EP4132824A2

EP4132824A2 - System unit, having a first actuator system and a second actuator system

Info

Publication number: EP4132824A2
Application number: EP21713622.5A
Authority: EP
Inventors: Samuel Bubeck
Original assignee: Robert Bosch GmbH
Current assignee: Robert Bosch GmbH
Priority date: 2020-04-08
Filing date: 2021-03-17
Publication date: 2023-02-15
Also published as: JP2023519905A; US20230065689A1; WO2021204506A2; CN115335267A; WO2021204506A3; JP7569864B2; DE102020204529A1

Abstract

The invention relates to a system unit for an at least semi-automated mobile platform, comprising at least a first actuator system and a second actuator system, each of which has at least an auxiliary operating mode and an emergency operating mode, the first actuator system and the second actuator system each being designed and coupled to switch to an inactive operating mode if a critical error is identified in the actuator system in question and to switch to an auxiliary operating mode if one of the actuator systems switches to the inactive operating mode, in order to additionally carry out at least parts of a functionality of the actuator system that is in the inactive operating mode, and to switch to an emergency operating mode if a critical error is identified in the actuator system in question in the auxiliary operating mode.

Description

description

title

System unit with a first actuator system and a second actuator system

The invention relates to a system unit for an at least partially automated mobile platform with at least one first actuator system and one second actuator system

State of the art

In today's motor vehicles, driver assistance systems are increasingly being used in different stages of development. They intervene semi-automatically or automatically in the drive, control (e.g. steering) or signaling devices of the vehicle or use suitable human-machine interfaces to warn the driver shortly before or support them during critical situations.

In addition to stabilizing functions, e.g. B. in the form of the classic ESP / ABS, an increasingly expanded range of functions: such as support of a driver through power assistance when a brake pedal is actuated by an electromechanical brake booster (eBKV) during brake actuation, or assisting or partially assisting functions by a system unit active modulation of the hydraulic brake pressure (e.g. ESP, eBKV,

Boost unit, etc.) without the active participation of the driver.

Disclosure of the invention

Future control systems for highly automated and / or partially automated driving and / or autonomous and / or partially autonomous driving require the provision of certain, possibly functional redundancies, so that in the event of an error, a “fail-operational” system, e.g. B. in a brake control system, can be guaranteed to potentially at least To enable a driver to temporarily not monitor the traffic situation, or to allow a temporary lack of responsibility or complete absence of a driver.

For example, a vehicle braking system can be designed in such a way that when a first fault occurs in the system, all braking functions can be taken over by a sub-unit of the braking system. In addition, for known automated driving functions, for example in an SAE level 3 and lower, the responsibility for driving the vehicle can be returned to a driver or a journey must be ended prematurely, since no further functional fall-back level is provided and a second fault in such a braking system could lead to this that the vehicle is no longer able to decelerate.

This is particularly important when such a system is used in a driving mode in which there is no driver or a driver cannot intervene in such a driving mode.

As an example, a brake system can have primary and secondary stabilization actuators and the primary actuators provide the (main) stabilization functions in the fault-free state.

Typically, the secondary actuator system can take over certain functionalities of the primary actuator system in its error-free state. Such a functionality of the secondary actuator system can be limited to the necessary functions of a fallback level or it can encompass the complete range of functions of the primary stabilization actuator system.

For example, a braking system in an autonomously driving vehicle, i. H. for a use case: autonomous driving SAE Level 4 have a primary and secondary braking unit. In the event of a fault in the brake system, the primary brake unit can implement the full range of functions without a secondary brake unit, and the secondary brake unit can have part of the range of functions of the primary unit and, if necessary, take over this part of the functions.

Such a functionality provided by a primary actuator system can, for example, be a wheel-specific active and passive pressure modulation, e.g. by means of an electronic stabilization program (ESP)

Return hydraulic system, and a secondary actuator system can, for example, a functionality of a single-channel active and / or passive Include pressure modulation, which can be implemented, for example, by a fail-boost unit and / or an electromechanical brake booster.

Since it is not possible to safely take over the driver in an SAE level 4 vehicle in the event of a fault in which only one of the two brake units is then functional, such a system should be designed to be as safe as possible.

Designing such a system through an optimal reaction to a further error is very complex, error-prone and, due to the very low probability of this situation, not economical due to the possible combinations of corresponding errors, since all active controllers of the system must be designed for the corresponding error situation for the optimal reaction . I. E. In particular, missing or incorrect signals must be able to be intercepted and all required signals from sensors and actuators must continue to be monitored for plausibility. However, since some of the error detection mechanisms are no longer functional due to the errors that have already been recognized, this is only possible with a high level of software development effort while accepting a lower probability of detecting errors.

According to one aspect of the invention, a system unit, a use of the system unit, a method, a device and a computer program product and a computer-readable storage medium for controlling the system unit according to the features of the independent claims are specified, which at least in part has the stated effects. Advantageous configurations are the subject matter of the dependent claims and the description below.

According to one aspect, a system unit for an at least partially automated mobile platform with at least one first actuator system and one second actuator system is proposed, each of which has at least one auxiliary operating mode and one emergency operating mode. The first actuator system and the second actuator system are each set up and coupled to switch to an inactive operating mode if a critical error is identified in the respective actuator system. Furthermore, the first actuator system and the second actuator system are set up and coupled to switch to an auxiliary operating mode when one of the actuator systems switches to the inactive operating mode in order to execute at least parts of a functionality of the respective actuator system that is in the inactive operating mode. In addition, the first actuator system and the second actuator system are set up and coupled to switch to an emergency operating mode if a critical error is identified in the respective actuator system in the auxiliary operating mode.

This system unit thus provides a further safety level in the form of the emergency operating mode, which is only active when a second critical error in the system unit, i.e. a first error in the respective actuator system that remains active in the auxiliary operating mode, occurs. The actuator system that remains active can, for example, meet all the requirements for the system unit in the auxiliary operating mode of the actuator system until the critical error occurs in the auxiliary operating mode. After the second fault in the system unit, the actuator system that is still active is intended to provide functionality for minimizing risk for the mobile platform or vehicle occupants of the mobile platform. This functionality can have greatly reduced requirements compared to a normal operating mode.

For example, a further safety level can be provided for a system unit in the form of a brake system, which is only active when a second fault affects the remaining brake unit. The respective active actuator system in the auxiliary operating mode in the form of a brake unit of the brake system that remains active can meet all the requirements for a fall-back level of known brake systems up to the second fault. After the second fault in the brake system, a maneuver to minimize the risk for the vehicle occupants can be carried out with the remaining active actuator system of the brake system, such as the remaining active brake unit, with reduced functionality. For such a maneuver, only greatly reduced requirements for stability and dynamics of the mobile platform equipped with such a braking system apply.

Thus, with such a system unit, the most robust possible operating mode for such a system unit, such as a brake system, can be provided, which brings the mobile platform, such as a vehicle, into a safe state in the error case described with a minimum of sensors, communication and actuators can.

If such a system unit is implemented in the form of a redundant brake system, it can be used to provide a brake system for highly autonomous driving. Thus, with this system unit, the risk of a (total) failure can be minimized without having to use a third actuator system by implementing a further safety level in both actuators of the system unit in the form described. This further safety level is switched to active in the respective actuator system, which in the first fallback level, for example, provides a braking functionality if an error is also identified or recognized on precisely this actuator system.

The system unit described thus provides a further safety level that is largely independent of errors in the respective actuator systems and / or of sensors and / or communication between control units of the actuator systems in order to be able to continue to carry out (emergency) braking.

For this purpose, the respective actuator system has a control mechanism that can only control a minimal functionality directly. In the case of brake systems, this can affect both the hydraulic valves, if they have to be switched to a certain position for pressure build-up in the actuator system, and the motor control. With such a system unit, a redundant braking system can be provided for highly autonomous journeys.

Advantageously, even after the occurrence or identification of two critical errors in such a system unit, such as a brake system consisting of a primary and secondary brake unit, the system unit is not automatically switched off, but instead, for example, carries out (emergency) braking.

In other words, when a first critical error occurs, the primary brake unit can implement the full range of functions without the secondary brake unit, or the secondary brake unit can take over part of the range of functions of the primary unit. A further safety level is therefore provided, which is only active when a second fault in the system unit affects the remaining braking unit. The remaining brake unit can, for example, meet all the requirements for the fallback level of known brake systems until a second fault occurs in the brake system. This additional fall-back level can provide additional security in a situation in which only one of the two brake units is functional. The respective actuator system can be set up to additionally execute at least parts of a functionality of the respective other actuator system. According to one aspect, it is proposed that the first actuator system and the second actuator system are each set up and coupled to receive a target value and to check in the emergency operating mode whether the target value is currently being received.

Such a target value can be specified for the respective actuator system in order to set the target value in a control loop or in accordance with a characteristic curve. Since, in the event of a fault, communication with sensors providing setpoint values can be disturbed, an emergency operating mode can be used to check whether such communication in the form of receiving setpoint values is intact. The further behavior of the respective actuator system in the emergency operating mode can then be made dependent on the setpoint.

According to one aspect, it is proposed that the first actuator system and the second actuator system are each set up and coupled to perform a first action in the emergency operating mode with the current setpoint received and / or to perform a second action without the current setpoint received, the first action being dependent on a value of the received current setpoint is executed.

Such a setpoint value can for example be transmitted via a bus system from a setpoint value generating system and / or a sensor to the respective actuator system. The system unit does not have to be set up to check this transmission or communication, for example in the emergency operating mode, in order to be able to decide whether such a setpoint, for example in the form of a braking force of a virtual driver of an at least partially automated mobile platform, can be implemented. A first action can, for example, relate to an action that is implemented in accordance with the value of the setpoint, and the second action can relate, for example, to an action that is permanently specified. For a braking system, the first action can correspond to braking with a predefined braking force or a correspondingly predefined braking profile, and the second action can be a predefined emergency braking. The first action can be implemented by means of a control loop and / or a control system by means of a characteristic curve.

In order to keep the dependency of the system unit on internal and external signals, which may no longer be monitored in this emergency operating mode, as low as possible, the actuation of the actuator system in the emergency Operating mode can be controlled based on characteristics and / or controlled with a complete control system.

Such a check of the functionality of the communication with a system providing setpoints can be rated positively if current setpoints are transferred to the respective actuator system at the respective point in time.

For example, in the second action, the mobile platform, such as a partially automated vehicle, for example with braking, can be brought into a safe state.

According to one aspect, it is proposed that the critical error be identified by the respective actuator system itself and / or the respective other of the actuator systems and / or a higher-level system.

If the presence of a critical error in the respective actuator system is identified by a higher-level system, other variables and dependencies with other systems can also be taken into account. If the respective actuator system identifies the critical error itself, greater independence and correspondingly lower susceptibility to, in particular, external errors can be achieved.

According to one aspect, it is proposed that the first actuator system is an electronic brake booster (eBKV) system and the second actuator system is an electronic stabilization program (ESP) system of a mobile platform; or the first actuator system is a first steering system of a mobile platform and the second actuator system is a second steering system of a mobile platform; or the first actuator system is an integrated power brake system (IPB) and the second actuator system is a redundant brake unit (RBU) of a mobile platform.

The second steering system can be designed as a redundant system to the first steering system.

The integrated Power Brake System (IPB) with the redundant brake unit (RBU) is a redundant brake system combination that is an alternative to an electronic brake booster (eBKV) system and an electronic stabilization program (ESP) system for the automated system Driving is.

The integrated Power Brake System (IPB) takes on the tasks of eBKV and ESP with an actuator system, in other words a one-box brake system. The redundant braking unit (RBU) takes over the functions of the Brake pressure build-up and stabilization only in the event of a fault in the integrated Power Brake System (IPB) and is otherwise completely passive.

The safety of the brake system resulting therefrom can be provided through the construction of a brake system in accordance with the system unit.

Use of the system unit described above for controlling an at least partially automated mobile platform is proposed.

With the above-described additional security of the system unit described, the corresponding security results for at least partially automated mobile platforms.

A method for controlling a system unit for an at least partially automated mobile platform with a first actuator system and a second actuator system is proposed, the first actuator system and the second actuator system each having an auxiliary operating mode and an emergency operating mode, and the method the following steps having. In a first step, the respective actuator system changes to an inactive operating mode if a critical error is identified in the respective actuator system. In a further step, the respective actuator system changes to an auxiliary operating mode when one of the actuator systems changes to the inactive operating mode in order to carry out at least parts of the functionality of the respective actuator system that is in the inactive operating mode.

In a further step, the respective actuator system, which is in the auxiliary operating mode, switches to an emergency operating mode if a critical error is identified in this actuator system.

In this entire description of the invention, the sequence of method steps is presented in such a way that the method is easy to understand.

However, the person skilled in the art will recognize that many of the method steps can also be carried out in a different order and lead to the same or a corresponding result. In this sense, the sequence of the process steps can be changed accordingly. Some features are provided with counting words to improve readability or to make the assignment clearer, but this does not imply the presence of certain features. The advantages of the system unit described above result correspondingly for the method described here for controlling a system unit also for the further aspects of the method.

According to one aspect, it is proposed that, in the method for controlling a system unit, the actuator system checks in the emergency operating mode whether a setpoint value for the first actuator system and / or the second actuator system is currently being received.

According to one aspect, it is proposed that, in the method for controlling a system unit, the actuator system in the emergency operating mode with the received current setpoint carries out a first action with a value of the currently received setpoint and / or carries out a second action without received current setpoint.

According to one aspect it is proposed that in the method for controlling a system unit by means of predefined characteristics of the actuator system in the emergency operating mode, such as for a motor current, and / or for predefined valve positions, according to a valve switching pattern, the actuator system in the emergency operating mode Emergency operating mode executes the first action with the value of the current setpoint received.

It can thus be achieved that the method for controlling a system unit for the first action can be designed as robustly and as less complex as possible.

A method is proposed which, based on the identified critical error and / or inactive operating mode and / or auxiliary operating mode and / or emergency operating mode of the method for controlling a system unit, provides a control signal for controlling an at least partially automated vehicle; and / or based on the identified critical fault and / or inactive operating mode and / or auxiliary operating mode and / or emergency operating mode, a warning signal for warning a vehicle occupant is provided. The term “based on” is broad in relation to the feature that a control signal is provided based on the identified critical fault and / or inactive operating mode and / or auxiliary operating mode and / or emergency operating mode of the method for controlling a system unit to understand. It is to be understood that the identified critical error and / or the inactive operating mode and / or the auxiliary operating mode and / or the emergency operating mode of the method for controlling a system unit is used for any determination or calculation of a control signal, but not excludes that other input variables are also used for this determination of the control signal.

Since in a correspondingly restricted operating mode, such as the auxiliary operating mode or the emergency operating mode, the corresponding functionality, such as a sufficient delay, cannot always be guaranteed, a higher-level unit or control, such as a virtual and / or a real Driver to be informed of this restriction. This means that further functionalities can be called up from a higher-level unit, such as support for the brakes by means of secondary actuator systems, such as an engine control, a parking brake or steering interventions to avoid collisions.

A device is proposed which is set up to carry out one of the methods described above. With such a device, the corresponding method can easily be integrated into different systems.

A computer program is proposed which comprises instructions which, when the computer program is executed by a computer, cause the computer to carry out the method described above. Such a computer program enables the described method to be used in different systems.

A machine-readable storage medium is proposed on which the computer program described above is stored. The computer program described above is transportable by means of such a machine-readable storage medium.

A mobile platform can be understood to mean an at least partially automated system which is mobile and / or a driver assistance system of a vehicle. An example can be at least one be a partially automated vehicle or a vehicle with a driver assistance system. That is, in this context, an at least partially automated system includes a mobile platform with regard to an at least partially automated functionality, but a mobile platform also includes vehicles and other mobile machines including driver assistance systems. Further examples of mobile platforms can be driver assistance systems with several sensors, mobile multi-sensor robots such as robotic vacuum cleaners or lawn mowers, a multi-sensor monitoring system, a production machine, a personal assistant or an access control system. Each of these systems can be a fully or partially automated system.

In addition, it should be noted that “comprehensive” does not exclude any other elements and “one” or “one” does not exclude a large number. It should also be pointed out that features that have been described with reference to one of the above exemplary embodiments can also be used in combination with other features of other exemplary embodiments described above. Reference signs in the claims are not to be regarded as a restriction.

Embodiments

Exemplary embodiments of the invention are shown in FIGS. 1 to 2 and are explained in more detail below. It shows:

FIG. 1 shows a sketched brake system with an electromechanical brake booster and an electronic stabilization program system; and

FIG. 2 shows a flow diagram for a method for controlling a system unit for an at least partially automated mobile platform with a first actuator system and a second actuator system.

FIG. 1 outlines a redundant embodiment of a brake system 100 with at least one first actuator system 120 in the form of an electromechanical brake booster 120 with the possibility of single-channel active and possibly passive pressure modulation, such as a fail-boost unit or an electromechanical brake booster, and a second actuator system 140 in Form of an electronic stabilization program system 140 for wheel individual active and passive pressure modulation, for example by means of ESP return hydraulics, which are hydraulically coupled via a connection 145. The electronic stabilization program system 140 is coupled to a brake system 160 of the tires of the vehicle via a further hydraulic connection 165. The first actuator system 120 and the second actuator system 140 can also be coupled in terms of signals and / or electrically.

FIG. 2 outlines a flowchart of a method 200 for controlling a system unit 100 for an at least partially automated mobile platform with a first actuator system 120 and a second actuator system 140, the first actuator system 120 and the second actuator system 140 each having an auxiliary operating mode and an emergency Have operating mode.

In a first step S1, a critical error is identified in a first or second actuator system 120 and the respective actuator system 120, 140 affected by the error changes to an inactive operating mode.

In a further step S2, the respective actuator system not affected by the error changes to an auxiliary operating mode in order to execute at least parts of the functionality of the respective actuator system affected by the error, which is in the inactive operating mode.

In a further step S3 it is determined whether a critical error is identified in the respective actuator system which is in the auxiliary operating mode.

In a further step S4, the respective actuator system, which is in the auxiliary operating mode, switches to an emergency operating mode S4a if a critical error is identified in this actuator system. In the case of a brake system, valves can be switched to the pressure build-up position for this purpose S4b.

In a further step S5, the respective actuator system checks in the emergency operating mode whether a setpoint value for the first actuator system 120 and / or the second actuator system 140 is currently being received or whether bus communication with setpoint value systems or sensors is possible.

Depending on the result in step S5, if a current setpoint value is received, the actuator system will also initiate a first action S6 in the emergency operating mode Carry out a value of the currently received setpoint, such as braking with the values of the setpoint, for example via a characteristic-based control of the actuator system motor.

Alternatively, a second action S7, such as an emergency stop of a vehicle, is carried out in the absence of a received current setpoint value in order to initiate a

To minimize the risk of accidents (blind stopping).

Claims

Expectations

1. System unit (100) for an at least partially automated mobile platform with at least one first actuator system (120) and one second actuator system (140), each of which has at least one auxiliary operating mode and one emergency operating mode; and the first actuator system (120) and the second actuator system (140) are each set up and coupled: to switch to an inactive operating mode if a critical error is identified in the respective actuator system (120, 140); and to change to an auxiliary operating mode when one of the actuator systems (120, 140) changes to the inactive operating mode in order to execute at least parts of a functionality of the respective actuator system (120, 140) that is in the inactive operating mode; and to switch to an emergency operating mode if a critical error is identified in the respective actuator system (120, 140) in the auxiliary operating mode.

2. System unit (100) according to claim 1, wherein the first actuator system (120) and the second actuator system (140) are each set up and coupled: to receive a target value; and in the emergency operating mode to check whether the setpoint is currently being received.

3. System unit (100) according to claim 2, wherein the first actuator system (120) and the second actuator system (140) are each set up and coupled: to perform a first action in emergency operating mode with the current setpoint received and / or without the current setpoint received carry out a second action, the first action being carried out as a function of a value of the current setpoint value received.

4. System unit (100) according to one of the preceding claims, wherein the critical error is identified by the respective actuator system (120, 140) itself and / or the respective other of the actuator systems (120, 140) and / or a higher-level system.

5. System unit (100) according to one of the preceding claims, wherein the first actuator system (120) is an electronic brake booster (eBKV) system and the second actuator system (140) is an electronic stabilization program (ESP) system of a mobile platform; or the first actuator system (120) is a first steering system of a mobile platform and the second actuator system (140) is a second steering system of a mobile platform; or the first actuator system (120) is an integrated power brake system and the second actuator system (140) is a redundant brake unit of a mobile platform.

6. Use of the system unit (100) according to claim 1 to 5, for controlling an at least partially automated mobile platform

7. Method (200) for controlling a system unit (100) for an at least partially automated mobile platform with a first actuator system (120) and a second actuator system (140), each of which has an auxiliary operating mode and an emergency operating mode with the steps:

Switching the respective actuator system into an inactive operating mode when a critical error is identified (S1) in the respective actuator system;

Change of the respective actuator system (120, 140) to an auxiliary operating mode (S2) when one of the actuator systems (120, 140) changes to the inactive operating mode in order to at least part of the functionality of the respective actuator system (120,

140) which is in the inactive mode of operation;

Switching the respective actuator system, which is in the auxiliary operating mode, into an emergency operating mode (S4) if a critical error is identified in this actuator system (S3).

8. The method (200) according to claim 7, wherein the actuator system (120, 140) checks (S5) in the emergency operating mode whether a setpoint value for the first actuator system (120) and / or the second actuator system (140) is currently being received.

9. The method (200) according to claim 8, wherein the actuator system in the emergency operating mode (120, 140) with the received current setpoint value carries out a first action (S6) with a value of the currently received setpoint value and / or without received current setpoint value a second one Action (S7) executes.

10. The method (200) according to claim 8 or 9, wherein by means of predefined characteristics of the actuator system in the emergency operating mode (120, 140) and / or predefined valve positions of the actuator system in the emergency operating mode (120, 140) the actuator system executes the first action (S6) in the emergency operating mode (120, 140) with the value of the current setpoint value received.

11. The method according to any one of the preceding claims, wherein based on the identified critical error and / or the inactive operating mode and / or the auxiliary operating mode and / or the emergency operating mode, a control signal for controlling an at least partially automated vehicle is provided; and / or based on the identified critical fault and / or inactive operating mode and / or auxiliary operating mode and / or emergency operating mode, a warning signal for warning a vehicle occupant is provided.

12. Device which is set up to carry out a method according to one of claims 7 to 11.

13. Computer program, comprising instructions that are used in the execution of the

Computer program causing a computer to carry out the method according to one of Claims 7 to 11.

14. Machine-readable storage medium on which the computer program according to claim 13 is stored.