EP1855924A1

EP1855924A1 - System for electronically controlling a motor vehicle brakes

Info

Publication number: EP1855924A1
Application number: EP06724971A
Authority: EP
Inventors: Wolfgang Fey; Michael Zydek; Stefan Sommer
Original assignee: Continental Teves AG and Co OHG
Current assignee: Continental Teves AG and Co OHG
Priority date: 2005-03-10
Filing date: 2006-03-08
Publication date: 2007-11-21
Also published as: WO2006094991A1; US20080312790A1; DE102006008958A1; KR20070107115A; JP2008532836A

Abstract

The invention concerns a system for controlling a motor vehicle brakes, comprising standard functional units provided with a braking electronic regulator and a hydraulic unit in particularly fixed connection with the regulator, said electronic regulator including a redundant or partly redundant system of microprocessors with several central units (UC) and standard functional units having a controlling and regulating philosophy at least for an anti-skidding system. Said control system also comprises non-standard hardware and software functional units of an external safety system for protecting the passengers of a motor vehicle, said system being passive, that is it does not intervene directly in the vehicle dynamics. Said units are integrated in the field of the motor vehicle brake control system, "field" meaning that the non-standard hardware and software functional units to be integrated are placed at least in the direct vicinity of the standard braking electronic control regulator.

Description

Electronic motor vehicle brake control unit

The invention relates to an electronic brake control device for motor vehicles according to the preamble of claim 1.

Electronic control units for motor vehicle brake systems are widely known and are increasingly in addition to the function anti-lock braking system (ABS) also various additional functions, such as traction control (ASR) and electronic brake distribution (EBV), but also features for active driving safety, such as electronic stability program (ESP) ready ,

While ABS, ARS and EBV can be regarded as longitudinally dynamic safety devices, ESP serves to increase safety in the event of lateral dynamic influences on the vehicle. Especially the latter system can be considered even more than the previously mentioned as an active safety system because of its driver-independent braking or even steering intervention (ESP the newer generation).

In addition, in the field of passive safety systems, various airbag arrangements have prevailed, which have predominantly led to the arrangement of separate electronic control units and actuators for controlling the airbags within a motor vehicle. These controllers are often also used to control other passive safety systems, such as retractable seat belts, activatable roll bars, window closing, etc. and often include a main processor in addition to a smaller auxiliary processor, which parts of the main function checked (so-called 1.5-core systems). The microprocessor systems included in today's passive safety control devices typically do not meet the reliability requirements that must be placed on a modern ESP brake control device. In the field of automotive electronics, there have been frequent attempts to integrate electronic components to save costs in common control units. However, this often fails because the existing error concept and the hardware requirements of the functions to be integrated are not compatible with each other.

Another idea of integration is realized with the Active-Passive-Integration-Approach (APIA) of the company Continental Teves GmbH & Co. oHG. At APIA, there is a centrally controlled system network consisting of different, networked control units that actively support the driver in coping with dangerous situations. A major aspect is to make reasonable use of the otherwise useless passing time between an accident event and a causally related driver reaction in order to at least provide the best possible protection for the occupants or other persons involved in the accident, at least in the event of an accident that can no longer be avoided enable. For this purpose, APIA relies on the exchange of data between the existing in a motor vehicle electronic systems that collect information about the activities of the driver, the behavior of the vehicle and the vehicle environment.

In addition to the resulting integration of the control programs (software function groups), there are already approaches regarding the integration of the corresponding hardware (hardware function groups). In this context, DE 101 07 949 B4 (Temic, AT 20.02.2001) describes the basic possibility of combining an airbag control unit with the sensors of a brake control unit. According to the example described is still a spatial separation of the electronics of the brake system and the electronics of the airbag control provided.

DE 44 36 162 C1 (Siemens, AT 10.10.1994) briefly proposes an ESP control system in which the airbag control and the ESP system are arranged in a common housing at a central location of the motor vehicle. Here, too, emphasis is placed on the fact that the arrangement of the control units takes place at a central location. This would mean that the control unit would have to be arranged under the driver's seat, for example. Consequently, it can be assumed that with such a solution, at least the hydraulic components of the brake system would have to remain arranged in the engine compartment.

In today's, equipped with appropriate facilities for safe operation, electronic circuits for braking systems or vehicle dynamics control systems, the circuits for the passive safety systems or restraint systems are still housed in separate control units. In the field of regulated brake technology, the control system for the driving dynamics and brake system is often connected to the hydraulic system of the brake system and the engine to a unit according to the principle of the magnetic connector, after which the necessary valve coils and the valve domes inserted therein in separate, interconnected Gehäusebreichen arranged are. The sensors for the ESP system including the necessary evaluation electronics are usually still in a separate, arranged in the passenger compartment housing in production vehicles, since integration of these sensitive sensors in the electronic control unit of the brake system due to the installation site and the existing vibrations technically difficult is. The necessary control devices for controlling the airbags (or the other passive safety systems) are - A -

Usually also arranged in the passenger compartment. Communication between the ECUs in the vehicle is via suitable digital networks (e.g., CAN bus).

The separate spatial arrangement of the above, counting active and passive driving safety, motor vehicle control devices is disadvantageous, inter alia, as partially used for the same physical size sensors are multiple (for example, acceleration sensors or even yaw rate sensors). The same applies to the actuators, consisting of actuator driver and actuator. As a result, the response to errors and the underlying philosophy in today's vehicles equipped with complex safety systems is highly heterogeneous and poorly matched. Another disadvantage is the level of error safety in known passive safety systems due to a limited available in the appropriate control device safe microprocessor system.

With the overcoming of the associated disadvantages, the invention is, inter alia, apart. The object of the present invention is therefore to eliminate the disadvantages of an overall heterogeneous active passive safety system consisting of several, distributed in the vehicle control units with at least partially different security concepts and thereby the cost and complexity, taking into account a high level of error security of the entire system reduce.

The invention now relates to an electronic control unit according to claim 1, which achieves this object.

The invention is based on the consideration that in force vehicle brake systems with, inter alia, the functions ABS-ESP, or even EHB (brake by wire) in mass production on the market, which meet very high requirements in terms of redundancy, fault detection, processing and tolerance. According to the claimed solution, the invention achieves a transfer of the high safety standards that are possible in the electronic brake area to passive safety systems such as airbags, belt tensioners, etc.

According to one example of a solution according to the invention, a safety-critical motor vehicle control system, such as an ABS / ESP control unit and an airbag control unit is combined in a common control unit or in a spatially close together area, at the same time according to the invention, a cost reduction in the takes place for the redundancy and / or security concept responsible electronic components.

The motor vehicle brake control device according to the invention comprises conventional functional groups in an electronic controller and a hydraulic unit, which in particular is firmly connected to the controller. The electronic controller contains a redundant or partially redundant microprocessor system (μP) with several central processing units (CPU). The conventional functional groups include a control and rule philosophy at least for an anti-slip regulation (ABS), but in particular also an electronic stability program (ESP). In addition to hardware elements, a function group can also include the software components necessary for a function.

The control device according to the invention is thus preferably a completely integrated system in which the controller housing (ECU) and the hydraulic block (HCU) are fixed, in particular, according to the known per se principle of the hydraulic connector, are interconnected. Preferably, therefore, the valve coils for the hydraulic valves are arranged in the controller housing and protrude from the valve block, the dome with the valve joints out. The control unit is constructed according to this preferred embodiment so that the coils are fitted over the valve dome by the assembly of ECU with HCU, so that there is a unitary control unit block, which in particular additionally has a motor for a valve disposed in the block hydraulic pump.

According to the invention, the motor vehicle brake control device further comprises non-conventional electronic hardware and software functional groups, e.g. Components, computers, memory, sensors and actuators, and the control philosophy, such. Algorithms and / or software function groups, an otherwise external motor vehicle occupant protection security system, which in particular does not directly interfere with the driving dynamics, that is passive. The non-conventional functional groups (hardware groups / software programs, software philosophies, software functions) also include, for example, the functional groups of an airbag control unit, belt tensioner, automatic roll bar, window closing automatic, etc.

According to the invention, the non-conventional functional groups are integrated into the environment of the motor vehicle brake control device, whereby the environment means that the non-conventional functional groups to be integrated are arranged at least in the immediate vicinity of the electronic brake controller.

In the control device according to the invention, the non-conventional components are in particular at least in the interior of the electronic control unit or even more preferably integrated into the controller housing of the vehicle brake control unit.

The microprocessor system according to the invention is fail-safe, since it has a complex redundancy concept, and comprises two or more central units (microprocessor cores or also CPU's) which mutually monitor each other for the purpose of error detection. For example, the system can operate on the principle of full redundancy, asymmetric redundancy or according to the principle of core redundancy. In this case, binuclear redundancy concepts in the event of a fault are usually designed so that the entire system is switched off. For this purpose, for example, the power supply lines are separated from the valves of the brake control unit in the event of a fault. However, according to another example, it is also possible to use more complex, more than dinuclear systems which as a rule can tolerate errors in the region of a core with the remaining computer cores. These more complex systems are often not switched off, so designed self-sustaining. The said three or more nuclear systems are indeed much more fault tolerant, but due to the higher chip area requirements and functionality also correspondingly more expensive to manufacture. It is now preferable to design the hardware of the microprocessor system according to the invention with respect to the redundancy concept so that it completely shuts off in the event of a fault or continues to operate in the event of an error in the sense of emergency operation.

In known fully redundant microprocessor systems, the central units and the functional groups necessary for the operation, such as memory, I / O, etc., are present twice or more than once. However, such fully redundant systems are too costly for the automotive industry. According to one aspect of the invention, the manufacturing costs of the integrated system can be significantly reduced if, for example, the known principle of core redundancy is used. According to the core redundancy concept, only the core but not the required memory chip area is doubled. The missing non-duplicated memory is only secured by means of suitable hardware measures via parity information. Mixed types have also become known, which combine the core redundancy principle of 2-core systems with the principle of emergency-capable redundancy in 3-core systems. In connection with polynuclear microprocessor systems without runflat capability, reference is made to DE 43 41 082 (P7583), WO 97/06487 (P7959) and WO 99/35543 (P9131) and, in connection with runnability, to WO 98/48326 (P9009) and WO 98/48326 (P9010).

Preferably, the principle of redundancy of the microprocessor system is therefore designed so that this works either on the principle of symmetric redundancy or asymmetric redundancy, in particular according to the principle of nuclear redundancy.

But it is also possible to link two CPUs with different capacities. This principle has become known by the term "asymmetric redundancy", as is apparent from EP 0 611 352 B1 (P7255), and means that the smaller test processor simulates in a simplified manner at least part of the control function of the main processor. Although it is in principle possible and therefore also preferred to apply the principle of asymmetric redundancy to the microprocessor system according to the invention. However, this is associated with an increase in software complexity, which has the hardware saving effect in today's systems. usually overcompensated. Therefore, according to the invention, the above kernredundanten systems with identical CPU's, but different memory configurations are particularly preferred, which can communicate with each other via bus coupling units (bus driver) not only input and output side, but also at command and data level.

According to a preferred embodiment, the electronic controller comprises a fail-safe microprocessor system and the most important basic elements of an ABS control unit. The electronic controller comprises a microcontroller with the following functional groups:

a) redundant microprocessor system, b) one or more mixed analogue / digital circuits for controlling powerful actuators for the mechanical restraint systems, in particular squibs, etc. , c) redundant shutdown circuits for the actuator control (for example, one or two main shutdown elements, such as main driver or safety switch) and d) self-sufficient power supply unit.

The above-mentioned basic elements of an ABS control unit are not finally defined by the following basic modules:

A) means for processing input signals from a plurality of wheel speed sensors,

B) driver outputs for solenoid coils or, in particular, also coils for magnetic hydraulic valves,

C) in particular one or more pressure sensor inputs and

D) Control driver for warning lamp / s. The actuators for the mechanical restraint systems are preferably so-called squibs, which are understood to mean ignition devices for eg airbags or belt tensioners.

The term "self-sufficient power supply unit" or self-sufficiency circuit is understood in the language of the invention, a driver or an energy storage, which may also be driver groups or energy storage groups. As drivers are e.g. Charge pumps into consideration, as energy storage capacitors, accumulators or batteries are useful, which can provide a short amount of energy necessary to ignite the squibs and possibly are suitable at least for short-term power to the circuit with the necessary energy for the function.

The microprocessor system preferably comprises the non-conventional functional groups:

e) at least one airbag acceleration sensor or an airbag acceleration sensor network, and f) at least one monitoring circuit for an acceleration sensor.

Actuators for the non-conventional hardware function groups generally include all actuators previously used in passive and active safety systems. In the case of airbag restraint systems, these are preferably drivers for "firing" units, which consist of one or more pyrotechnic cells. Therefore, one or more drivers in the control unit according to the invention are used, these drivers expediently according to the invention with the rest of the electronics are integrated.

Preferably, the microprocessor system comprises at least one security actuator driver, in particular

g) at least one airbag ignition driver, and / or h) at least one driver for a belt tensioner.

If in the context of the invention of "integration" is mentioned, this is understood as a gradual, multi-level preferred integration. That is, in the first preferred integration stage, the non-conventional function group (software and / or hardware component) to be integrated is located in the area of the environment of the control unit in which the conventional function groups are combined. This means that the functional group to be integrated is located in the immediate vicinity of the control unit, which advantageously requires only short line paths.

In the second, more preferred integration stage, the functional group to be integrated with the control unit, for example in the form of a flanged housing or via a plug with the control unit directly releasably connected or in particular unsolvable. This offers the advantage that the majority of the otherwise necessary bus cable can be omitted.

In the third, even more preferred integration stage, the functional group to be integrated is located inside the electronic control unit or, in particular, inside the electronic control unit housing of the motor vehicle brake control unit. This protects the function group against environmental influences and results in a Compact design of the entire unit consisting of valve block and the electronic control unit housing.

In the fourth, particularly preferred integration stage, the functional group to be integrated is located on a common conductor carrier with the chips of the brake control unit. This has the advantage that the electronic components can be produced more cheaply in a common manufacturing process. A space savings results from this also.

In the fifth, more particularly preferred, integration stage, the functional group to be integrated is part of a chipset developed in concert with the brake control devices. This ensures that the existing functional groups reliable other hardware functional groups, such. A / D converter, can share, if this makes sense by the error concept. An expedient variant of this type is when the highly integrated circuits with the microprocessor system on a first chip (MCU) and the power circuits with the necessary logic on another second chip (PCU) are housed. The drivers and input circuits for the safety systems are integrated in this variant in the second chip.

In the sixth, finally preferred integration stage, the non-conventional function group to be integrated with the conventional functional groups of the brake control unit is essentially integrated on a common chip. It is not absolutely necessary that this is done on a piece of semiconductor material / eg flip-chip technology, but this may be particularly useful. The sixth level of integration allows a production in particularly high Quantity with low specific consumption of wafer material.

A further simplification of the overall system is achieved if, according to a further preferred embodiment of the electronic control unit, the common microprocessor system

i) uses a common analog / digital converter, which is designed in particular redundant, and which processes both input signals for the brake control / control as well as input signals for the safety system.

The resulting integrated motor vehicle brake system according to the invention has the advantage that the existing functional groups can be used multiple times. This reduces the total number of hardware and software functional groups.

Furthermore, there is the advantage that the redundancy concept of a microprocessor system with several central units (for example, according to the principle of core redundancy) can also be used for the non-conventional functional groups. This ensures safe operation of the passive safety systems.

The integrated brake control device according to the invention also has the advantage that due to shorter data connections a data exchange between the existing software function groups is made possible with increased speed. In this way complex driving state evaluation algorithms for eg so-called pre-crash functions can be better implemented. This gives you, for example Brake functions that help to shorten the braking distance.

Further preferred embodiments will become apparent from the subclaims and the following description of the figures.

The invention will be explained in more detail below with reference to examples.

Show it

1 shows a circuit arrangement with a circuit arrangement for an error-protected brake control device,

Fig. 2 is a schematic representation of a circuit arrangement with the essential elements of a brake control device and the essential elements for security systems, which are integrated on a common chip.

On semiconductor material 2 include a redundant microcontroller system 20, logic elements 27, power supply 15 and power driver stages 21, 22, 23 (in particular valve driver with pulse width modulated drive 21, other valve driver 22 and relay driver 23) and spatially separate test processors 24, 25 (Watch Dogs) and power supply IC's 15, 15 'summarized. This requires a modern semiconductor process, which at least partially allows mixed-signal-capable hardware structures. On IC 15, a semiconductor main relay is further arranged, with which the power supply for the valve coils can be interrupted. Furthermore, an input / output unit 26 is provided, with which, for example, the warning lamp WL of the ABS Brake system can be controlled.

Microprocessor system 20 comprises two central units 21, and is constructed in accordance with the principle of kernel redundancy. That is, the memory of the two microcontroller is not only duplicated, but at least parts of the redundancy memory, as far as redundancy possible, removed. The remote memory parts are secured by appropriate hardware test functions in conjunction with redundancy memory areas. About serial bus 1 microprocessor 20 is connected to other chip areas for the exchange of data or connected to control the drivers 21, 22, 23 for the actuators.

The essential elements of the circuit arrangement in FIG. 2, in which the non-conventional functional groups of passive safety systems are integrated on semiconductor material 3, correspond to the elements of the circuit arrangement in FIG. 1 with regard to the conventional ABS / ESP functional groups. The integrated non-conventional functional groups are concerned These are essentially hardware logic elements and power drivers, that is, the software functional groups of the non-conventional passive system are processed together in microprocessor system 20. Amongst others, these are driver stages 9, which are integrated with the on-chip for controlling airbags 4, belt tensioners 5 and optionally further actuators 6. Also, additional sensor inputs 22 are provided to process sensor signals which are separately required in connection with the connected passive safety systems.

In addition, a yaw rate sensor 7 provided for ESP can be integrated on the one-piece semiconductor material 3 if this is not arranged outside the chip in module 7 '. net becomes. Furthermore, there is on chip 3 self-sufficiency module 8 for self-sufficient power supply of the chip or the release unit for the passive safety systems 4 to 6. 9 designates firing stacks (firing stages) for the security systems 4 to 6 (eg Squib's). Denoted by 10 is a safety switch for switching off the actuator driver 9, which prevents actuator access in the event that a fault occurs in microprocessor system 20 or another circuit. Safety switch 10 acts on all outputs in common, so that an additional, per se customary "safety switch", which is specially provided for the safety systems, can be omitted. This acts advantageous at the same time on the driver of the brake system 11, which are connected to the valve coils 12 or motor 13 for driving a hydraulic pump of the brake system. 14 denotes a module for wheel speed sensor signal processing. 15 denotes a common power supply with a wake-up device 15 '. 16 denotes a common watchdog which monitors the bus, the processor and the inputs for errors. 17 designates input circuits or monitoring circuits for sensors of the passive safety systems (eg for acceleration sensors 18).

If an error occurs in the area of the microprocessor system 20, an error signal is output to watchdog 16 via fault lines (not shown), which error signal can also be executed twice (redundantly) according to FIG. This then switches off via safety switch 10 all outputs to the conventional and non-conventional actuators.

Claims

claims

1. Motor vehicle brake control unit of an electronic brake controller and a particular fixedly connected to the controller hydraulic unit, wherein the electronic controller includes a redundant or partially redundant microprocessor system (20) with a plurality of central processing units (21), and wherein conventional functional groups on the one software components with a control and control philosophy As well as hardware components for at least for traction control (ABS) and hardware components, characterized in that non-conventional functional groups of an otherwise external passive vehicle occupant protection security system are present and they are integrated into the environment of the motor vehicle brake control unit, where environment means that the non-conventional functional groups to be integrated which may each comprise hardware and / or software components, at least in the immediate vicinity of the conventional electronic brake controller arrange t are.

2. Control device according to claim 1, characterized in that the hardware of the microprocessor system with respect to the redundancy concept is designed so that it completely shuts off in the event of a fault or continues to operate in the event of an error in the sense of emergency operation.

3. Control device according to claim 1 or 2, characterized in that the principle of redundancy of the control device is designed so that the microprocessor system which controls the brake function, either according to the principle of symmetrical redundancy or the asymmetric Re- dundancy, in particular works according to the principle of Kernredundanz, and that the non-conventional functional groups of the motor vehicle occupant protection safety system are not affected by a shutdown error.

4. Control device according to at least one of the preceding claims, characterized in that the microprocessor system comprises a microcontroller, which at least the functional groups

a) redundant microprocessor system, b) one or more mixed analog / digital circuits for controlling powerful actuators for the mechanical restraint systems, c) redundant shutdown circuits for the actuator control and d) self-sufficient power supply unit

as well as the basic elements of an ABS control device which, among other things, at least through the modules

A) means for processing input signals from a plurality of wheel speed sensors,

C) in particular one or more pressure sensor inputs and

D) Control driver for warning lamp / s

is defined.

5. Control unit according to at least one of the preceding Claims, characterized in that the microprocessor system is the non-conventional functional groups

e) at least one airbag acceleration sensor or an airbag acceleration sensor network, and f) at least one monitoring circuit for an acceleration sensor

includes.

6. Control device according to at least one of the preceding claims, characterized in that the microprocessor system comprises at least one safety actuator driver.

7. Control device according to at least one of the preceding claims, characterized in that the microprocessor system comprises a microcontroller in which some or all existing non-conventional hardware function groups in a mixed analog / digital circuit (b)) are integrated or these additional components in another mixed Analog / digital circuit are integrated.

8. Control device according to at least one of the preceding claims, characterized in that an integration of the functional groups on the circuit board, in particular in a chip or chipset of several chips.

9. Control device according to at least one of the preceding claims, characterized in that the microprocessor system

D) at least one input for a yaw rate sensor module (eg "sensor cluster") and / or at least one integrated yaw rate sensor

includes.

10. Control device according to at least one of the preceding claims, characterized in that the microprocessor system

E) comprises one or more watchdog circuits,

which monitor / monitor the function of the microprocessor system (s).

11. Control unit according to at least one of the preceding claims, characterized in that the common microprocessor system