DE102018222313A1 - Brake system for an autonomous vehicle - Google Patents

Abstract

The invention relates to a brake system in an at least partially autonomous vehicle, with at least one vehicle wheel brake (1), which is associated with both a primary brake control system (BRS1) and a redundant secondary brake control system (BRS2), the primary in normal driving operation -Brake control system (BRS1) is activated, which generates a control signal (y) on the basis of a target deceleration specification (V) generated in a pilot system (11) in order to actuate the vehicle wheel brake (1), and wherein the primary brake control system (BRS1) carries out an actuator diagnosis in which it is determined whether there is a fault in the primary brake control system (BRS1), and if there is a fault in the primary brake control system (BRS1), the secondary brake control system (BRS2) is activated, which instead of the primary brake control system (BRS1) controls the vehicle wheel brake (1) on the basis of the target deceleration specification (V).

Description

The invention relates to a braking system in an at least partially autonomous vehicle according to the preamble of claim 1 and a method for operating such a braking system according to claim 10.

In an at least partially autonomous vehicle, the brake system must be designed for autonomous brake pressure build-up and for autonomous wheel slip control (ABS functions). Depending on the system design, the braking system must perform both braking and steering tasks in the event of a fault and automatically bring the vehicle to a standstill and hold it safely. For this purpose, the brake system can be designed with a primary brake control system and a secondary, redundant brake control system.

In a generic brake system, the at least one vehicle wheel brake is assigned both a primary brake control system and a redundant secondary brake control system. In normal driving, the primary brake control system is activated, which generates a control signal on the basis of a target deceleration specification generated in a pilot system and thus controls a primary actuator in order to actuate the vehicle wheel brake. To monitor the brake system, the primary brake control system has a primary diagnostic module which carries out an actuator diagnosis in which at least one actuator parameter of the primary actuator is monitored.

In the case of a hydraulically actuable vehicle wheel brake, the primary actuator has a pressure build-up actuator (hereinafter, e.g. a hydraulic pump) and a control valve as hydraulic components. In this case, a speed signal for the pump motor of the hydraulic pump and a valve control signal for the control valve are generated as a control signal in the primary brake control system. An actual speed of the pump motor, an actual current consumption of the pump motor and / or an actual hydraulic pressure applied to the brake hydraulic cylinder can be recorded as actuator parameters in the primary brake control system.

On the basis of the above actuator parameters, the primary diagnostic module determines whether there is a fault in the primary brake control system. In the event of a fault, the primary brake control system activates the secondary brake control system, which controls the vehicle wheel brake instead of the primary brake control system on the basis of the target deceleration specification.

In the prior art, in the event of a fault, the primary brake control system is switched over to the secondary brake control system in a serial process sequence. In the case of the sequential process sequence, the presence of an error is first determined in the primary diagnostic module. A switchover signal is then generated in the primary brake control system in order to activate the redundant secondary brake control system. After its activation, the secondary brake control system takes over the implementation of the target deceleration specification of the pilot system, whereupon the pressure build-up in the vehicle wheel brake is carried out by the secondary brake control system.

The above serial process sequence is associated with a high computing time expenditure and a high signal processing expenditure.

From the DE 10 2014 208 391 A1 a method for operating a vehicle is known. From the DE 10 2014 220 441 A1 , from the DE 10 2017 204 157 A1 and from the DE 10 2016 203 563 A1 further brake systems for a vehicle are known.

The object of the invention is to provide a brake system or brake system in an at least partially autonomous vehicle, in which, in the event of a fault, the redundant secondary brake control system can be activated more quickly than in the prior art.

The object is solved by the features of claim 1 or 10. Preferred developments of the invention are disclosed in the subclaims.

According to the invention, the redundant secondary brake control system has a secondary diagnostic module with which the operation of the primary brake control system can be monitored. For this purpose, the secondary diagnostic module detects at least one actuator parameter of the primary actuator in the primary brake control system. In normal driving operation, therefore, both the primary diagnostic module and the secondary diagnostic module each carry out an actuator diagnosis of the primary actuator in parallel operation. A significant deviation of the actuator parameters of the primary actuator from reference values is therefore recognized immediately, ie without a signal detour via the primary diagnostic module, in the secondary diagnostic module. In the event of a fault in the primary actuator, the redundant secondary brake control system is therefore activated immediately, regardless of the actuator diagnosis that is subject to computing time and takes place in the primary diagnostic module. In this way, in the event of a fault, the redundant secondary brake control system can implement the target deceleration specification of the process time which is shorter than the prior art Take over the pilot system from the primary brake control system.

The essence of the invention therefore generally relates to the fact that the secondary brake control system monitors state variables of the primary brake control system (for example system pressure or actuator current). The status information of the primary brake control system can be transmitted to the secondary brake control system via bus signals or a direct connection (wired signals). If no activity of the primary brake control system is detected via the above-mentioned signals upon receipt of a delay specification after a period to be defined, the pressure is built up by the secondary brake control system. The pressure build-up by the secondary brake control system can be carried out in two steps: in a first process step, the vehicle brake can remain inactive for a period of less than a first limit value. If the first limit value is exceeded, the brake pads can be applied to the brake disc in a second process step (prefill state). If a further limit value is exceeded, the secondary brake control system can build up pressure completely.

In a technical implementation, the primary brake control system can have a primary control unit in addition to the primary actuator and the primary diagnostic module. On the basis of the target deceleration specification, the control signal is generated in the primary control unit, with which the primary actuator can be actuated in order to actuate the vehicle wheel brake. Preferably, the primary brake control system and the redundant secondary brake control system can each have identical primary and secondary actuators. In addition, the secondary brake control system can have a secondary control unit. When the secondary brake control system is activated, the secondary control device can generate an actuating signal on the basis of the target deceleration specification, with which the secondary actuator can be actuated in order to actuate the vehicle wheel brake.

In a common implementation, the vehicle wheel brake can be operated hydraulically. In this case, the vehicle wheel brake has a hydraulically controllable hydraulic cylinder, with which brake pads can be brought into a pressure system against a rotating brake disc. The primary / secondary actuator can have a pressure build-up actuator (hereinafter e.g. a hydraulic pump) and a control valve as hydraulic components. In the following aspects of the invention, a hydraulic pump is specifically used as the pressure build-up actuator, but the invention is not restricted to the use of a hydraulic pump. Therefore, the primary / secondary control device can generate a speed signal for the pump motor of the hydraulic pump and / or a valve control signal for the control valve as the control signal.

In the above hydraulic system, the actual speed of the pump motor of the hydraulic pump, the actual current consumption of the pump motor and / or the actual hydraulic pressure applied to the brake hydraulic cylinder can be recorded as actuator parameters. Both the primary diagnostic module and the secondary diagnostic module can carry out the final control diagnosis of the primary final control element in parallel operation on the basis of these actuator parameters (ie actual speed, actual current consumption and / or actual hydraulic pressure).

In a preferred embodiment variant, the secondary diagnostic module can have a timing element in which an error time interval is recorded at which the error case determined in the secondary diagnostic module is present. The secondary control unit can vary the control signal depending on the length of the fault time interval. As an example, the secondary control unit in the secondary brake control system cannot generate an actuating signal (i.e. the secondary actuator is not actuated) in spite of the presence of a fault until the fault duration exceeds a first limit value. In addition, the secondary control unit in the secondary brake control system can generate a preparatory actuating signal in the event of a fault duration greater than the first limit value and until a second limit value is reached. The preparation control signal does not yet result in a brake intervention that correlates with the target deceleration specification. Rather, the brake pads of the vehicle wheel brake are preliminarily brought into contact with the rotating brake disc in order to be ready for a brake intervention that is likely to take place. If the fault duration exceeds the second limit value, the preparation control signal is increased to a brake intervention control signal which correlates with the target deceleration specification in order to carry out the brake intervention.

An exemplary embodiment of the invention is described below with reference to the attached figures.

• 1 in einem allgemeinen Blockschaltdiagramm ein Bremssystem für eine Fahrzeugrad-Bremse eines zumindest teilweise autonomen Fahrzeugs;
• 2 ein weiteres Blockschaltdiagramm des Bremssystems in einer detaillierteren Darstellung;
• 3 in einem Blockschaltbild die Programmbausteine des Primär-Diagnosemoduls;
• 4 in einem Blockschaltbild die Programmbausteine des Sekundär-Diagnosemoduls;
• 5 ein Stellsignal-Zeit-Diagramm; und
• 6 in einer Ansicht entsprechend der 2 ein aus dem Stand der Technik bekanntes Bremssystem.

Show it:

• 1 in a general block diagram, a brake system for a vehicle wheel brake of an at least partially autonomous vehicle;
• 2nd another block diagram of the brake system in a more detailed representation;
• 3rd the program modules of the primary diagnostic module in a block diagram;
• 4th in a block diagram the program blocks of the secondary diagnostic module;
• 5 a control signal-time diagram; and
• 6 in a view corresponding to the 2nd a brake system known from the prior art.

In the 1 is roughly schematic of the structure of a braking system according to the invention or a brake system for a vehicle wheel brake 1 of an autonomous vehicle. The vehicle wheel brake 1 has one via a hydraulic cylinder 3rd ( 2nd ) operable brake caliper 5 as well as a brake disc 7 on. When the vehicle wheel brake is applied 1 becomes the hydraulic cylinder 3rd pressurized, causing the brake caliper 5 with its brake pads, not shown, in pressure system with the brake disc 7 is coming.

The vehicle wheel brake 1 is a primary brake control system BRS1 and a redundant secondary brake control system BRS2 assigned. The two brake control systems BRS1 and BRS2 are on the output side via hydraulic lines 9 in flow connection with the hydraulic cylinder 3rd the vehicle wheel brake 1 . At the signal input of the primary brake control system BRS1 and the secondary brake control system BRS2 one is in a pilot system 11 automatically generated target deceleration V _should on. The pilot system 11 is about this via signal lines 13 both with the input side of the primary brake control system BRS1 as well as with the input side of the secondary brake control system BRS2 in signal connection.

The primary brake control system is in normal driving operation BRS1 activated, based on the target deceleration V _should generates a hydraulic pressure p on the hydraulic cylinder 3rd the vehicle wheel brake 1 is present. If a primary diagnostic module 17th ( 2nd or 3rd ) in the primary brake control system BRS1 the presence of an error is determined, the secondary brake control system BRS2 activated. In this case, the secondary brake control system controls BRS2 - instead of the primary brake control system BRS1 - on the basis of the target deceleration specification V _should the vehicle wheel brake 1 on.

Like in the 1 by the arrow 15 is indicated, is between the primary brake control system BRS1 and the secondary brake control system BRS2 there is a signal connection. Via the signal connection 15 status information (hereinafter actuator parameters n is ₁ , l is ₁ , p is ₁ ) to the secondary brake control system BRS2 passed, so that in normal driving also in the secondary brake control system BRS2 the operability of the primary brake control system BRS1 is diagnosable. If in the secondary brake control system BRS2 a fault in the primary brake control system BRS1 has been determined, the secondary brake control system immediately BRS2 activated, regardless of one in the primary diagnostic module 17th of the primary brake control system BRS1 final, time-dependent actuator diagnosis.

With a view to a simple understanding of the invention, reference is first made to the 6 taken in which a brake system known from the prior art is set forth insofar as is necessary for an understanding of the invention. As a result, the primary brake control system BRS1 has a primary control unit 19th and a primary actuator 21st on. The primary control unit 19th has a converter unit as program modules 23 on, based on the existing target deceleration V _should an actuating signal y is generated with which the primary actuator 21st is controlled to the vehicle wheel brake 1 to operate. In the 1 has the primary actuator 21st a hydraulic pump as hydraulic components 25th (or another pressure build-up actuator) and a hydraulic control valve 27 on. The primary control unit generates accordingly 19th as control signal y both a speed signal n for the control of a pump motor 29 the hydraulic pump 25th as well as a valve control signal S for the control of the hydraulic control valve 27 .

As from the 6 further shows, the primary control unit 19th a primary diagnostic module 17th on that in signal connection with a speed sensor 33 and an ammeter 35 of the pump motor 29 as well as with a pressure sensor 37 with the help of an actual speed n is ₁ , an actual current consumption I is ₁ and an actual pressure p is ₁ is detected on the hydraulic cylinder 3rd is present. Based on these actuator parameters n is ₁ , l is ₁ , p is ₁ determines the primary diagnostic module 17th whether in the primary brake control system BRS1 there is an error. If there is a fault in the primary brake control system BRS1 is in the primary brake control system BRS1 a switching signal S _T generated that over a signal line 39 from the primary brake control system BRS1 to the secondary brake control system BRS2 is routed to the secondary brake control system BRS2 to activate. In this case, instead of the primary brake control system BRS1 , the secondary brake control system BRS2 the implementation of the target deceleration target V _should of the pilot system 11 take over.

In the 6 is the primary brake control system BRS1 and the secondary brake control system BRS2 essentially constructed identically. The secondary brake control system BRS2 shows - similar to the primary brake control system BRS1 - a secondary control unit 53 and a secondary actuator 48 on. The secondary control unit 53 has a secondary converter unit as program modules 49 on. With activated secondary brake control system BRS2 (ie in the event of an error) is based on the set target deceleration V _should generates an actuating signal y with which the secondary actuator 48 is controlled to the vehicle wheel brake 1 to operate. In the 6 has the secondary actuator 48 , as well as the primary actuator 21st , a hydraulic pump as hydraulic components 25th as well as a hydraulic control valve 27 on. The secondary converter unit is used to control these hydraulic components 49 as control signal y both a speed signal n for the control of a pump motor 29 the hydraulic pump 25th as well as a valve control signal S for the control of the hydraulic control valve 27 .

As from the 6 further emerges, the secondary control unit points 49 a secondary diagnostic module 46 on that in signal connection with a speed sensor 33 and an ammeter 35 of the pump motor 29 as well as with a pressure sensor 37 with the help of an actual speed n is ₂ , an actual current consumption I is ₂ and an actual pressure p is ₂ is detected on the hydraulic cylinder 3rd is present. Based on these actuator parameters n is ₂ , l is ₂ , p is ₂ determines the secondary diagnostic module 46 whether in the primary brake control system BRS2 there is an error.

In the 6 In the event of a fault, the primary brake control system is switched over BRS1 to the secondary brake control system BRS2 in a serial process sequence. In the serial process sequence, the primary diagnostic module 17th in a diagnostic routine ( 3rd ) determines whether there is an error. A comparator block compares in the diagnostic routine 41 from the sensors 33 , 35 , 37 recorded actuator parameters n is ₁ , l is ₁ , p is ₁ with assigned reference values nref, Iref, pref. The reference values are from a map 43 in the comparator block 41 of the primary diagnostic module 17th read out. If there is a significant deviation in the actuator parameters n is ₁ , l is ₁ , p is ₁ of the assigned reference values nref, Iref, pref is in a signal generation unit 45 an error signal S _error generated. Based on the error signal S _error is in the primary brake control system BRS1 becomes a switching signal S _T generated to the secondary brake control system BRS2 to activate.

The above serial process sequence up to the activation of the secondary brake control system BRS2 with the switching signal S _T is associated with a high computing time expenditure and a high signal processing expenditure, whereby the secondary brake control system BRS2 is activated with a time delay.

In contrast to the 6 is the following in the 2nd shown brake system according to the invention described: So in the 2nd the primary braking system BRS1 identical to that in the 6 built up. To a compared to 6 accelerated and robust activation of the redundant secondary brake control system BRS2 to enable, the secondary control unit 53 a secondary diagnostic module according to the invention 47 on that over the signal link 15 with the primary brake control system BRS1 is connected. The signal connection 15 consists in the 2nd from three signal lines, through which the secondary diagnostic module 47 the actuator parameters recorded by the sensors n is ₁ , l is ₁ , p is ₁ to the secondary diagnostic module 47 directs. In this way, both the primary diagnostic module can be used during normal driving 17th as well as the secondary diagnostic module 47 an actuator diagnosis of the primary actuator 21st carry out. Therefore, it is immediately in the secondary diagnostic module 47 detects whether in the primary brake control system BRS1 there is an error or not, regardless of that in the primary diagnostic module 17th Actuator diagnosis involving computing time.

If there is a fault in the primary brake control system BRS1 can - compared to 6 - An accelerated and more robust activation of the secondary brake control system BRS2 respectively.

In the 4th are the program blocks of the secondary diagnostic module in a block diagram 47 shown. As a result, as in the primary diagnostic module 17th ( 3rd ), a comparator module 41 , a map 43 and a signal generating unit 45 intended. In addition, there is a secondary diagnostic module 47 a timer 50 on that is a fault duration Δt _F recorded in the in the secondary diagnostic module 47 determined error is present. In the 4th is in the secondary converter module 49 of the secondary control unit 53 on the basis of the target deceleration set at the signal input V _should as a control signal y, a speed signal n and a control signal S for the control valve 55 generated. As from the 4th further emerges, the secondary converter unit 49 a further signal input on which one with the fault duration Δt _F there is a correlating signal. In this way, the generation of the control signal y in the secondary converter unit 49 depending on the size of the fault duration Δt _F respectively.

So in the 4th the secondary converter unit 49 Despite the presence of an error, do not generate a control signal y until the error duration Δt _F a first limit t ₁ exceeds. In addition, the secondary converter unit 53 in the event of a fault Δt _F greater than the first limit t ₁ as well as less than a second limit t ₂ a preparatory control signal y _prefill generate, in which the brake pads of the vehicle wheel brake 1 loose in contact with their brake disc 7 are brought. In the event of an error period Δt _F In contrast, one with the target deceleration specification can be greater than the second limit value t ₂ V _should Correlating brake intervention control signal y are generated.

QUOTES INCLUDE IN THE DESCRIPTION

This list of documents listed by the applicant has been generated automatically and is only included for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• DE 102014208391 A1 [0008]
• DE 102014220441 A1 [0008]
• DE 102017204157 A1 [0008]
• DE 102016203563 A1 [0008]

Claims (10)

Braking system in an at least partially autonomous vehicle, with at least one vehicle wheel brake (1), which is assigned to both a primary brake control system (BRS1) and a redundant secondary brake control system (BRS2), the primary brake control system (BRS1 ) is activated, which generates a control signal (y) on the basis of a target deceleration specification (V _soll ) generated in a pilot system (11) in order to actuate the vehicle wheel brake (1), and wherein the primary brake control system (BRS1) carries out an actuator diagnosis, in which it is determined whether there is a fault in the primary brake control system (BRS1), and if there is a fault in the primary brake control system (BRS1), the secondary brake control system (BRS2) is activated, which instead of the primary Brake control system (BRS1) controls the vehicle wheel brake (1) on the basis of the target deceleration specification (V _soll ), characterized in that the secondary brake control system (BRS2) has a signal connection (15) receives status information (n _ist1 , l _ist1 , p _ist1 ) of the primary brake control system (BRS1), on the basis of which an actuator diagnosis of the primary brake control system (BRS1) can be carried out in the secondary brake control system (BRS1), and that in the event of a fault in the primary brake control system (BRS1), the secondary brake control system (BRS2) can be activated, directly on the basis of the actuator diagnosis made in the secondary brake control system (BRS2) and independently of that in the primary brake control system (BRS1) final, time-dependent actuator diagnosis. Braking system after Claim 1 , characterized in that, during normal driving, the primary brake control system (BRS1) controls a primary actuator (21) with the actuating signal (y) to actuate the vehicle wheel brake (1), and that the primary brake control system (BRS1) has a primary diagnostic module (17) that performs the actuator diagnosis, in which at least one actuator parameter (n _ist1 , l _ist1 , p _ist1 ) of the primary actuator (21) is detected, and that on the basis of the actuator -Parameters (n _ist1 , l _ist1 , p _ist1 ) of the primary actuator (21) it is determined whether there is a fault in the primary brake control system (BRS1) and that if there is a fault in the primary brake control system (BRS1) the secondary brake control system (BRS2) is activated, which controls the vehicle wheel brake (1) instead of the primary brake control system (BRS1) on the basis of the target deceleration specification (V _soll ). Braking system after Claim 2 , characterized in that the secondary brake control system (BRS2) has a secondary diagnostic module (47) to which the actuator parameter (n _ist1 , l _ist1 , p _ist1 ) of the primary actuator (21) is routed, and in that During normal operation, both the primary diagnostic module (17) and the secondary diagnostic module (47) in parallel operation carry out final control diagnosis of the primary final control element (21) and that the secondary brake control system (BRS2) can be activated in the event of an error , directly on the basis of the actuator diagnosis carried out in the secondary diagnosis module (47) and independently of the actuator diagnosis which is subject to computing time and takes place in the primary diagnosis module (17) of the primary brake control system (BRS1). Braking system after Claim 2 or 3rd , characterized in that the primary brake control system (BRS1) has, in addition to the primary actuator (21) and the primary diagnostic module (17), a primary converter unit (23), by means of which, on the basis of the target deceleration specification (V _soll ) the control signal (y) is generated, and / or that the primary brake control system (BRS1) and the redundant secondary brake control system (BRS2) have, in particular, identical primary and secondary actuators (21, 48), and / or that the secondary Brake control system (BRS2) has a secondary control unit (53) which, when the secondary brake control system (BRS2) is activated, generates an actuating signal (y) on the basis of the desired deceleration specification (V _soll ), with which the secondary actuator (48) can be controlled is to actuate the vehicle wheel brake (1). Braking system after Claim 2 , 3rd or 4th , characterized in that the vehicle wheel brake (1) has a hydraulically controllable brake cylinder (3), and in particular that the primary and secondary actuators (21, 48) as hydraulic components have a pressure build-up actuator, in particular a hydraulic pump (25), and a control valve (27), and that in particular the primary or secondary control device (19, 53) as a control signal (y), a control signal (s) for the pressure build-up actuator (25) and / or a valve control signal (S) for the control valve (27) generated. Braking system after Claim 2 , 3rd , 4th or 5 , characterized in that in the primary brake control system (BRS1) the actual speed (n _ist1 ) of a drive motor (M) of the hydraulic pump (25), the actual current consumption (l _ist1 ) of the pump motor (EM) and / or or the actual hydraulic pressure (p _ist1 ) applied to the brake hydraulic cylinder (3) can be detected, and that in particular the primary diagnostic module (17) and the secondary diagnostic module (47) in parallel operation and in normal driving operation on the basis of the actual rotational speed (nist) of the actual current consumption (l _ACT1) and / or the actual hydraulic pressure (p _ACT1) the actuator performs diagnosis of the primary actuator (21). Braking system according to one of the preceding Claims 2 to 6 , characterized in that the secondary diagnostic module (47) has a timing element (51) which detects a fault duration (Δt _F ) at which the fault is detected in the secondary diagnostic module (47), and that the secondary control unit ( 53) the control signal (y) varies depending on the length of the fault case duration (Δt _F ). Braking system after Claim 7 , characterized in that the secondary control unit (53) in the secondary brake control system (BRS2) does not generate a control signal (y), in spite of a fault, until the fault duration (Δt _F ) exceeds a first limit value (t ₁ ), and / or that the secondary control unit (53) in the secondary brake control system (BRS2) is larger than the first limit value (t ₁ ) in the event of a fault (Δt _F ) and a preparation control signal is reached until a second limit value (t ₂ ) is reached (y _prefill ) generated, in which the brake pads of the vehicle _wheel brake (1) are loosely in _contact with their brake disc (7). Braking system after Claim 8 , characterized in that in the event of a fault (Δt _F ) greater than the secondary limit value (t ₂ ), a brake intervention control signal (y) which is correlated with the target deceleration specification (V _soll ) is generated. Method for operating a brake system according to one of the preceding claims.

Images