the example of FIG. 4, this is shown diagrammatically by the brake control unit 50 providing a control signal CM to the one or more additional control units 60, 70. In practice, the various elements of the vehicle control system are configured to communicate with each other via a communication facility such as a CAN bus or a Bluetooth connection, rather than a dedicated control line. In some embodiments, the additional control unit may comprise a speed control unit 60 for controlling the speed of the vehicle. In these example embodiments, when the brake control unit 50 determines that it is not in a normal operation mode, it controls the speed control unit 60 to impose an upper limit on the speed at which the speed control unit 60 can drive the vehicle. In other examples of these embodiments, the mode control utility 530 additionally or alternatively causes the vehicle control system 100 to suspend vehicle operation upon determining that a predetermined time interval has elapsed and / or that the vehicle has been driven a predetermined distance since the operating mode was no longer in the normal operating mode. In some embodiments, the mode control utility 530 provides the driver with a grace period or limits further driving, up to a maximum distance sufficient to drive the vehicle to a garage.

[0048] As shown in Figures 5 and 6, not all components in the control unit need to have a backup counterpart. In the embodiment of Figures 5 and 6, the following additional functional components are provided that are communicatively coupled to one or both of the primary feedback controller 511B and the backup feedback controller 521B depending on the mode of operation. These functional components are: Wheel Speed ​​Interface 570 A first communication interface 572, for example a first CAN bus A second communication interface 574, e.g. a second CAN bus Motor Angle Sensor 576 In one embodiment, the latter is a dual angle sensor.

[0049] For each of these functional components, a respective signal and power switch 571, 573, 575, 577 is provided to control the routing of input and / or output signals to one or both of the primary feedback controller 511B and the backup feedback controller 521B depending on the mode of operation.

[0050] FIG. 5 illustrates an operating mode in which the output signals of the wheel speed interface 570 and the angle sensor 576 are sent to the primary feedback controller 511B via the respective signal and power switches 571, 577. Furthermore, in this mode, the signal and power switches 573, 575 are configured to allow the primary feedback controller 511B to communicate bidirectionally via the first and second communication interfaces 572, 574, respectively. In the example of FIG. 5, the operating mode is considered to be a normal operating mode M1 in which power is provided by the main power source 561A, as indicated diagrammatically by the reference "MP". In a degraded operating mode in which the main power source 561A is defective but the primary control branch 510 is functioning properly, the additional functional components are powered by the backup power source 561B.

[0051] FIG. 6 shows degraded operating modes M2, M3 that are selected, for example, when the primary control branch 510 is defective, and instead the output signals of the wheel speed interface 570 and the angle sensor 576 are sent to the backup feedback controller 521B via the respective signal and power switches 571, 577. Also, in these degraded operating modes, the signal and power switches 573, 575 are configured to allow the backup feedback controller 521B to communicate bidirectionally via the first and second communication interfaces 572, 574, respectively. In the example of FIG. 6, it is presumed that the main power source 561A has failed in these degraded operating modes. Therefore, power is provided from the backup power source 561B, as indicated by the symbol "BP". In other cases, when the primary control branch 510 has failed but the main power source 561A is normal, power is normally provided by the main power source.

[0052] Exemplary embodiments of the power switches 571, 573, 575, 577 include switches, multiplexers, signal doublers, and / or other circuits for routing or multiplying signals. In the embodiment shown in FIG. 5, FIG. 6, it is assumed that either the primary feedback controller 511B (FIG. 5) or the backup feedback controller 521B (FIG. 6) is communicatively coupled to the functional components 570, 572, 574, 576. In other embodiments, the primary feedback controller 511B and the backup feedback controller 521B are both capable of receiving and / or transmitting one or more signals. As an example, in one embodiment, in a normal operating mode, the primary feedback controller 511B and the backup feedback controller 521B both receive a motor angle signal from the motor angle sensor 576.

[0053] In some embodiments, the units and / or devices are implemented using hardware, software, and / or a combination thereof. Exemplary embodiments of hardware devices include processing circuitry such as, but not limited to, a processor, a central processing unit (CPU), a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a system on a chip (SoC), a programmable logic unit, a microprocessor, or other device capable of responding to and executing instructions in a defined manner.

[0054] Examples of software include computer programs, program code, instructions, or any combination thereof, which independently or collectively instruct or configure a hardware device to operate as required. Examples of computer programs and / or program code include programs or computer readable instructions, software components, software modules, data files, data structures, etc., executable by one or more hardware devices, such as one or more of the hardware devices listed above. Examples of program code include both machine code produced by a compiler and higher level program code executed using an interpreter.

[0055] In interpreting the appended claims, it should be understood that the word "comprising" does not exclude the presence of elements or acts other than those recited in a particular claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of elements. Reference signs in a claim do not limit its scope. Several "means" can be represented by the same or different items or implemented structures or functions. Any of the disclosed devices or parts thereof can be combined together or separated into further parts, unless otherwise specified. When a claim refers to another claim, this may indicate synergistic effects achieved by the combination of the respective features. However, the mere fact that certain means are recited in mutually different claims does not indicate that a combination of these means cannot be used to advantage. Thus, the present embodiments may include all functional combinations of claims, each of which may in principle refer to any preceding claim, unless clearly excluded by the context. [Explanation of symbols]

[0056] D 10 Primary Motor Drive Signal D 20 Backup motor drive signal En 510 Primary branch enable signal En 520 Backup Branch Enable Signal En 516 Primary branch phase cutoff switch control signal En 526 Backup branch phase cutoff switch control signal En 563a Control signal of the primary branch input power switch 563a En 563ab Control signal for backup branch input power switch 563b M0 Power off mode M01 Power-on mode M1 Normal operation mode M2 Degraded Operation Mode M3 Further degraded operating mode M4 Controlled Power Off Mode P dc1 Primary Controlled Branch Power P dc2 Backup Controlled Branch Supply Power 1 Primary Gear 12 Electric brake motor 30 Brake Transmission 40 Brake Mechanism 41 Caliper 42 Brake disc 50 Brake control unit 60,70 Additional control units 60 Speed ​​Control Unit 100 Vehicle Control System 150 Electric Brake System 510 Primary Control Branch 511 Primary Control Module 511a, 511b, 511c Primary Control Components 511a Power Management Controller 511b Primary Feedback Controller 511c First Pre-driver 512 Primary Inverter 515 Diagnostic Utility 515a, 515b, 515c diagnostic units 516 Primary branch phase cutoff switch 517 Primary branch EMI filter 520 Backup Control Branch 521 Backup Control Module 511a, 511b, 511c Backup Control Components 521a Backup Power Management Controller 521b Backup Feedback Controller 521c Backup Pre-driver 522 Backup inverter 526 Backup Branch Phase Cut-Off Switch 527 Backup branch EMI filter 530 Mode Control Utility 550 Signal Selector 561a Main Battery Package 561b Backup Battery Package 562 Power Selector 563a Primary branch input power switch 563b Backup Branch Input Power Switch 570 Wheel Speed ​​Interface 571 570 Signal and Power Switches 572 First communication interface 573 572 Signal and Power Switches 574 Second Communication Interface 575 574 Signal and Power Switches 576 Motor Angle Sensor 577 576 Signal and Power Switches

Claims

1. A brake control unit (50) comprising a primary control branch (510), a backup control branch (520), a diagnostic utility (515), and a mode control utility (530), The primary control branch (510) comprises a primary inverter (512) and a primary control module (511) for controlling the operation of the primary inverter; The backup control branch (520) includes a backup inverter (522) and a backup control module (521) for controlling the operation of the backup inverter; The diagnostic utility (515) checks the integrity status (S ＩＮＴ ) , The mode control utility (530) determines the integrity status (S ＩＮＴ selecting an operation mode of said brake control unit from a plurality of possible operation modes (M0-M4) including at least a normal operation mode (M1) and a degraded operation mode (M2, M3) in accordance with the determination of Each of the primary control branch (510) and the backup control branch (520) receives an external brake control signal (I Ｂ ) to generate a first brake motor drive signal (D 10 ) and a second brake motor drive signal (D 20 ) at respective inverters controlled by respective control modules in response to said first brake motor drive signal (D 10 ) and said second brake motor drive signal (D 20 ); The primary control module (511) includes at least first and second mutually cooperating primary control components (511A, 511B) having respective first and second diagnostic units (515a, 515b), the first and second mutually cooperating primary control components (511A, 511B) being part of the diagnostic utility (515) in that the first diagnostic unit (515a) of the first primary control component (511A) is configured to diagnose (QA) the integrity of the second primary control component (511B) and the second diagnostic unit (515b) of the second primary control component (511B) is configured to diagnose (QA) the integrity of the first primary control component (511A), the diagnostic utility (515) being configured to diagnose (QA) the integrity of the first primary control component (511A), Ｔ ) the backup control branch response signal (S Ｒ a third diagnostic unit (515c) configured to diagnose an integrity status of said backup control branch (520) by verifying a first fault condition (F1) of said backup control branch (520).

2. The mode control utility (530) is configured to maintain operation of the backup control branch (520) during the normal operation mode, and the diagnostic utility (515) is configured to monitor the response signal (S) of the backup control branch (520). Ｒ ) is compared with a reference response signal, and the response signal (S Ｒ 2. The brake control unit (50) of claim 1, configured to report a lack of integrity of the backup control branch (520) to the mode control utility (530) when a substantial difference between the backup control branch (520) and the reference response signal is determined.

3. The test signal (S Ｔ ) is the external brake control signal (I Ｂ 3. The brake control unit (50) of claim 2, wherein the brake control unit (50) simulates a brake control circuit (10) for controlling a brake force distribution.

4. The response signal (S Ｒ ) indicates a control signal provided by the backup control module to the backup inverter; The brake control unit (50) of claim 3, wherein the reference response signal is indicative of a control signal provided by the primary control module to the primary inverter.

5. The mode control utility (530) is configured to enable both the primary control branch (510) and the backup control branch (520) to generate the first brake motor drive signal (D 10 ) and the second brake motor drive signal (D 20 ), respectively, and the brake control unit (50) receives the first brake motor drive signal (D 10 ) from the primary control branch (510) in the normal operation mode. １０ ) and in the degraded operating mode, the second brake motor drive signal (D ２０ ) controlled by said mode control utility, and Ｒ ) is the second brake motor drive signal (D ２０ ), and the reference response signal represents the first brake motor drive signal (D １０ 4. The brake control unit (50) of claim 3, further comprising:

6. A set of possible operating modes includes providing the backup control branch (520) with the second brake motor drive signal (D ２０ ), and the mode control utility (530) controls the backup control branch (520) to generate the second brake motor drive signal (D ２０ ) to temporarily drive the brake motor (12), and the diagnostic utility (515) detects the second brake motor drive signal (D ２０ The brake control unit (50) of any one of claims 1 to 5, further comprising a step of diagnosing the operation of the backup control branch (520) by verifying the operation of the brake motor (12) in response to a brake motor failure signal.

7. 7. The brake control unit (50) of claim 1, wherein the plurality of possible operating modes includes a further degraded operating mode (M3) in which the mode control utility (530) selects the primary control branch (510) as the source of the first brake motor drive signal (D 10 ), and the mode control utility (530) selects the further degraded operating mode (M3) if the diagnostic utility (515) determines a lack of integrity of the backup control branch (520) but determines that the primary control branch (510) meets integrity requirements.

8. 8. The brake control unit (50) of claim 7, wherein the mode control utility (530) completely disables operation of the backup control branch (520) in the further degraded mode of operation (M3).

9. The brake control unit (50) of any one of claims 1 to 8, wherein the backup control branch (520) has limited auto-diagnostic capabilities including one or more of checksum verification and out-of-range signal verification.

10. The brake control unit (50) of any one of claims 1 to 9, wherein the first primary control component (511A) is a power management controller and the second primary control component (511B) is a microcontroller for feedback control of a brake motor.

11. An electric brake system comprising a brake control unit (50) according to any one of the preceding claims and a vehicle brake motor (12) controlled by said brake control unit.

12. A vehicle control system (100) comprising an electric brake system having a brake control unit (50) according to any one of claims 1 to 10 and one or more additional control units (60, 70) for controlling additional vehicle functions, A vehicle control system (100), wherein the brake control unit (50) is configured to change at least one operation mode of the one or more additional control units (60, 70) according to its own operation mode.

13. 13. The vehicle control system (100) of claim 12, wherein one of the one or more additional control units (60, 70) is a speed control unit (60) that controls the speed of the vehicle, and the brake control unit (50) imposes an upper limit on the speed at which the speed control unit (60) can drive the vehicle in an operating mode other than a normal operating mode.

14. 14. The vehicle control system (100) of claim 12 or 13, wherein the brake control unit (50) causes the vehicle control system (100) to cease vehicle operation when it determines that a predetermined time interval has elapsed since the operating mode was no longer in the normal operating mode and / or that the vehicle has traveled a predetermined distance.

15. External brake control signal (I Ｂ 1. A method for controlling a brake motor (12) of a vehicle, comprising the steps of: generating a brake motor drive signal (Do) in response to a vehicle speed; Providing a primary control branch (510) and a backup control branch (520), the primary control branch (510) having a primary inverter (512) and a primary control module (511) for controlling the operation of the primary inverter, the primary control module (511) including at least first and second mutually cooperating primary control components (511A, 511B); the backup control branch (520) having a backup inverter (522) and a backup control module (521) for controlling the operation of the backup inverter; The integrity state (S ＩＮＴ selecting an operating mode from a plurality of possible operating modes (M0-M4) in accordance with the determination of (M0-M4), said possible operating modes comprising at least one of a normal operating mode (M1) and a degraded operating mode (M2, M3); During said normal operating mode (M1), the step of enabling said primary control branch (510) to exclusively generate said brake motor drive signal (Do) in response to said external brake control signal, said normal operating mode determining an integrity state comprises: said at least first and second mutually cooperating primary control components diagnosing each other's integrity status; The primary control branch receives a test signal (S Ｔ ) the backup control branch response signal (S Ｒ ) further diagnosing the integrity status of the backup control branch (520) by verifying and During the derated mode of operation, the backup control branch (520) controls the brake motor drive signal (D ｏ ) exclusively generated by the A method for controlling a brake motor (12) of a vehicle, comprising:

Images