EP2193042A1

EP2193042A1 - Redundant hardware architecture for the control signal stage of a braking system for a vehicle all the wheels of which are each connected to at least one rotary electrical machine

Info

Publication number: EP2193042A1
Application number: EP08804507A
Authority: EP
Inventors: Gérald Bourqui; Fabrice Cudre-Mauroux; Jean-Louis Linda
Original assignee: Michelin Recherche et Technique SA Switzerland; Michelin Recherche et Technique SA France; Societe de Technologie Michelin SAS
Current assignee: Compagnie Generale des Etablissements Michelin SCA; Michelin Recherche et Technique SA France
Priority date: 2007-09-20
Filing date: 2008-09-19
Publication date: 2010-06-09
Also published as: US8494699B2; CN101801709B; JP2010538914A; FR2921310A1; FR2921310B1; US20110046830A1; WO2009037352A1; CN101801709A

Abstract

Electric braking system for a road vehicle of which at least one wheel is connected for the purposes of rotation to at least one rotary electrical machine, at least one wheel control electronic module 23 driving the electrical machine or machines of one same wheel, comprising a central processing unit 3 that manages the movement of the vehicle, said central processing unit controlling the wheel control electronic module or modules 23, comprising a brake command available to a driver, said command being mechanically connected to at least three sensors C1, C2, C3 delivering a vehicle braking command signal of given amplitude representative of the total braking force desired for the vehicle, said sensors C1, C2, C3 being split between a first group C1 and a second group C2, C3, in which the sensor or sensors C1 of the first group delivers or deliver its or their control signal to the said central processing unit 3 and the sensor or sensors of the second group C2, C3 delivers or deliver its or their control signal to the or to each of the wheel control electronic module(s) 23.

Description

Redundant hardware architecture for the control signal stage of a vehicle braking system, all wheels of which are each connected to at least one rotating electrical machine.

FIELD OF THE INVENTION

The present invention relates to road vehicles. It relates in particular to the braking systems of a road vehicle with electric traction.

[0002] Electric vehicles include vehicles in which the electrical energy necessary for their movement is stored in batteries and vehicles in which electrical energy is produced on board, by a heat engine driving a generator or by a battery. combustible. The traction of the vehicle is provided by one or more electrical machines. The braking of the vehicle is ensured by a conventional mechanical braking system. The state of the art already knows many proposals electric traction vehicle. There may be mentioned, for example, US Pat. No. 5,418,437, which describes a four-wheeled vehicle, of hybrid series type, each wheel being driven by an electric machine of its own, a controller making it possible to control the wheel motors and ensuring the supply management of the wheel. energy to the engines from an alternator or a battery. This patent remains silent on the management of electric braking.

However, since an electric machine is reversible, it can also be used as an electric generator during the braking phases of the vehicle and in this case it transforms the braking mechanical energy into electrical energy that the vehicle must absorb, possibly by dissipation. thermal. This mode of operation is often called "electric braking" or "regenerative braking".

In practice, the electric machines work as a generator to ensure a moderate deceleration of the vehicle, to recover as much as possible energy and store it in electric accumulators, or even to dispel it to lighten the solicitation of mechanical brakes of the vehicle. The main braking of a vehicle is indeed provided by mechanical brakes controlled hydraulically, usually assisted, and usually now provided with an anti-blocking function commonly referred to as "ABS". Braking is a key safety feature on a vehicle. Mechanical brakes are power

P10-2005-WO important, capable of bringing the wheel to the blocking, the power clipping being provided by the anti-blocking function, the clipping being related to the limit of adhesion. To ensure the safety of passengers, the braking system of a passenger vehicle is generally capable of decelerating the order of 1 "g", where g is the acceleration unit whose value "1" corresponds to Earth's gravity.

Moreover, in a vehicle with electric traction, integrate the electric machine into the wheel is a particularly interesting configuration because it eliminates the mechanical shafts and offers more latitude for the general architecture of the vehicle. The state of the art knows several provisions of integration of electrical machines in the wheels. The patent application WO 2003/065546 proposes to have four electrical machines transmitting their torque to the wheel by means of an epicyclic gear train. Patent application EP 0878332 discloses a ground connection which incorporates both the vertical suspension of the wheel inside thereof and a rotary electric traction machine. There is a reduction stage between the wheel and the electric machine, the latter being geared on a toothed wheel coaxial with the wheel. The wheel includes of course a disk brake to ensure the service braking function. In addition, the ground connection comprises a pivot to allow to steer the wheel. All mechanical functions of a ground connection are thus integrated into the wheel.

The safety of operation being paramount, many traditional mechanical brake control systems have been proposed, such as that of the patent application EP 1 026 060 which describes redundant means, control by decision by the majority, several low-voltage power supplies control systems to maintain full operability even if multiple batteries fail. Let us also mention the US Pat. No. 6,244,675 describing a braking command whose position is measured by three sensors, fed by two independent sources: a sensor is powered by a first source, another by a second source, and the third by the two sources via diodes; if one of the sources is out of service, two sensors are still powered and remain in service.

We can also mention US Patent 6,476,515 which shows a use of four sensors, measuring different physical quantities. The sensors are grouped according to the physical principle measured and they are all necessary for the normal calculation of the braking force.

P10-2005-WO The invention relates to electric braking systems of a road vehicle equipped with wheels which are each rotatably connected to at least one rotary electric machine, each rotary electric machine cooperating with a single wheel. In such an architecture, it is possible to confer on electric braking a predominant role, both in power and in control of the stability of the vehicle (functions known under the names ABS and ESP) since it is possible to control selectively on each of the wheels the torque to the wheel via the control of the machine (s) (s) electrical (s) rotary (s) which is (are) associated (s). It is still necessary for this that the electric braking is extremely reliable.

The object of the present invention is to improve the safety of electric braking systems for electric traction vehicles. In particular, the aim is to propose an architecture of an electric braking system such that it is possible to suppress the mechanical brakes and to ensure the service braking function purely electrically. More specifically, the objective of the present invention is, by particular configurations of redundant means, to provide such a system with a very high degree of security in the detection and exploitation of a braking demand by the driver of a driver. vehicle.

BRIEF DESCRIPTION OF THE INVENTION

[0010] A braking system is described below in which it is possible to distinguish:

A power stage in which the electric power required for traction and the electric power generated by the electric braking is circulated,

A low voltage power supply stage for supplying electronic circuits for controlling and controlling the power elements, and

A stage of circulation of the brake control signals of the vehicle.

We propose below an architecture in which each of these stages has a certain level of redundancy. The redundancies proposed for each of the stages can be used each alone, or in combination with another. Of course, we raise the level of security by combining all the proposed redundancies.

P10-2005-WO - AT -

The invention proposes an electric braking system of a road vehicle of which at least one wheel is rotatably connected to at least one rotary electrical machine, at least one wheel drive electronic module driving the electrical machine or machines. a same wheel, comprising a central unit for managing the movement of the vehicle, said central unit controlling the electronic wheel control module or modules, comprising a braking command available to a driver, said command being mechanically connected to three sensors delivering a brake control signal of the vehicle having a given amplitude representative of the total braking force desired for the vehicle, said sensors being distributed in a first group and a second group, in which the sensor (s) of the first group is (are) physically connected to the central unit (3) and delivers (s) its (their) ana command signal logic to said central unit and the sensor (s) of the second group delivers (s) its (their) analog control signal to or each of the electronic wheel control modules, said electronic wheel control modules delivering the information from the sensors of the second group to the central unit via a computer type of communication channel.

Preferably, the system according to the invention comprising at least two subsystems each comprising at least one wheel drive electronic module, comprising a low voltage power supply stage for supplying electronic control and control circuits. power elements, said low-voltage power supply stage comprising a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by an electrical line comprising a first section and a second section, said first and second sections; sections being connected by an electrical separation device of the two sections, able to interrupt the interconnection on command, in case of undervoltage or over-current on one of them, one of the subsystems being fed by the first section and the other subsystem being powered by the second section, the first group comprising a first sensor connected directly or indirectly to one or both of the first power supplies, the second group comprising a second sensor and a third sensor, the second sensor and the electronic module (s) (s). ) of one of the subsystems being connected directly or indirectly to the first power supply, the second sensor being associated to deliver a control signal to the electronic module (s) wheel drive (s) of said sub -System, the third sensor and one or the electronic module (s) wheel piloting the other of the

P10-2005-WO subsystems being connected directly or indirectly to the second power supply, the third sensor being associated to deliver a control signal to the electronic module (s) wheel piloting said subsystem.

In addition, at the power stage, using several rotary electrical machines, at least two and preferably one per driving wheel, which already brings some redundancy. Preferably, the system according to the invention comprises at least one electronic dissipation module for each of the subsystems, one of the electronic dissipation modules being powered by the first section and the other of the electronic dissipation modules being powered by the second section. The dissipation installation comprises, for example, an electrical dissipation resistor associated with each of the electronic dissipation modules, so as to always offer a certain deceleration capacity in the event of a failure of a resistor or its control module.

In an implementation for a four-wheeled vehicle, preferably, each of the wheels is mechanically connected to its or its own rotating electrical machines, each of said subsystems comprising two of said wheels. Preferably, each subsystem groups the vehicle wheels arranged diagonally at opposite corners of the vehicle. It will be seen that this solution offers more safety than the dual hydraulic brake systems commonly used on automobiles.

Furthermore, very advantageously, the low voltage power supply stage for supplying electronic control and control circuits of the power elements comprises two independent voltage sources. Said low voltage power supply stage comprises a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by a low voltage electrical line comprising a first section and a second section, said first and second sections being connected together. by an electrical separation device of the two sections, capable of interrupting the interconnection on command, in case of undervoltage on one of them, each wheel drive electronic module and electronic dissipation module of a subsystems being powered by the first section and each wheel drive electronic module and electronic dissipation module of the other subsystems being powered by the second section.

P10-2005-WO The first power supply consists for example of a voltage converter connected to the central power line. The electrical energy on this central line can come either from a main source, such as for example a fuel cell, an electrical energy storage device, or real-time recycling energy. There is also a redundancy of energy sources. The second power supply consists for example of a low voltage battery, dedicated to this low voltage power supply. Of course, it is possible to use for this second voltage source a second voltage converter also connected to the central line or directly on the storage bench.

Finally, the circulation stage of the brake control signals of the vehicle is built around three sensors mechanically connected, and preferably separately, to a braking control available to a driver, the sensors being operated from totally different way as explained below.

Note also that, preferably, to hold the vehicle stationary, it installs a mechanical brake device commonly called parking brake. However, such a device is not designed to brake the vehicle but only to keep it stopped, preferably even on very steep slopes. Thus, the system according to the invention comprises, associated with a wheel at least, a mechanical braking device of the wheel controlled solely by a parking brake control. Preferably, the parking brake device is controlled by an electric actuator controlled by a brake control unit which can be activated only under a longitudinal speed threshold of the vehicle, said threshold being for example less than 10 km / h.

BRIEF DESCRIPTION OF THE FIGURES

Other objects and advantages of the invention will become apparent from the following description of a preferred but nonlimiting embodiment, illustrated by the following figures in which:

P10-2005-WO • Figure 1 shows schematically a braking system of a four-wheeled vehicle, producing electrical energy on board;

• Figure 2 is a diagram detailing the organized power level to present some hardware redundancy; "Figure 3 details the low voltage power supply level of the various electronic control circuits;

FIG. 4A details the level of the control lines between the electronic control circuits of the various elements and the central unit;

FIG. 4B illustrates some alternative embodiments of the configuration illustrated in FIG. 4A;

FIG. 5 illustrates a second embodiment of the low-voltage power supply level and the level of the control lines associated therewith;

FIG. 6 illustrates a third embodiment of the low voltage power supply level and the level of the control lines associated therewith.

DESCRIPTION OF THE BEST MODE OF CARRYING OUT THE INVENTION

In Figure 1, there is shown a four-wheeled vehicle 1A _V G _> ¹ A _V D ' ¹ ArG ^and IArD- The wheels are noted IA _V GP ^or the front left ^wheel , IA _V DP ^or the front ^wheel right,

Iarg T ^o l ^a i ^{wheel arr} ^ere left and IA _Γ DP ^our the ^right rear ^wheel. Each wheel is equipped with an electric machine that is mechanically coupled to it. We see the electrical machines

AvG ^ ^ AvD ^ ^ ArG ^and ArD- ^{^) years} ^has the ^Sulte> ^{it will} not resume indices specifically designating the position of the wheel 1 or of the electric machine 2 in the vehicle when it adds nothing to the clarity of the presentation. The electrical traction machines 2 are three-phase synchronous machines, equipped with a resolver-type angular position sensor and are controlled by the electronic wheel control modules 23 to which they are connected by power lines 21. The electronic modules wheel steering 23 are designed to drive the electric machines in torque. Each wheel control electronic module 23 makes it possible to impose selectively on the wheel in question a driving torque determined in amplitude and in sign. As a result, the electrical machines can be used as motor and generator. Each of the rear wheels IArG ^{and 1} ArD ^{is also} equipped with a

P10-2005-WO mechanical braking 71 of the wheel controlled by an electric actuator 7 controlled by a brake control unit.

In a particularly advantageous implementation of the invention, none of the wheels of the vehicle has a mechanical service brake. Whatever the amplitude of the brake control signal, that is to say, even for the most intense braking, the braking is ensured only by electrical means, that is to say by driving the electrical machines in generator. Each wheel has one or more dedicated electrical machines in order to be able to generate a braking force selectively on each wheel, which one could not do with a common electric machine with several wheels, for example the wheels of an axle, because in this case there would be a mechanical transmission and a differential between the wheels. Electrical machines are sized appropriately to impose the highest possible braking force on each wheel.

Of course, the system comprises means capable of absorbing a high electrical power, which for example leads to install one or more electrical dissipation resistors cooled efficiently, for example by water circulation, the known electric accumulators n not being able to absorb the electrical power produced by an emergency braking or not being able to absorb all the electrical energy produced by long-term braking, except to install a capacity such as the weight of the vehicle would be really prohibitive. Thus, the invention makes it possible to form an autonomous electrical system isolated from the environment, without exchange of electrical energy with the outside of the vehicle, thus also applicable to motor vehicles, application of electric braking systems much more difficult than in the cases of vehicles connected to an electrical network such as trains or urban trams.

Many arrangements are possible to arrange an electric machine mechanically coupled to the wheel. Note, however, that it will be advantageous to install a relatively large gear ratio, for example at least equal to 10 and preferably even greater than 15, so that the electric machine is not too bulky. An electric machine can be installed coaxially with the wheel, the mechanical connection being provided by an epicyclic gear train to provide the necessary reduction. It is also possible to adopt a configuration of the type described in patent application EP 0878332, preferably by adding a mechanical reduction stage. We can also choose to have several

P10-2005-WO electric machines whose couples add up. In this case, an electronic wheel module can drive several electrical machines in parallel installed in the same wheel. Regarding the installation of several electrical machines in a wheel, see for example the patent application WO 2003/065546 and the patent application FR 2776966.

The invention is illustrated in an application to a vehicle ensuring the production of electrical energy on board. We see a fuel cell 4 delivering an electric current on a central electrical line 40. Of course, any other power supply means can be used, such as batteries. We also see an electrical energy storage device constituted in this example by a bank of super capacitors 5, connected to the central electrical line 40 by an electronic recovery module 50. We see an electrical dissipation resistor 6, preferably dipped in a coolant discharging heat to an exchanger (not shown), constituting an energy absorbing device adapted to absorb the electrical energy produced by all the electrical machines during braking. The dissipation resistor 6 is connected to the central electrical line 40 by an electronic dissipation module 60.

A central unit 3 manages various functions, including the electric traction system of the vehicle. The central unit 3 communicates with all the electronic wheel control modules 23 as well as with the electronic recovery module 50 via the electrical lines 30A (CAN bus ®). The central unit 3 also communicates with an acceleration control 33 via an electric line 30E, with a braking command 32 (service brakes) via an electric line 30F, and with a control 31 selecting the forward or reverse gear via a 30C power line. This allows to take into account the intentions of the driver. The central unit 3 also dialogs with a longitudinal acceleration sensor 34 via an electrical line 30D. Finally, the electronic recovery module 50 communicates with the electronic dissipation module 60 via an electrical line 30B.

The central unit 3 manages the longitudinal movement of the vehicle. Said central unit 3 controls all the electronic wheel control modules 23. The central unit 3 has a vehicle braking operating mode activated by a vehicle braking control signal having a given amplitude representative of the total force desired braking effect for said vehicle. In braking mode, whatever the amplitude of the brake control signal, said central unit 3 controls all the electronic modules

P10-2005-WO wheel steering device 23 so that the sum of the longitudinal forces of the set of wheels 1 from the rotating electrical machines is a function of said amplitude of the braking control signal. In other words, there is no mechanical service brake; the electric braking system described here is the service brake of the vehicle.

We also see a parking brake control 35. The actuator 7 of the mechanical wheel braking device is controlled via an electric line 3OH only by this parking brake control 35, and absolutely not by the braking command 32. Preferably, in order to avoid any deterioration of the mechanical braking devices 71 designed solely to keep the vehicle stationary and whose ability to evacuate calories is therefore very limited, said parking brake control unit can not be activated. that under a longitudinal speed threshold of the vehicle rather low, for example less than 10 km / h.

Explain the operation of the system according to the invention.

When the driver selects the forward movement with the aid of the control 31 and activates the accelerator pedal 33, the central unit 3 orders the electronic wheel control modules 23 to power the electrical machines 2 by drawing the electric power on the central electrical line 40. This is supplied by the fuel cell 4 and / or the bank of super capacitors 5, according to the state of charge thereof and under the control of the unit 3. The vehicle is moving forward. Electrical machines 2 convert electrical energy into mechanical traction energy. The power used depends in particular on the position of the acceleration control 33.

When the driver actuates the brake pedal 32, the central unit 3 goes into braking mode. From the action of the driver on the brake pedal 32, the central unit 3 calculates a value of the brake control signal. Whatever the amplitude of the braking control signal, said central unit 3 controls all the electronic wheel control modules 23 so that the sum of the longitudinal forces of the set of wheels 1 is proportional to said amplitude of the brake control signal. The rotating electrical machines 2 then transform mechanical rotation energy into electrical energy.

According to the strategy for managing electrical energy programmed in the electronic recovery module 50, the latter distributes the braking energy so as to recharge the bank of super capacitors 5 and / or controls the electronic dissipation module. 60 so as to

P10-2005-WO dissipate the energy in the electrical dissipation resistor 6. It is understood that when the storage means such as the bank of super capacitors 5 are saturated, the entire energy must be dissipated. In addition, the power of the storage means can be limited, that is to say that the charging speed of the storage means can for example correspond to a light braking as is commonly expected from a heat engine (this which is called the "engine brake"). Beyond this braking level, the electrical power produced is then directed towards the dissipation means.

In order to ensure the operational safety of the vehicle, the electrical dissipation resistor 6 is dimensioned and cooled so that all the electrical energy produced in emergency braking maneuvers, the most violent, can to be dissipated. In fact, it is advisable to size the chain formed by the rotary electrical machines 2, the electronic wheel control modules 23, the central electrical line 40, the electronic dissipation module 60 and the electrical dissipation resistor 6 according to similar criteria. severity than what is applied to mechanical braking systems.

Preferably, the set of electrical dissipation resistors 6 form a power absorbing device of power greater than 500 kW per ton of vehicle. Indeed, if F is the force applied to the vehicle to brake it, if its mass is worth M kg and its speed is worth V m / sec and if γ is the acceleration in m / sec2, we have F = M * γ and P = F * V = M * (γ * V); assuming that the maximum deceleration is 1 g, at 130 km / h, the power per ton of vehicle is about 350 kW and it is about 500 kW at 160 km / h. Those skilled in the art will easily size the power of the energy absorbing device according to the characteristics of the vehicle he wants to build.

Thus, as in the example illustrating the invention, there are two subsystems each having an electrical dissipation resistor, each of these electrical dissipation resistors 6A and 6B is of power greater than 250 * M / 1000. kW.

When the driver selects the reverse gear, the central unit 3 orders the electronic wheel control modules 23 to reverse the operation of the rotating electrical machines 2, including in case of braking.

Now let's describe how one can implement an anti-lock wheel function.

P10-2005-WO The electric traction machines 2 being equipped with a resolving type angular position sensor, each wheel 1 having its own rotary electrical machine 2, thus has a speed sensor of each wheel rotation. It is therefore advantageous to equip the system according to the invention with a device for controlling the sliding of each wheel in which, in braking mode (or even as soon as the driver lifts his foot off the accelerator pedal to provoke what he has agreed to call a motor brake), the steering torque of a wheel is decreased when the slip control device detects a slip of the wheel considered. One can for example analyze in real time the signal that the rotational speed sensor of each wheel delivers and deduce from a strong variation (deceleration) a locking primer. The derivative of the rotation speed signal of each wheel can be calculated in real time, thus obtaining a signal representative of the acceleration / deceleration of each wheel and comparing it with a signal giving the actual acceleration / deceleration of the vehicle if we have a suitable sensor. It is the longitudinal acceleration sensor 34 already introduced above, or it is the fact of a processing of several signals for estimating the actual acceleration / deceleration of the vehicle. Therefore, the central unit 3 can order the electronic wheel control modules 23 to reduce the wheel drive torque (selectively wheel) when the slip control device detects a sliding of the wheel in question. Note that this torque reduction can be managed directly by the electronic wheel control modules which can react in real time with respect to the speed and acceleration measured on the wheel, the central unit transmitting, for example, speed and acceleration instructions. limit to be respected.

In conclusion, note that the absence of conventional braking member (see disk and clamp in EP 0878332) substantially simplifies not only the architecture of the vehicle equipped with a system according to the invention, but also its maintenance by eliminating periodic replacement of pads and discs. Among the advantages of the suppression of conventional hydraulic braking members, there may be mentioned in addition the elimination of any residual friction of the wafers (it is known that these frictions consume a significant part of the energy necessary for the operation of a vehicle with conventional braking). Another advantage is the elimination of the thermal stresses induced on the ground connection by the conventional hydraulic braking members and the elimination of the nuisance associated with the dust produced by the wear of the pads and disks.

P10-2005-WO It has been described above a traction system for a motor vehicle in which none of the wheels is equipped with mechanical brakes. The deceleration capacity of the vehicle comes from the control of rotating electric machines as a generator and these are dimensioned so as to be able to bring each of the wheels of the vehicle to the blocking, that is to say they are capable of providing a torque brake sufficiently large.

The following description illustrates a particular, non-limiting example, to build a system with sufficient hardware redundancy to ensure a very high level of safety to the vehicle braking system.

It can be seen in FIG. 2 that the electric braking system comprises two subsystems (A and B) connected to the central electrical line 40, each of the subsystems comprises two wheels each connected in rotation to at least one machine. rotating electric 2 of its own. The right front wheel and the left rear wheel, or more exactly the rotary electric machines 2 and the electronic wheel control modules 23 associated therewith, form the subsystem A. The left front wheel and the right rear wheel, or more exactly the rotary electrical machines 2 and the electronic wheel control modules 23 associated therewith form the subsystem B. Each subsystem comprises an electrical dissipation resistor 6A, respectively 6B, each powered by an electronic dissipation module 6OA , respectively 6OB.

If we examine the various components of the traction system with respect to the material redundancy criterion, the rotating electric machines 2 integrated wheels form a system that naturally has redundancy since each of the wheels has its own electric machine . The control electronics of these machines, namely the electronic wheel control modules 23, also forms a system that has a hardware redundancy since each of these electrical machines 2 has its own control electronics.

In regenerative braking, each of the rotary electrical machines 2 provides electrical power line 40 with electrical energy via the electronic wheel control modules 23. This energy can be stored in accumulators such as the super bench. capacitors 5 or be dissipated by the electrical power resistors 6A and 6B. In emergency braking, it is obvious that we can not rely on the storage capacity of the

P10-2005-WO accumulators because they could very well already be at their maximum load and unable to absorb electrical energy. Therefore, the electrical resistance 6 is a crucial element for the operational safety. Likewise, the electric power line 40 is a crucial element for the operational safety of the braking system of the vehicle by all-electric means. Different failure scenarios are discussed below.

In Figure 2, there is recognized the main source of electrical energy which, in this embodiment, is a fuel cell 4. It also shows the battery for storing electrical energy which, in this exemplary embodiment, is a bank of super capacitors 5 and its electronic recovery module 50. Finally, the low voltage power supply of the various electronic modules is provided on the one hand by a voltage converter 41 to convert the voltage available on the power line 40 low voltage (for example 12 volts) used to power the various electronic control circuits, and secondly by a battery 42 such as a battery conventionally used on a vehicle voltage of 12 continuous volts.

We have seen that, in order to ensure safety braking, the braking system is organized in two subsystems, namely the system A grouping the right front wheel and the left rear wheel and the system B grouping the left front wheel and right rear wheel. The subsystem A is connected to the power line 40 via an overcurrent protection device 4 IA. The subsystem B is connected to the power line 40 via an overcurrent protection device 4 IB. Each of the subsystems therefore has its own dissipation resistor 6A, 6B and each has its own electronic dissipation module 6OA, 6OB, and is connected to the power line 40 via an overcurrent protection device 41A, 41B capable of electrically isolating said subsystem from the central power line. On the opposite side to the power line 40, downstream of the device 4 IA, a power line section 40A is connected to the electronic wheel control module 23 associated with the left rear wheel, the electronic wheel control module 23 associated with the right front wheel and finally to the electronic dissipation module 6OA associated with the dissipation resistor 6A. Similarly, for subsystem B.

In case of damage on the power line 40 causing a break between the connection points of the overcurrent protection devices 41A and 41B, there remain two subsystems independent of each other, the systems A and B, each capable of braking

P10-2005-WO electric vehicle. Each of these subsystems has its own electrical dissipation resistor. So we have a hardware redundancy of the power stage.

The power stage may have other damage than a failure on the power line 40. For example, imagine that the section of the power line 4OA leading to the electronic dissipation module 6OA is interrupted. In this case, the dissipation resistor 6A is off. The electric power produced by the subsystem A in electric braking can pass through the section of the uninterrupted power line 4OA and, via the overcurrent protection device 4 IA, back on the power line 40 and be routed via the power line 4OB to the electrical dissipation resistor 6B. The electrical dissipation resistor 6B therefore becomes common, in this case, to the subsystem A and the subsystem B.

Even if the available electrical dissipation power is halved, in this case, the braking capacity of the electric braking system remains large, sufficient to provide emergency braking. Indeed, each of the electrical dissipation resistors 6 is immersed in a hydraulic cooling circuit. In the event of emergency braking, the energy produced by the electric braking is sufficient to bring the cooling fluid to a boil. Nevertheless, as and when it is transformed into the vapor phase, the vaporized fluid is immediately replaced by liquid phase cooling fluid, which licks the resistor again and the system continues to have a certain capacity to evacuate calories. In addition, the cooling system has a certain thermal inertia. The applicant's experiments have shown that, even in this case, the electric braking system remains much more powerful and effective than a cross-hydraulic braking system such as those currently used on motor vehicles.

If the 4OA power line is interrupted between the electronic wheel control module 23 associated with the right front wheel and the electronic wheel control module 23 associated with the left rear wheel, then in this case the electrical resistance dissipation 6A remains available for the rotary electric machine 2 associated with the right front wheel when it operates as a generator while the electrical dissipation resistor 6B is available for the subsystem B and for the rotary electric machine 2 associated with the wheel rear left, that is to say one of the rotating electrical machines 2 subsystem A. One

6B electrical dissipation resistors will receive a higher electrical power than

P10-2005-WO the other 6A. The operation is not optimal but we are therefore in a configuration less penalizing for the slowing capacity of the vehicle than that exposed in the previous paragraph.

If, for any reason, a damage causes the opening of the overcurrent protection device 4 IA, thus isolating the subsystem A, then again the braking capacity of the vehicle remain maximum because the electrical resistances of dissipation are dimensioned so as to ensure, overall, the full deceleration of the vehicle even when the electric energy accumulator, here constituted by the bank of super capacitors 5, is at its maximum load. In this case, it is therefore not in a situation of failure of the electric braking system as to the maximum capacity of deceleration. Admittedly, we are not in an optimal situation with regard to general management since, in particular, the possibility of recovering energy is lost, but this is not detrimental to safety.

If any of the failures that have just been explained for subsystem A occur in subsystem B, for reasons of symmetry, the electrical braking safety conditions remain strictly identical. In conclusion, by organizing the power stage into two independent subsystems, the system A and the system B, each connected to the central power line 40 of the vehicle by its own overcurrent protection device (devices 41A and 41B) and by equipping each of the subsystems with its own electrical dissipation resistor, a dual hardware redundancy has been arranged so that the electric braking of the vehicle can be provided under excellent safety conditions.

The dissipation power of the electrical dissipation resistors 6A and 6B depends on the proper operation of the cooling system. Indeed, they are immersed in a heat transfer fluid. Figure 3 schematically shows the cooling circuit. We see that it has 2 pumps 8A and 8B and 2 radiators 80A and 80B. The 2 pumps 8A and 8B are connected in series and each is controlled by its own electric motor 81A and 8 IB respectively. Each of these electric motors is driven by its own electronic control circuit 82A and 82B. The radiators 80A and 80B are connected in parallel, and equipped with valves 83 which make it possible to isolate each of the radiators selectively in case of leakage to one of them. On the other hand, the pump assembly and pump actuation motor is dimensioned such that if one of the pumps is out of order, the other pump is capable of ensuring a sufficient flow of the coolant despite the that the other pump is no longer functional.

P10-2005-WO We now describe the low voltage power supply of the various electronic control circuits and the various auxiliaries, with the help of Figure 3. On it, we recognize the electronic dissipation modules 60 A and 6OB of the 2 electrical dissipation resistors 6A and 6B, the electronic wheel control modules 23 each associated with one of the four electrical machines 2, the electronic recovery module 50 associated with the bank of super capacitors 5. It also shows the central unit 3 the electronic control circuit 82A of one of the cooling circuit pumps and the electronic control circuit 82B of the other of the cooling circuit pumps.

The redundancy for the supply of low voltage electrical energy is designed as follows. Since we have, on the one hand, a voltage converter 41 connected to the power line 40 and delivering a 12 volts DC voltage and, on the other hand, a battery 42 also delivering a voltage continuous 12 volts, some elements will be connected to the voltage converter 41 and other elements will be connected to the battery

12 volts as follows. A line 43 provides the interconnection between the voltage converter 41 and the battery 42. This line 43 comprises a first section 43 A and a second section 43B, said first and second sections being connected by an electrical separation device 430 of the two sections. in case of undervoltage or over-current on one of them.

Thus, we see that in the non-limiting embodiment illustrating the invention, the two sections 43A and 43B are supplied with the same voltage. Some elements are connected to the first section 43A, each via an overcurrent protection device 434A.

Some other elements are connected to the section 43B, each via an overcurrent protection device 434B.

For example, to ensure the proper functioning of the cooling circuit pumps, one of the motors 81A is connected to the first section 43A via its electronic control circuit 82A. The other of the motors 8 IB is connected to the second section 43B via its electronic control circuit 82B. The electronic control circuits of the subsystem A, namely the electronic wheel control module 23 associated with the rotary electric machine 2 of the right front wheel, the electronic wheel control module 23 associated with the rotary electric machine 2 of the left rear wheel and the electronic dissipation module 6OA of the dissipation resistor 6A are connected to the second section 43B then

P10-2005-WO that the same electronic circuits of the subsystem B are connected to the first section 43A.

The central unit 3 managing the movement of the vehicle, since it controls all the electronic wheel control modules 23, has a double electrical connection. It is connected at the same time to the first section 43A and the second section 43B via a pair of diodes insulating said first and second sections. The central unit 3 is connected each time via a diode 435 so as to ensure the continuity of the power supply of the central unit 3, even in the event of failure of one of the two low voltage sources. In addition, an appropriate circuit 436 monitors the presence of voltage on each of the power lines to send a fault signal in case of failure of one of the two power supplies. The electronic recovery module 50 associated with the bank of super capacitors 5 is connected to the first section 43A only. Note that this type of dual connection could also be used for all electronic circuits, including electronic wheel control modules 23.

In the case of undervoltage or overcurrent occurring for example following a short circuit on one of the two sections 43A or 43B or directly internal to one of the power supplies 41 or 42, the Electrical separation device 430 interrupts the connection between the two sections 43A and 43B so as to preserve the functionality of the flawless section. It can thus be seen that if, for any reason, a large fault on the voltage converter 41 causes the electrical separation device 430 to interrupt the interconnection between the voltage converter 41 and the battery 42, the battery 42 can continue to supply power. in low voltage the electronic control circuits associated with the subsystem A and the central unit as well as one of the two pumps of the hydraulic cooling circuit. Conversely, in the case of a major fault on the battery side 42, the electrical separation device 430 can interrupt the interconnection and the voltage converter 41 can continue to supply the subsystem B, the unit central and one of the pumps of the hydraulic cooling circuit. It can therefore be seen that the architecture described makes it possible to maintain the operation of one of the two subsystems A or B and therefore half of the braking power of the vehicle is still available. Of course, by using the double connection of the low-voltage electronic supply for all the electronic circuits, it is possible to maintain, even in this case of defect, the totality of the braking power.

P10-2005-WO The brake pedal is assumed to be sufficiently safe by its construction and is therefore not doubled. It is necessary to transform the action of the driver on the brake pedal into an electrical signal that can be used by the central unit 3 and / or the electronic wheel control modules 23. To this end, sensors associated with the brake pedal are installed. Several are being implemented to provide some redundancy in order to bring the security of the system to a sufficient level. The braking system, as a whole, should be able to cope with sensor faults such as the disappearance of the power supply of a sensor or the signal it delivers, as well as a short circuit of the signal. to "more" or "zero". In addition, it is also appropriate that the braking system, globally, be able to cope with certain drifts as a simple shift between the information delivered by a sensor relative to the others (sensor defect not frank). To this end, three position sensors C1, C2 and C3 are each associated with the brake pedal and each deliver a signal representative of the desired control by the driver of the vehicle.

The architecture of the system according to the invention devolved to the three sensors C1, C2 and C3 a different role. Consider that there is a first group comprising the first sensor C1 and a second group comprising the second sensor C2 and the third sensor C3. It is conceivable to associate two sensors on the central unit 3 and a sensor with all the electronic wheel modules 23, or to associate a sensor with the central unit 3 and two sensors with the electronic wheel modules 23. Before To return to the following on various possibilities of associations, a preferred variant which associates two sensors with electronic wheel modules 23 in the particular case of a four-wheeled vehicle equipped with the means of the invention is described below in detail. .

We will now describe the supply of braking sensors C1, C2 and C3 which are at the source of the brake control chain. Recall that the system according to the invention comprises a central unit 3 which controls all the electronic wheel control modules 23. The sensor C1 is supplied with low voltage electrical energy via the central unit 3. It delivers the control signal to the central unit 3 and the latter receives the brake control signal from the sensor C1 to create the overall control signals of the braking of the vehicle of a first level. Note that the central unit 3 comprises the appropriate circuits for monitoring the presence of voltage on the supply line of the sensor C1, and the integrity of the control signal on the line 30F, in order to manage a fault information of the conditioning circuit of the sensor Cl.

P10-2005-WO The second and third sensors are supplied with low voltage electrical energy respectively via one or the electronic module (s) wheel (s) (23) of a (A) subsystems and via the one or the electronic module (s) driving wheel (23) of the other (B) subsystems. Of course, the second and third sensors are supplied with low voltage electrical energy from all the electronic wheel control modules (23) respectively of one (A) and the other (B) of the subsystems via diodes. 230 isolating said first and second sections. In addition, an appropriate circuit 231, interacting with each of the wheel control modules 23, monitors the presence of voltage on each of the four supply lines, in order to send a fault signal in the event of failure of one of the four power supplies. It will be seen in the following paragraph that the sensors C2 and C3 are directly associated with the electronic wheel control modules 23 and only with the electronic wheel control modules 23.

We have just seen that the low voltage power supply stage comprises a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by an electrical line 43 comprising a first section 43A and a second power supply. section 43B, said first and second sections being connected by an electrical separation device 430 of the two sections in case of undervoltage or overcurrent on one of them. Said first sensor C1 is fed, via the central unit 3, by each of the sections 43A and 43B. Said second sensor C2 is powered by each of the electronic wheel control modules 23 of one (A) of the subsystems, via a line 232A and via diodes 230 isolating the power supplies coming from each of the electronic control modules. 23. The electronic wheel control modules 23 of the subsystem A both receive their low-voltage electrical energy from the section 43A. Said third sensor C3 is supplied by each of the electronic wheel control modules 23 of the other (B) subsystems, through a line 232B and via diodes 230 isolating the power supplies from each of the electronic modules of wheel control 23. The electronic wheel control modules 23 of the subsystem B both receive their low-voltage electrical energy from the other section 43B.

In FIG. 4A, it can be seen that the central unit 3 is interconnected with each of the electronic wheel control modules 23 and with the electronic recovery module 50 by a CAN® bus (Control Area Network, designated by the reference 30A) allowing the transfer

P10-2005-WO piloting orders in computer form. The central unit 3 is responsible for the appropriate software to be able to take into account all the desirable parameters in order to develop a braking command signal which is sent to the various electronic circuits driving the electrical machines according to the protocols required to travel on the CAN bus. ® 3OA. The central unit 3 sends said signal clocked on the bus 30A with a periodicity of the order of 10 to 20 ms and each wheel control electronic module 23 controls this periodicity. Each wheel control electronic module 23 thus responds to the commands produced by the central unit 3 on the basis of the signal delivered by the first sensor C1. If for a reason of malfunction of the CAN® bus, the central unit 3 or the software implanted, or for any other reason, this periodicity is not respected, CAN® communication fault information is generated in the wheel drive electronic modules 23.

Each of the electronic wheel control modules 23 of the sub-system A, respectively of the subsystem B, also directly receives analog signals delivered by the sensor C2, respectively C3, this time via analog lines 300A respectively. 300B. Note also that each wheel control module 23 comprises the appropriate circuits for monitoring the integrity of the control signal on the lines 300A and 300B, in order to manage fault information in the event of failure of the conditioning circuit of the sensor C2, respectively C3.

Each wheel control electronic module 23 monitors its sensor signal (fault detection franc) and independently generates a "valid sensor measurement" information. In addition to the brake control developed on the basis of the sensor C1, the central unit reports on the CAN bus 30A if its own sensor C1 is valid for each electronic control module wheel 23. If this is not the case, each wheel control electronic module 23 ignores the braking setpoint running on the CAN® bus 30A in order to apply the associated sensor setpoint, namely that coming from the sensor C2 or the sensor C3. Each wheel control electronic module 23 also applies the sensor setpoint associated with it, namely that from the sensor C2 or the sensor C3, in the case of detection of a communication fault reported on CAN® as explained before. In case of detection of a clear fault on the C2 sensor or the C3 sensor, the full braking capacity is retained; it is the same in the event of a clear fault on both the sensor C2 and the sensor C3 as long as there is a braking control signal developed on the basis of the sensor C1 signaled valid on

P10-2005-WO CAN® 30A bus. However, even if the full braking capacity is maintained in the event of detection of a clear fault on the C2 sensor and / or on the C3 sensor, an alert should be activated to inform the driver of the vehicle of a failure in the vehicle. redundancy and program various appropriate measures such as prohibiting the subsequent restart of the vehicle or limit the speed.

FIG. 4B schematizes that, in the configuration just described with the support of FIGS. 3 and 4, the sensor C1 can be powered by the central unit 3 (as shown in FIG. 3) or indifferently directly via the sections 43A and 43B (with the interposition of diodes) or, as an acceptable variant, either by the section 43A or the section 43B. The sensor C2 can be powered from at least one of the electronic wheel modules 23 of the subsystem A (FIG. 3 shows a dual power supply of this type) or directly via the section 43A and the sensor C3 can be powered from least one of the electronic wheel modules 23 of the subsystem B (Figure 3 shows a dual power supply of this type) or directly by the section 43B. Thus, in the event of a power failure on the section 43A for example, the sensor C3 and the electronic wheel modules 23 associated with it (those of the subsystem B) remain powered and can play their role explained elsewhere.

Other embodiments of the low voltage power supplies and sensor connections associated therewith may be conceived. However, it is important to ensure that, in the event of failure of one of the low voltage sources, both the sensor (s) and the associated electronic wheel module (s) 23 are still all powered. The redundancy objective would not be respected to improve safety if, for example, a sensor were fed only by the voltage present on the first section 43A and one of the electronic wheel control modules 23 associated with this sensor were powered only by the second section 43B and vice versa.

Finally, control lines 30B connect the electronic recovery module 50 to the electronic dissipation modules 60 A and 6OB. In the event of a fault on said control lines 30B or on the electronic recovery module 50, the electronic dissipation modules 6OA and 6OB retain the possibility of dissipating the braking power which rises on the power line 40 in an autonomous manner, without receiving on line 30B. The principle of subsets A and B remains fully operational for braking but

P10-2005-WO without the possibility of storing the energy since, in the latter case, the electronic module 50 for recovery is out of order.

Let us return to the creation of the braking couples by the electric machines 2. The control of the electrical machines 2 being ensured directly by an electronic wheel control module 23 particular to each of the electrical machines 2. This one is in charge of the appropriate software to control each electric machine in torque according to the received control signals. Each electronic wheel control module 23 receives braking control signals on the one hand on the bus 30A and on the other hand on the analog line 300 delivering the signal of the sensor C2 or C3. Each electronic wheel control module 23 can therefore compare at any time the control signal delivered on the bus 30A and the control signal delivered by the analog line 300 and, within a certain tolerance, for example of the order of 10 at 20% according to experimental determinations, give priority to the braking control signal from the bus 30A. This is the normal operating mode.

On the other hand, if for a reason of malfunction of the central unit 3 or the software implanted in the central unit 3, the braking command signal sent by the bus 30A was much smaller than the braking control signal coming from directly analog C2 sensor, or C3, priority can be given to the control signal from the sensor C2 (respectively C3) to ensure the braking safety of the vehicle.

With three sensors, the system is even able to react to faults "not frank". The detection of a possible offset between sensors is centralized at the level of the central unit 3 which has its own measurement and the measurement flowing on the CAN bus 30A of all the electronic steering wheel modules 23. The central unit 3 assures a consistency check of the measures by determining by a "majority vote" what are the valid measures. In addition to the brake control developed on the basis of the sensor C1, the central unit 3 signals each electronic wheel control module 23, by appropriate signal on the CAN bus 30A, if its own sensor C1 is valid. It also indicates whether the own measurement of each electronic wheel control module 23 is itself valid (they do not, autonomously, this consistency check). If the measurement of the sensor C1 directly associated with the central unit 3 is not valid, each wheel control electronic module 23 ignores the instruction

P10-2005-WO braking on the CAN bus 3OA to apply the setpoint (analog signal) of its own sensor C2 or C3, if it is valid. If the internal setpoint of the electronic wheel control module 23 is not valid (the probability that it occurs at the same time for the two sensors being considered low) then the wheel concerned does not brake.

Note that only the sensor C1 (first group) is connected to the central unit 3; it serves, alone, to calculate the braking setpoint in the normal situation. The second group (sensors C2 and C3) is connected to the electronic wheel control modules 23 which transmit on the CAN® 3OA bus their measurements from the sensors C2 and C3 to the central unit 3. Note that the first group of sensors ( here, the only sensor C1) is physically connected to the central unit 3. It delivers an analog signal to the central unit 3. It should also be noted that the sensor (s) of the second group (here, the sensors C2 and C3) deliver an analog signal to each of the electronic wheel control modules 23 and that, downstream and via the electronic wheel control modules 23, they deliver to the central unit 3, this time indirectly, information via a channel communication type. On this communication channel of the computer type, digital signals and not analog signals circulate. The measurements of the second group of sensors (sensors C2 and C3) participate, in the central unit 3, the consistency check, as explained above, to validate all the measurements. However, they do not intervene directly in the normal calculation of the braking setpoint.

It is known that the multiplication of equipment contributes, in the case of a judicious implementation, to increase the operational safety of a system. This is the principle of redundancy. However, the more we increase the number of installed equipment, the more we increase the probability of failure. For example, if to ensure the redundancy of information at the central unit 3, we connect all the sensors to it, the multiplication of physical power lines between sensors and central unit increases the risk of failure. However, observing that, in the braking system treated here, the electronic wheel control modules 23 receive in any case as input information from sensors and that, in the state of the art, it implants anyway a communication channel of computer type, that is to say for example a CAN bus to ensure dialogue between all subsystems, thanks to the invention, we use an analog / digital conversion channel already existing in electronic wheel control modules and is circulated on the already existing CAN bus also one or

P10-2005-WO additional information (the information from the sensors of the second group) to provide redundancy at the level of the central unit 3. In doing so, it ensures redundancy without adding hardware for this purpose alone, so without risking degrading the system reliability. In this way, a great deal of operational security can be reconciled thanks to redundancy from the operation of several sensors, and high reliability by containing the equipment used (in particular the physical electrical connections) to a minimum.

The safety can be further increased for example by using for example 4 sensors in the second group, a sensor being associated with a single wheel. The considerations made above in case of detection of a clear fault on the C2 sensor or on the C3 sensor (full braking capacity preserved thanks to the channel using the C1 sensor, alerts utility, or even appropriate precautionary measures ) applies of course to a four-sensor embodiment in the second group.

It is seen that the proposed architecture performs a different operation of the signals delivered by each of the C1 sensors on the one hand and C2 and C3 on the other hand. The sensor C1 is associated with the central unit 3 and makes it possible to calculate a global first level braking signal. On the other hand, the control signals delivered by the sensors C2 and C3 are directly delivered by analog means by appropriate lines to the electronic wheel control modules 23

If an electronic wheel control module 23 detects a communication fault on the CAN bus 30A, or if the central unit 3 detects a fault of the sensor C1 or its conditioning circuit, priority can be given to the control signal from the sensor C2, respectively C3. In this way, the safety in the braking control is ensured even in the event of failure of the bus 30A, or of a bus section, or of any of the analog lines 300 or 30F. Of course, as already mentioned above in another hypothesis, it is necessary to activate an alert to inform the driver of the vehicle of a failure in the redundancy and to program various appropriate measures such as prohibiting the subsequent restart of the vehicle or to limit the speed.

In addition to all this, it is possible to implement a possibility of creating a predetermined braking signal by an emergency command by means of, for example, an emergency button at the

P10-2005-WO driver layout. This type of brake control is taken into account by the central unit 3, more precisely by the software implanted in the central unit 3, and is routed to the electronic control modules 23 of each of the electrical machines via the CAN bus 30A. This can provide braking safety even in the event of breakage of the brake pedal. Similarly, this can ensure a braking operation safety in case of breakage of the three sensors or failure of the fixing of the three brake sensors C1, C2 and C3. If only the mechanical connection of one of the three sensors C1 or C2 or C3 or one of the sensors is defective, of course the safety of braking operation is ensured as explained in the previous paragraph. But in this case, one can for example allow the end of the trip and, after stopping the vehicle, prohibit restarting.

FIG. 5 illustrates another embodiment of sensor associations and low voltage power supplies. The first group comprises a first sensor C1 connected directly or indirectly to one or the other of the first or second power supply or to both, the second group comprising a second sensor C2 and a third sensor C3. Each of the second and third sensors C2 and C3 is associated, to deliver a control signal to the electronic module (s) wheel (s) 23 of the two subsystems A and B, the second sensor (C2) and the third sensor (C3) being connected directly or indirectly to one or both of the first and second power supplies.

In an alternative embodiment, if the sensor C1 is connected directly or indirectly to only one of the first or second power supply, for example the section 43A, then at least one of the second C2 or third C3 sensors must be powered by a supply different from that of the first sensor C1, for example the section 43B.

FIG. 6 illustrates a third embodiment of sensor associations and low voltage power supplies. This time, the first group comprises a first sensor C1 and a second sensor C2 connected directly or indirectly to one of the first or second power supply or both, the second group comprising a third sensor C3 associated to deliver a control signal to the or the electronic module (s) wheel piloting 23 of the two subsystems A and B, the third sensor C3 being fed by one of the first or second power supply or both.

P10-2005-WO In this embodiment, the sensors C1 and C2 (first group) are physically connected to the central unit 3 and deliver it an analog signal, while the sensor C3 (second group) is connected to the electronic control modules. of wheel 23 which transmit on the CAN® 3OA bus the measurement resulting from the sensor C3 the central unit 3. It is therefore an indirect transmission via the electronic wheel control modules 23, information via a channel communication type.

If in a variant of the third embodiment, the central unit 3 is powered by only one of the first or second power supply, for example by connection to the section 43A, and if the three sensors C1, C2 and C3 are also powered by only one of the first or second power supply, then at least one of the sensors C1 or C2 of the first group must be powered by the same power supply as that of the central unit 3 while the sensor C3 of the second group must be powered by a different power supply that of the central unit 3, in this case by connection to the section 43B.

Finally, note that preferably the hardware redundancy that has just been exposed is used in combination with a software redundancy, advantageously both for the software loaded in the central unit 3 and those loaded in the electronic control modules. In this way, a high degree of safety of the vehicle braking system is achieved by a completely electric way.

P10-2005-WO

Claims

1. Electric braking system of a road vehicle of which at least one wheel is connected in rotation to at least one rotary electric machine, at least one electronic wheel control module (23) driving the electric machine or machines of the same wheel, comprising a central unit (3) managing the movement of the vehicle, said central unit controlling the electronic wheel control module or modules (23), comprising a braking command available to a driver, said command being mechanically connected to at least three sensors (C1, C2, C3) delivering a brake control signal of the vehicle having a given amplitude representative of the total braking force desired for the vehicle, said sensors (C1, C2, C3) being distributed in a first group (C1) and a second group (C2, C3), wherein the sensor (s) (C1) of the first group is (are) physically connected to the central unit (3) and delivered e (nt) its (their) analog control signal to said central unit (3) and the sensor (s) of the second group

(C2, C3) delivers (s) its (their) analog control signal to the or each of the electronic wheel control modules (23), said electronic wheel control modules (23) delivering the information coming from the sensors from the second group to the central unit (3) via a computer-type communication channel.

2. System according to claim 1, comprising at least two subsystems (A and B) each comprising at least one wheel drive electronic module (23), comprising a low voltage power supply stage for supplying electronic circuits of the invention. control and control of the power elements, said low voltage power supply stage comprising a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by an electrical line (43) comprising a first section (43A ) and a second section (43B), said first and second sections being connected by an electrical separation device (430) of the two sections, capable of interrupting the on-demand interconnection, in case of under-voltage or over-current on one of them, one (A) of the subsystems being fed by the first section (43A) and the other (B) of the subsystems being by the second section (43B), the first group having a first sensor (C) directly or indirectly connected to one of the first or second power supply, or both, the second group having a

P10-2005-WO second sensor (C2) and a third sensor (C3), the second sensor (C2) and one or the electronic wheel control module (s) (23) of one (A) of the subsystems being connected directly or indirectly to the first power supply, the second sensor (C2) delivering a control signal to the electronic module (s) wheel drive (s) (23) of said subsystem (A), the third sensor (C3) and one or more electronic wheel control module (s) (23) of the other (B) of the subsystems being connected directly or indirectly to the second power supply, the third sensor ( C3) delivering a control signal to the electronic module (s) wheel (s) (23) of said subsystem (B).

3. System according to claim 1, comprising at least two subsystems (A and B) each comprising at least one wheel drive electronic module (23), comprising a low voltage power supply stage for supplying electronic circuits of control and control of the power elements, said low voltage power supply stage comprising a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by an electrical line (43) comprising a first section (43A ) and a second section (43B), said first and second sections being connected by an electrical separation device (430) of the two sections, capable of interrupting the on-demand interconnection, in case of under-voltage or over-current on one of them, one (A) of the subsystems being fed by the first section (43A) and the other (B) of the subsystems being by the second section (43B), the first group comprising a first sensor (C1) connected directly or indirectly to one or both of the first and second power supplies, the second group comprising a second sensor (C2) and a third sensor ( C3), each of the second and third sensors (C2 and C3) delivering a control signal to the electronic wheel control module (s) (23) of the two subsystems (A and B), the second sensor (C2) and the third sensor (C3) being connected directly or indirectly to one of the first or second power supply or both.

4. System according to claim 3 wherein the first group comprising a first sensor (C1) is connected directly or indirectly to only one of the first or second power supply, at least one of the second (C2) or third (C3) sensors being powered by a different power supply than the first sensor (Cl).

P10-2005-WO

5. System according to claim 1, comprising at least two subsystems (A and B) each comprising at least one wheel drive electronic module (23), comprising a low voltage power supply stage for supplying electronic circuits of the invention. control and control of the power elements, said low voltage power supply stage comprising a first power supply and at least a second power supply, the first power supply and the second power supply being interconnected by an electrical line (43) comprising a first section (43A ) and a second section (43B), said first and second sections being connected by an electrical separation device (430) of the two sections, capable of interrupting the on-demand interconnection, in case of undervoltage or overcurrent on the one of them, one (A) of the subsystems being powered by the first section (43A) and the other (B) of the subsystems being powered by the second section (43B), the first group comprising a first sensor (C1) and a second sensor (C2) connected directly or indirectly to one of the first or second power supplies or both, the second group comprising a third sensor ( C3) associated to deliver a control signal to the electronic module (s) wheel (s) (23) of the two subsystems (A and B), the electronic module (s) of steering wheel (23) subsystems being connected directly or indirectly to the first or second power supply or both.

6. System according to claim 5 wherein the central unit (3) is fed by only one of the first or second power supply and the three sensors C1, C2 and C3 are also powered by only one of the first or second power supply, at least one sensors Cl or C2 of the first group being fed by the same power supply as that of the central unit 3, the sensor C3 of the second group being fed by a different power supply than that of the central unit 3.

7. System according to claim 2 or 3 or 5, wherein the first sensor (C1) is supplied with low voltage electrical energy via the central unit (3).

8. System according to one of claims 2 to 5, wherein said first power supply is a battery (42).

P10-2005-WO

9. System according to one of claims 2 to 8 comprising a central power line (40), wherein a second power supply is formed by a voltage converter (41) connected to a central power line (40).

Vehicle braking system according to one of claims 2 to 9, for a four-wheeled vehicle, each connected in rotation to at least one rotary electric machine (2) of its own, in which each of said -systems has two of said wheels.

11. Brake system of a vehicle according to one of claims 2 to 10 wherein each subsystem groups the vehicle wheels arranged diagonally at opposite corners of the vehicle.

12. System according to one of claims 2 to 11, wherein said central unit (3) is fed both by the first section and the second section via a pair of diodes insulating said first and second sections.

13. System according to one of claims 1 to 12 wherein the central unit (3) comprises a program providing a consistency check measures by determining by a "majority vote" which are the valid measures.

P10-2005-WO