Electrical braking system for a motor vehicle

[0002] A decentralized electrical braking system (e.g., brake by wire) for a motor vehicle which, due to its decentralized configuration, is capable of meeting high technical demands with respect to safety and availability.

[0003] A conventional braking system is described in German Patent Application No. 196 34 567. This conventional braking system has a decentralized structure in which a pedal unit for forming the command variables, which are a function of the driver's input, optionally a processing unit for the consideration of additional functions, as well as wheel-pair units for the open-loop or closed-loop control of the final controlling elements of the wheel brakes are connected via one or a plurality of communication systems. Furthermore, the braking system is supplied with energy from at least two vehicle electrical systems. In this manner, satisfactory reliability and availability of the braking system is ensured. A “pedal unit” forms setpoint values for the brake control in response to a service braking. An inclusion of a parking brake function is not described.

[0004] One of the objects of the present invention is to specify measures for the incorporation of a parking brake function into a decentralized braking system.

[0005] An incorporation of a parking-brake function into a decentralized braking system is possible using the electrical braking system according to the present invention.

[0006] In so doing, it is advantageous that the necessary operational reliability and availability are also ensured with respect to the parking brake. For example, the functional reliability of the unit evaluating the driver's braking inputs is verified without great expenditure for hardware.

[0007] Furthermore, the parking-brake input and the service-brake input of the driver are advantageously coordinated with one another.

[0008] FIG. 1 shows a first exemplary embodiment of an electromechanical braking system according to the present invention.

[0009] FIG. 2 shows an exemplary structure of a pedal unit.

[0010] FIG. 3 shows a processing unit.

[0011] FIG. 4 shows a first exemplary structure of a wheel unit of the electromechanical braking system illustrated in FIG. 1.

[0012] FIG. 5 shows a second exemplary structure of the wheel unit of the electromechanical braking system.

[0013] FIG. 6 shows a second exemplary embodiment of the electromechanical braking system.

[0014] FIG. 7 shows a third exemplary embodiment of the electromechanical braking system.

[0015] FIG. 8 shows a third exemplary structure of the wheel unit of the third exemplary embodiment illustrated in FIG. 7.

[0016] An open-loop or closed-loop control of the service-brake and parking-brake function of the braking system of a motor vehicle is described below. Due to the decentralized distribution of the braking system and the redundancies provided in the system, in the event of static and dynamic faults, the braking functionality is maintained to a high degree, and the operational reliability of the braking system is ensured. In addition, fault conditions are stored for service purposes and signaled, if necessary. The abbreviations for components and signals, which are described below and shown in the Figures, are provided in the Appendix.

[0017] FIG. 1 shows a first exemplary embodiment of an electromechanical braking system according to the present invention, and the respective signals exchanged. The system has a decentralized structure which results from the system components, and includes a pedal unit 10, four wheel units 12, 14, 16 and 18, an energy diagnostic unit 20 and a processing unit 22.

[0018] Pedal module (unit) 10 of the electromechanical braking system is primarily responsible for detecting the driver's braking input, analyzing the overall system condition and initiating fallback strategies in a fault situation.

[0019] Each wheel unit (12, 14, 16, 18) is composed of a wheel module (12a, 14a, 16a, 18a), the wheel sensors (e.g., for example, n1, F1i, s1H, etc.) and an actuator (12b, 14b, 16b, 18b). Each wheel module (12a, 14a, 16a, 18a) includes a microcomputer system, a monitoring component, and the power electronics for driving the actuator.

[0020] The electric power for the electrical system is supplied via the two independent vehicle electrical systems E₁and E₂. Two wheel units are supplied from the same energy source. In the system structure shown in FIG. 1, a diagonal distribution is assumed, i.e. wheel units (12, 14) for the left front and right rear wheels are supplied from a shared energy source E₁The same holds true for wheel units (16, 18) for the right front and left rear wheels, which are supplied from energy source E₂. Another embodiment in which the two wheel units of one axle are in each case allocated to one energy source is likewise possible. This embodiment will not be discussed further below. The following described procedures are likewise used for this distribution with the corresponding advantages. The wheel units are arranged near the respective wheel brake, while the pedal unit and processing unit 22 are mounted together or separately at a more central location.

[0021] Data is exchanged between the individual components of the braking system with the assistance of two independent communication devices K₁and K₂, which are preferably implemented as serial bus systems, e.g., CAN. Communication devices K₁and K₂are powered by the different vehicle electrical systems. In addition, the connection to the control unit of the engine management system is implemented by a communication system K₃.

[0022] In each wheel module, the activation of the associated actuator is implemented for adjusting the desired application force or the desired braking torque. For this purpose, the wheel application force or the wheel braking torque is alternatively detected in each actuator by sensors. The electromechanical actuator acts via a gear stage on the brake application stroke of disc or drum brakes without a hydraulic intermediate stage. To this end, the wheel unit controls the application force or the braking torque for the individual wheel. The necessary command variable is preselected by way of the allocated bus system.

[0023] In one exemplary embodiment, actuator (12b, 14b, 16b, 18b) of a wheel unit also includes an electromagnetically vented disengaging (release) device (control via i1K, i2K, i3K, i4K), which, on one hand, performs the parking-brake function, and in addition, during steady-state braking phases, retains the braking system in the prevailing position without energy consumption. In addition, integrated in actuator (12b, 14b, 16b, 18b) of each wheel is a resetting (return) device (control via i1R, i2R, i3R, i4R) which, in response to all types of faults that would prevent the brakes of a wheel from releasing, isolates the wheel in question. In order to be able to manage these types of faults even when an energy diagnostic unit (20) is malfunctioning, the resetting device is activated by the adjacent wheel unit of the same axle (e.g. for 12bfrom 18a). In the diagonal distribution of the energy circuits under discussion, the two wheel units of an axle are preferably supplied from different energy sources. Because of this, in the event of failure of an energy source, in any state, at least a release of the affected actuator can be achieved by the resetting device.

[0024] Energy diagnostic module (20) ascertains the state of charge of the energy supply units and transmits this information (c₁, c₂) to pedal module (10).

[0025] A detailed description of the functions and of the structure of the system components of the electromechanical braking system is described below, with reference to FIGS. 2 through 5.

[0026] FIG. 2 shows an exemplary embodiment of pedal module (10).

[0027] The tasks of this system component are to detect the driver's braking input, and specifically with respect to the service brake and the parking brake, and to form the requisite command variables for the wheels of the front and rear axles; to acquire and evaluate the status messages of all system components of the electromechanical braking system; to analyze the prevailing overall condition of the braking system, optionally initiating fallback measures and signaling the fault condition to the driver or storing it within a fault storage means; to initialize all components of the braking system after the ignition is switched on or in response to the actuation of the brake while the ignition is switched off; to deactivate the braking system after travel has terminated; and to activate the brake light.

[0028] The driver's input for a service braking is detected by independent sensors b₁, b₂and b₃, which preferably detect the analog driver input (brake-pedal angle and/or the force of the actuation) at the brake pedal. The sensors are powered by the different energy supplies E₁and E₂, respectively, i.e. sensors b₁and b₂by energy supply E₁and sensors b₂and b₃by energy supply E₂. The driver input of a parking-brake actuation is detected by way of sensors b₄and b₅(likewise, e.g. by detecting the deflection of the parking-brake lever), which are powered by the different energy supplies. One analog sensor each for detecting the service-braking input as well as the parking-brake input could also be replaced by a binary detector (e.g. a transducer).

[0029] Pedal module 10 has a fault-tolerant construction, e.g. by implementation using a redundant microcomputer system composed of microcomputers P₁and P₂, which in addition includes the necessary interface, storage and watchdog modules, and a monitoring component P₃. Microcomputers P₁and P₂as well as monitoring component P₃communicate via internal communication channel C which, for example, is implemented by a serial bus system or with serial interfaces. Independent programs Pr1 and Pr2 are implemented within microcomputer systems P₁and P₂Using computer program Pr1, sensor signals b₁through b₅are acquired via input interface U₁, stored, and made available to microcomputer P₂via communication channel C. In corresponding manner, using computer program Pr2, sensors signals b₁through b₅are acquired via input interface U₂, stored, and transmitted to microcomputer P₁. Therefore, 6 measured values of the driver's input for service braking and 4 measured values of the driver's input for a parking-brake actuation are available within both computers.

[0030] From the measured values for the service braking, a representative signal value for the service-brake input b_B,repis determined in microcomputers P₂and P₂, in each case by majority selection. This is effected while weighting possible individual errors, in that the individual measured values which differ over and above a certain degree from the others are not utilized for forming the reference values. The reference values calculated in microcomputers P₁and P₂are designated by b_B,rep,1and b_B,rep,2, respectively. If reference value b_B,rep,1exceeds a predefined limiting value, then the brake light is activated by signal U_BL.

[0031] Representative signal values are likewise calculated in both microcomputers from the measured values of the driver's input for the parking-brake actuation. The representative signal values ascertained in microcomputers P₁and P₂are designated by b_F,rep,1and b_F,rep,2, respectively. When the passenger car is stationary (which, e.g. is determined by evaluating one or a plurality of wheel-speed signals), these representative signal values are the maximum values of the measured sensor signals b₄and b₅, and when the passenger car is in motion, i.e. not stationary, are the minimum values of these two sensor signals.

[0032] From reference values b_B,rep,1and b_B,rep,2, the respective command variable for the desired average application force or the desired average braking torque of a wheel during a service braking is calculated in both microcomputers, using a stored pedal characteristic. This command variable is designated in microcomputer P₁by F_B,res,1and in microcomputer P₂by F_B,res,2.

[0033] Utilizing a pre-definable stored characteristic, the driver's input for the average application force or the average braking torque of a wheel during a parking braking is likewise ascertained in microcomputers P₁and P₂from sensor signals b_F,rep,1and b_F,rep,2. This command variable is designated in microcomputer P₁by F_F,res,1and in microcomputer P₂by F_F,res,2.

[0034] The command variables for the service brake input and the parking brake input calculated in one microcomputer are made available to the respective other microcomputer via internal communication channel C. In both microcomputers, F_B,res,1is compared to F_B,res,2and F_F,res,1is compared to F_F,res,2. If the comparison values agree in each case within a pre-definable tolerance limit, then a resulting variable is formed for service-brake input FB,res by the arithmetic mean from variables F_B,res,1and F_B,res,2, and the resulting variable for parking-brake input F_F,resis formed by the arithmetic mean of variables F_F,res,1and F_F,res,2.

[0035] If the comparison values do not agree, then the error-free signal values both for the service-brake input and for the parking-brake input are clearly detected by monitoring component P₃on the basis of the computer monitoring system described below. In both microcomputers, the error-free signal values are allocated to variables F_B,resand F_F,res, respectively.

[0036] The resulting average application force of a wheel F_resis formed from signals F_B,resand F_F,resusing the equation F_res=maximum (F_B,res, F_F,res). In an alternative embodiment, F_rescould also correspond to the resulting average braking torque of a wheel which is demanded by an actuation of the service or parking brake. The desired application forces or braking torques for the wheels of the front axle F_vand for the wheels of the rear axle F_Hare calculated from F_resalong the lines of a suitable distribution.

[0037] Using communication systems K₁and K₂, the pedal module transmits the setpoint values for the application forces and braking torques F_vand F_Hto the connected components of the electromechanical braking system.

[0038] Due to the diverse acquisition and calculation, errors which would lead to an unintentional braking or a false command variable for the wheel application force or the wheel braking torque are recognized. Corrupt memory contents, which would result in a similar faulty action, are detected as well. Monitoring component P₃communicates with microcomputers P₁and P₂, respectively, via internal bus system C. The monitoring component is used for monitoring the program runs in programs Pr1 and Pr2, and in addition, for checking the computing reliability of microcomputers P₁and P₂. In order to ensure safety in the event of a computer error in P₁or P₂, in this fault situation, programs Pr1 and Pr2 must nevertheless still run properly, or the run which is not proper must be reliably recognized. In response to a run which is not proper, the associated computer channel is deactivated and an error is signaled by way of signals d_p1and d_p2, respectively. In the embodiment shown, the control of the performance reliability is effected by a query-response communication. Microcomputers P₁and P₂collect a query from monitoring component P₃and respond to it within a predefined time interval, in each case taking into account all safety-relevant program sections. The queries are preselected in such a way that a correct response is only given if these program sections, in particular the computer functional performance tests (RAM test, ROM test, etc.) and the command tests (with respect to addition, subtraction, etc.) are executing correctly. The partial responses formed from the partial programs are combined in each microcomputer to form a complete response. The respective complete responses provided by microcomputers P₁and P₂are checked in the monitoring component with respect to the time interval of arrival and for the bit-for-bit agreement with the correct response matching the query and, if applicable, strategies for mastering the error such as signaling and channel deactivation are initiated. The performance reliability of the monitoring component is checked by microcomputers P₁and P₂using suitable test queries. These test queries can only be answered correctly by the monitoring component if it is functioning completely correctly.

[0039] In addition, the internal error states and error signal messages d₁, d₂, d₃and d₄of the connected wheel units and error message d_vof the processing unit are acquired in the pedal module and stored in a fault storage means. Status signals c₁and c₂of the energy diagnostic unit are also acquired. This acquisition takes place both during a test phase before the vehicle begins to move, as well as during all vehicle operating phases. All error and status signals are evaluated within the pedal module, using preselected tables in which an action to be carried out for each type of error and for each status is stored. As a result of the evaluation, while the vehicle is in operation, messages for fallback strategies corresponding to the danger potential of the error states are introduced in the various components of the braking system which are transmitted to the processing unit and the wheel units by signals r₁, r₂, r₃, r₄, and r_v. In the case of safety-relevant errors, the driver is signaled by error signals d_P1and d_P2, respectively. In the case of error states which are detected in the test phase before vehicle travel begins, the driver is likewise signaled. In response to safety-critical errors, the initializing of the braking system is broken off, and the parking brake is prevented from releasing. In the event of safety-critical operating states while the vehicle is in motion, it is also possible to intervene in the engine management system to reduce the available drive torque.

[0040] Using signal lines z₁and z₂, respectively, the further components of the electromechanical braking system are initialized by the pedal module after the ignition is switched on, or in response to the actuation of the brake while the ignition is switched off, as well. In addition, a controlled shutdown of the system components is carried out when vehicle operation has ended using these signals.

[0041] Service interface d_smakes it possible for service personnel to access the braking system and to read out the error storage means for the entire system.

[0042] Energy diagnostic unit (20) monitors the energy supply units (batteries) with respect to sufficient capacity for the output and energy necessary during braking processes. For this, at least the energy needed to achieve the minimum braking action specified by law must be guaranteed. Monitoring is accomplished by suitable sensors L₁and L₂, for example, for measuring the charging current and the load current, and a mathematical model. This model takes into account the electro-chemical and physical properties, as well as the previous histories, e.g. the number of exhaustive discharges, of the energy supply units. The energy diagnostic unit is preferably implemented in the form of a redundant microcomputer system which is powered via two energy sources and whose subsystems are able to exchange data via an internal bus system.

[0043] The higher-level functions of the braking system are implemented in processing unit (22). Among these are, in particular, the calculations of the wheel-individual command variables F₁, F₂, F₃and F₄for the application forces or braking torques of a wheel. The calculations are carried out, using known principles such as the consideration of the wheel specific rotational frequencies during full brakings along the lines of an anti-lock protection; consideration of a traction control function; implementation of an operating dynamics control for avoiding skid conditions, including further sensors, e.g. for steering-wheel angle δ_L, transversal acceleration a_yand yaw-angle speed ψ; consideration of the braking-pad thickness for each individual wheel during partial brakings with the goal of achieving uniform wear of the brake pads; implementation of a hill-holder function; consideration of the load state to achieve optimal braking-force distribution on the wheels of the front and rear axle; achievement of an adaptive braking-force distribution between the inner and outer wheels of an axle in a curve as a function of the measured steering angle, in order to achieve improved operating dynamics; corrections of the individual braking forces in response to the malfunction of a wheel unit; deliberate interventions in the engine management system in response to a braking input via communication system K₃; and intervention in the engine management system in the event of a safety-critical fault of the braking system. In addition, the measured actual values of controlled variables F1i, F2i, F3i and F4i are available to the processing unit for calculating command variables F1 through F4 for the individual wheels. Furthermore, operating-dynamics reference variables can optionally be ascertained for supporting the monitoring functions within the wheel units. Details are set forth in the description of the functions of the wheel unit.

[0044] As shown in FIG. 3, processing unit (22) is redundantly constructed using two microcomputer systems RV1 and RV2, which exchange calculated data via an internal communication channel C1. Via the two communication systems K₁and K₂, processing unit (22) receives the wheel-individual rotational frequencies (n1 through n4) and the actual values of the application force or the braking torque (F1i through F4i) from wheel units (12 through 18), and receives the command variables for the application force or the braking torque for the wheels of front axle F_vand for the wheels of rear axle F_H, respectively, from pedal unit (10).

[0045] In the event of a malfunction of one computer channel in pedal unit (10), the data transport via the connected communication system is interrupted. In response to this fault constellation, processing unit (22) transmits the axle-individual command variables Fv and FH received from the other computer channel of pedal module (10), as well as messages (r1 through r4) for the fallback strategies, to connected wheel units (12 through 18). In addition, given this fault, diagnostic messages (d1 through d4) of the wheel units are routed to the functional computer channel of the pedal module. Consider as an example the malfunction of microcomputer P₂in the pedal module. In response to this error case, the messages of the pedal module can be transmitted via communication system K₁and the processing unit to wheel modules 2 and 4. The diagnostic messages from wheel modules 2 and 4 take the reverse path. In addition, to calculate the wheel-individual command variables necessary for an operating-dynamics-control function, the requisite variables (steering angle, transversal acceleration and rate of rotation) are ascertained in processing unit (22).

[0046] The calculations indicated above are performed independently in both computer systems RV1 and RV2 and compared to one another. In response to inconsistent results, the processing unit is switched off and a fault-status message dvis dispatched via the communication system.

[0047] The application forces and braking torques for the individual wheels are controlled in closed loop within the wheel units. Communication systems K₁and K₂provide the command variables for this purpose.

[0048] The wheel units are powered by different electrical energy sources, wheel units 12 and 14 by energy source E₁and wheel units 16 and 18 by energy source E₂. The wheel units are also connected to the other system modules by different communication systems. Wheel units 12 and 14 communicate via K₁and wheel units 16 and 18 communicate via K₂.

[0049] Wheel unit 12 shown in FIG. 4 is described below. The other wheel units are constructed in a corresponding manner. Wheel unit 12 is used for the closed-loop control of the application force or the braking torque of one wheel and for initiating a fallback strategy in response to a fault in actuator 18bof wheel unit 18. Wheel unit 12 communicates with the other system components via communication system K₁. The wheel unit receives the following variables via this system:

[0050] F₁: Wheel-individual command variables for the closed-loop control of the application force or of the braking torque of the wheel. This variable is provided by processing unit (22) at the instant of an ABS (i.e., an antilock braking system), ASR (i.e., a traction control system) or FDR (e.g., an operating dynamics control) intervention. In a further embodiment variant, this command variable could additionally be calculated by the processing unit specifically for the following tasks:

[0051] a) to achieve uniform wear of all the brake pads of a vehicle;

[0052] b) to adapt the distribution of the driver's overall braking-torque input on the wheels of the front and rear axle, respectively, as a function of the instantaneous axle-load distribution; and

[0053] c) to achieve an adaptive braking-force distribution between the inner and outer wheel of an axle in a curve as a function of the measured steering angle, in order to achieve improved operating dynamics.

[0054] F_v: Substitute command variable for the front axle for the application force or the braking torque of a front-axle wheel. (Substitute command variable F_His used correspondingly for the wheel units allocated to the rear axle.) Command variable F_vis formed from the service-brake and parking-brake input of the driver and is provided to the two wheel units of the front axle as well as to the processing unit. The axle-specific command variable is used within a wheel unit for the closed-loop control of the braking force or of the braking torque, provided that no differing wheel-individual command variable has been formed in the processing unit, or also in the event of a malfunction of the processing unit.

[0055] r₁: Control message for initiating a modified processing sequence in the wheel unit. This message is formed by the pedal unit or the processing unit from the received error signal messages of the connected system modules.

[0056] The signals received via the communication system are stored redundantly in storage cells S_iof microcomputer system R_1A. In other embodiments, the following signals received via communication system K₁can also be processed for monitoring the functioning of the wheel unit:

[0057] a_R2, a_R3, a_R4: decelerations of the other wheels

[0058] a_v,ref: reference value for the deceleration difference of the wheels of the front axle

[0059] s_R2, s_R3, s_R4; slippage of the other wheels

[0060] Δs_v,ref: reference value for the slippage difference between the wheels of the front axle

[0061] v_F: estimated value for the vehicle velocity.

[0062] The following signals are fed as output variables of the wheel unit via communication system K₁to the connected system modules:

[0063] n₁: preprocessed rotational-frequency signal of the allocated wheel

[0064] d₁: cyclical error-signal message of the wheel unit

[0065] f1i: measured actual value of the controlled variable

[0066] In addition, in variants of the embodiment, the following variables are also needed by wheel unit 12 for monitoring functioning in the other wheel units:

[0067] a_R1: deceleration of the allocated wheel

[0068] s_R1: slippage of the allocated wheel

[0069] The signals are provided via communication system K₁to the other system modules.

[0070] Wheel unit 12 includes the following components:

[0071] a) microcomputer system R_1Ahaving the associated interface, storage, and watchdog modules;

[0072] b) monitoring component R_1B;

[0073] c) electric motor M_1H, including the necessary gear stage for converting the rotational movement into an adjustment movement of the brake pad of a disc or drum brake;

[0074] d) electromagnetically vented disengaging device K_u1, which engages with a shaft lying within the flow of torque between the electric motor and the brake pad, and which, in the currentless state, is closed by a spring element, and in this state, maintains the prevailing angular position of the shaft. The design of this disengaging device must ensure that any input application force on the brake disc can be maintained;

[0075] e) resetting module M_1R, implemented in the form of an electromagnetically operable disengaging device or as an electric motor. This module is powered by energy source E₂and is driven by wheel unit 18;

[0076] f) power electronics LE_1Hfor driving electric motor M_1H;

[0077] g) power electronics LE_1Kfor driving electromagnetically operable disengaging device Ku₁;

[0078] h) power electronics LE_2Rfor driving resetting module M_2Rwhich is integrated in wheel unit 18.

[0079] Items c), d) and e) will hereinafter be referred to as actuator 12bof wheel unit 12.

[0080] The following input signals deriving from the allocated wheel are fed via peripheral input modules to microcomputer system R_1Aand redundantly stored in storage cells S₁: wheel rotational frequency n₁, actual value F_1ifor the wheel application force or the wheel braking torque, the brake application stroke or the rotational angle s_1Hof the gear stage or of the electric motor and optionally the motor current i_1Hof the actuator.

[0081] Within microcomputer R_1A, first of all, command variable F_1Fis selected from variables F₁and F_v, respectively, received cyclically via the communication channel. Using prevailing measured actual value F_1ifor the wheel application force or for the wheel braking torque, system deviation x_d1is formed therefrom according to

[0082] x_d1(t)=F_1F(t)−F_1i(t)  (1)

[0083] With limiting values ε and μ to be predefined, and time intervals T_ε and T_μ, the comparisons can then be carried out in accordance with

[0084] |x_d1(t)|≦εfor 0<t<T_ε  (2)

[0085] |d x_d1(t)/dt|≦μ for 0<t<T_μ  (3)

[0086] If conditions (2) and (3) are met, no corrective interventions whatsoever are carried out at the actuator. If this condition is not met, then the active manipulated variable necessary for adjusting the wheel application force or the wheel braking torque is calculated using a digital control algorithm, taking into consideration the most recently output manipulated variable (for example, of a proportional-integral controller or of a proportional-integral-derivative controller). This manipulated variable is output in the form of PWM signal u_1Hto power electronics LE_1H. In addition, electromagnetically vented disengaging device Ku₁is activated by way of control signal f₁and power electronics LE_1K, this being the prerequisite for enabling a rotational movement of the motor to achieve a change in the wheel application force. If conditions (2) and (3) are met during the adjustment of the application force or of the wheel braking torque, then activation of electromagnetically operable disengaging device Ku₁is terminated, and electric motor M_1His subsequently switched to the currentless state. In order to avoid an unwanted change in the wheel application force because of a malfunction of microcomputer system R_1A, activation of the electric motor by current i_1His only made possible if enabling signal g_1Hand, additionally, enabling signal e_1Hof monitoring component R_1Bare applied to the activation section of power electronics LE_1H(e.g., AND-operation in LE_1H).

[0087] In order to also be able to avoid an unwanted decrease of the wheel application force maintained by the disengaging device, the activation of disengaging device Ku₁by current i_1Kis only possible when both enabling signal g_1Hand enabling signal e_1Hare made available by monitoring component R_1B(e.g., AND-operation in LE_1K). By including the electromagnetic disengaging device in the control process, in response to an approximately steady-state braking input of the driver, the necessary application force can initially be applied via the electric motor, and subsequently can be maintained solely by the spring forces within the electromagnetically operable disengaging device, without the consumption of electrical energy. Thus, the application forces necessary in response to the actuation of the parking brake of the motor vehicle can be introduced in a simple manner and maintained without energy. To release the brake at a wheel, first the disengaging device is opened by activation signal f₁, and thereupon, electric motor M_1His activated by negative voltage. If this release is prevented by a fault in the actuator suite, for example, because the gear stage in the actuator suite has jammed, then this error can be clearly recognized from the measured wheel application force or wheel braking torque. This is done, for example, by comparing the activation input to the wheel rotational frequency, optionally to the rotational angle. Jamming is recognized when, for example, in spite of activation, no change is recognized in the rotational angle of the electric motor, and/or if there is brake slippage of the allocated wheel in the absence of activation. The closed-loop control is thereupon broken off, and an error message d₁is dispatched via the communication system. This message is evaluated in pedal unit (10), and as a result, an error-rectification measure is initiated. With the assistance of a fallback message r₂, sent via communication system K₂, wheel unit 18 shown in FIG. 5 receives the information to activate resetting device M_1Rin actuator suite 12bby way of power electronics LE_1Rand signal i_1R. Since resetting device M_1Ris activated by energy source E₂, a release of the braking function of the wheel allocated to wheel unit 12 can even be carried out in the event of a failure of energy source E₁.

[0088] There is a corresponding reaction in wheel unit 12 to a fallback message r₁which contains the information to release the wheel, allocated to wheel unit 18, which was braked due to a fault situation. This type of message leads to the output of signal u_2Rwhich activates power electronics LE_2R. However, control signal i_2Rfor addressing the resetting device in actuator 18bis only actuated if enabling signals g_2Rand e_2Rare provided (e.g., AND-operation in LE_2R).

[0089] The accuracy of the measured actual value of the wheel application force or of the wheel braking torque can be ensured by an analytical redundancy. In one implementation of the present invention, this redundancy can be effected by one or more of the following measures:

[0090] Comparing the actual values of the wheel braking force or the wheel braking torque to a reference variable F_r,a. To determine F_r,a, first the change of position or rotational-angle measured variable s_1His measured from the instant of the start of braking, and with the assistance of a function defined in the design, subsequently converted to the physical dimension of a force or a torque. This function takes into consideration all elasticities of the components arranged in the force flux of the actuator. In the case of the closed-loop control of the wheel braking torque, a temperature-dependent friction model of the brake disc (e.g., modeling of the heating and cooling of the disc) is also implemented in the function.

[0091] Comparing the actual value of the wheel application force or the wheel braking torque to a reference variable F_r,b. To determine F_r,b, the current of electric motor M_1His measured during a steady-state braking phase and, with the assistance of a predefined function, is converted to the physical dimension of a force or a torque. This function takes into consideration, first of all, the design data of the electric motor and of the gear, optionally including a temperature and friction model. Also taken into consideration are the prevailing, effective input voltage and the direction of rotation before reaching the steady-state working point. In the case of the closed-loop control of the wheel braking torque, a temperature-dependent friction model of the brake disc can also be implemented in the function.

[0092] A further method is based on the comparative observation of the deceleration of the wheels in the partial-braking range. The calculation of the wheel decelerations in the individual wheel units is initiated by a message from the processing unit at instant T_x. The deceleration of the wheel allocated to wheel unit 12 is calculated according to the equation

[0093] a_R1(T_x)=C₁[n(T_x)−n(T_x−T_a)]  (4)

[0094] Here, T_ais the cyclical sampling time during which the rotational frequency is ascertained at each wheel unit, and C₁is a constant defined by the wheel geometry and the sampling time.

[0095] The deceleration difference Δa_v(T_x) of the front-axle wheels is formed from the deceleration values of the wheels of front axle a_R1(T_x) and a_R2(T_x):

[0096] Δa_v(T_x)=a_R1(T_x)−a_R2(T_x)  (5)

[0097] Value a_R2(T_x) necessary for this purpose is supplied by wheel unit 18 via communication system K₁. If the closed-loop application-force or braking-torque control is functioning correctly, the following must be true for deceleration difference Δa_v(T_x):

[0098] |Δa_v(T_x)−Δa_v,ref(T_x)|<ε_a  (6)

[0099] Here, Δa_v,refis a reference value for the deceleration difference of the wheels of the front axle. ε_adescribes a parameterizable fault limiting value. Reference value Δa_v,refis calculated in the processing unit with a mathematical model, using the cyclically acquired operating-dynamics measured variables of steering-wheel angle δ_L, transversal acceleration a_y, and yaw-angle speed ψ, and taking into account an estimated value for vehicle velocity v_F. If condition (6) is violated, then a fault can be inferred in the application-force or braking-torque sensor of one of the wheels. The use of both wheels of an axle for detecting faults eliminates the influence of disturbance variables which act on both wheels. In this method, it is assumed that the functionality of the control algorithm and of the manipulated-variable output, as well as the error-free detection of the rotational frequencies at both wheels of the front axle are ensured by other monitoring methods. The allocation of a recognized fault to wheel unit 12 or wheel unit 18 is effected by including the two wheel-deceleration values of the rear axle a_R3(T_x) and a_R4(T_x) (e.g. by comparing the individual variable to the corresponding variable of a rear wheel).

[0100] A further method is based on the comparative consideration of the slippage values of the individual wheels in the partial-braking range. The calculation of the slippage in the individual wheel units is initiated by a message from the processing unit at instant T_x. Within wheel unit 12, the slippage of the allocated wheel, along with wheel rotational frequency n₁and the estimated value of vehicle velocity v_F, is calculated according to the equation

[0101] s_R1(T_x)=1−C₂n₁(T_x)/V_F(T_x)  (7)

[0102] Constant C₂is determined by the wheel geometry. Using wheel slippage s_R2(T_x), which is supplied by wheel unit 18 via the communication system, the slippage difference of the wheels of front axle Δs_vcan be calculated according to

[0103] Δs_v(T_x)=s_R1(T_x)−s_R2(T_x)  (8)

[0104] If the closed-loop application-force or braking-force control is functioning correctly, the following must be true for slippage difference Δs_v(T_x)

[0105] |Δs_v(T_x)−Δs_v,ref(T_x)|<ε_s  (9)

[0106] Here, Δs_v,refis a reference value for the slippage difference of the wheels of the front axle. ε_sdescribes a parameterizable fault limiting value. Reference value Δs_v,refis calculated in the processing unit with a mathematical model of the operating dynamics, using the cyclically acquired measured variables of steering-wheel angle δ_L, transversal acceleration a_y, and yaw-angle speed ψ, and taking into account the wheel-individual command variables for the application forces or wheel braking torques:

[0107] Δs_v,ref(T_x)=f₁{δ_L, a_y, Ψ, F₁, F₂, F₃, F₄}  (10)

[0108] In a further variant of the embodiment, an improved reference variable Δs_v′refcan be ascertained, by including measured or estimated values for wheel loads F_N1, F_N2, F_N3and F_N4. To that end, Δs_v′refis formed in the processing unit using an expanded dynamic model. In this manner, influences caused by a shift in the wheel load are taken into consideration during the calculation. If condition (9) is violated, then a fault can be inferred in the application-force or braking-torque sensor of one of the wheels. In this context, it is assumed that the functionality of the control functions, as well as the error-free detection of the rotational frequencies at both wheels of the front axle are ensured by other monitoring methods. The allocation of a recognized fault to wheel unit 1 or wheel unit 2 is effected by including the two slippage values s_R3(T_x) and s_R4(T_x) for the wheels of rear axle (e.g., by comparing the individual variable to the corresponding variable of a rear wheel).

[0109] The monitoring concept of the wheel module is structured with the four logic levels L₁, L₂, L₃and L₄and two hardware levels. Microcomputer system R_1Aand monitoring component R_1Boperate in the hardware levels.

[0110] Monitoring component R_1Bcommunicates with microcomputer system R_1Aby an internal bus system. The monitoring component is used to check the computing capability of this microcomputer system and to monitor program runs within the computer. A mutual monitoring of these components is made possible by the selected type of data communication between microcomputer system R_1Aand monitoring component R_1B. For that purpose, the following tasks are assigned to the logic levels:

[0111] A level 1 is implemented in microcomputer system R_1A. It assumes the following tasks: calculating the control function for the activation of electric motor M_1H; activation of electromagnetically operable disengaging device Ku₁; activation of resetting module M_2R; calculations for checking the accuracy of the measured actual value of the wheel application force or wheel braking torque F_1iby the analytical redundancy described.

[0112] A level 2 is likewise integrated into microcomputer R_1A. This level checks the accuracy of the calculations carried out in level 1, using algorithms which are of a different nature from those in level 1. In addition, the input data stored redundantly in storage cells S_iare used to perform the calculations, so that errors due to corrupt memory contents are recognized. The functioning of the controller is checked by a parallel-connected, mathematical model of the controller, which is calculated using the redundantly stored data for alternative command variables F₁and F_v, respectively, and with the actual value of the wheel application force or wheel braking torque F_1i. An error condition is recognized in response to significant deviations between the model output variable and the calculations performed in level 1. In addition, the correct functioning of the controlled system is checked in level 2. Used for that purpose is a mathematical model of the controlled system which describes the dynamic correlation between the manipulated variable and controlled variable F_1i, also including disturbance variables. The manipulated variable calculated in the control algorithm in level 1 is supplied to this model. An error condition is recognized in response to significant deviations between the model output variable and the measured actual value of the wheel application force or wheel braking torque F1_i. Activation signals f₁for the electromagnetically vented disengaging device and u_2Rfor the resetting module, respectively, are likewise checked for correctness in level 2 and fault conditions are optionally recognized. The models utilized are derived from the physical correlations.

[0113] In response to faults recognized in level 3, as well as in level 2, the appertaining enabling signals g_1Hand g_2R, respectively, are reset, and an error message d₁is transmitted via communication system K₁.

[0114] Level 3 is implemented in microcomputer R_1A. To ensure safe functioning of the wheel unit in the event of a computer or program error, in a fault situation, the programs in levels 1 and 2 must nevertheless still run properly, or the run which is not proper must be reliably recognized. In the embodiment variant presented, the control is effected by a query-response communication of levels 3 and 4. Microcomputer system R_1Acollects a query from the monitoring computer and responds to it within a predefined time interval, in each case taking into account all safety-relevant program sections. A query can only be answered correctly if the programs for the computer functional performance test and the command test are executing in fault-free manner. The partial responses formed from the partial programs are combined to form a complete response and supplied to level 4 in the monitoring component.

[0115] This level is implemented in the monitoring component. Here, the entire response provided by microcomputer R_1Ais checked with respect to the time interval of arrival and for the bit-for-bit agreement with the correct response matching the query. If the query-response communication with level 3 is not proceeding properly, enabling signals e_1Hand e_2R, respectively, are interrupted in monitoring component R_1B.

[0116] In another embodiment (e.g., embodiment 2) the functions of two wheel units of a diagonal or of an axle are integrated into one wheel-pair unit according to the previous explanations. The structure of this embodiment variant of the electromechanical braking system is shown in FIG. 6.

[0117] In embodiments 1 and 2 of the electromechanical braking system, in the event of the failure of one energy supply or of one of communication systems K₁and K₂, respectively, it is usually the case that two wheels are no longer ready for braking. This disadvantage is avoided in embodiment variant 3. The structure of this embodiment is shown in FIG. 7 and its wheel unit is shown in FIG. 8. This embodiment differs from the embodiment 1 especially in that the wheel modules of the front wheels are each connected by redundant communication systems K₁and K₂to the other system modules, and the wheel modules of the front wheels are powered by both energy sources.

[0118] The functions described are implemented by corresponding programs which run in the corresponding computer.

[0119] The measures for forming the setpoint values in the pedal unit are also used in other electrical braking systems, e.g., in electro-hydraulic or electro-pneumatic braking systems.

[0120] a_R1, a_R2, a_R3, a_R4: Decelerations of the wheels

[0121] a_v,ref, a_H,ref: Reference value for the deceleration difference of the wheels of the front and rear axle, respectively

[0122] a_y: Transverse acceleration

[0123] b₁, b₂b₃: Measuring signals of the driver's input (e.g. brake-pedal angle)

[0124] b₄, b₅: Measuring signals of the parking-brake input

[0125] b_{B,rep,1 bB,rep,2}: Reference values for the service-brake input

[0126] b_F,rep,1b_F,rep,2: Reference values for the parking-brake input

[0127] C: Internal communication system

[0128] C₁, C₂: Diagnostic signals of the load state of the energy-supply devices

[0129] d: Activation signal of a diagnostic unit

[0130] d_p1, d_P2: Status messages concerning the state of the electromechanical braking system

[0131] d_s: Service interface in the pedal module

[0132] d_v: Error signals of the processing unit

[0133] d₁, d₂, d₃, d₄: Error messages of the wheel units

[0134] E₁E₂: Energy supply

[0135] e_1H, e_2H, e_3H, e_4H: Logical activation signal for the power electronics of a wheel unit

[0136] e_1R, e_2R, e_3R, e_4R: Logical activation signal for the power electronics of the resetting device of a wheel unit

[0137] F_B,res,1, F_B,res,2: Command variable for the total force of the service brake

[0138] F_res: Command variable for the driver's braking-force input

[0139] F_H: Command variable for the application force (or the wheel braking torque) for the wheels of the rear axle

[0140] F_F: Command variable for the parking-brake force

[0141] F_F,res,1F_F,res,2: Command variable for the total force of the parking brake

[0142] F_H: Command variable for the application force (or the wheel braking torque) for the wheels of the rear axle

[0143] F₁, F₂, F₃, F₄: Wheel-individual command variable for the wheel braking force or the wheel braking torque

[0144] F_1F, F_2F, F_3F, F_4F: Selected wheel-individual command variable for the wheel application force or wheel braking torque

[0145] F_1iF_2iF_3iF_4i: Actual value for the wheel braking force or wheel braking torque

[0146] f₁, f₂, f₃, f₄: Activation signal for the electromagnetic clutch in a wheel unit

[0147] g_1H, g_2H, g_3H, g_4H: Logical activation signal for the power electronics in a wheel unit

[0148] g_1R, g_2R, g_3R, g_4R: Logical activation signal for the power electronics of the resetting device in a wheel unit

[0149] i_1K, i_2K, i_3K, i_4K: Current for activating an electromagnetic disengaging device in a wheel unit

[0150] i_1H, 1_2H, i_3H, i_4H: Current for activating the electric motor in a wheel unit

[0151] i_1R, i_2R, i_3R, i_4R: Current for activating the resetting device in a wheel unit

[0152] K₁, K₂, K₃: Communication devices

[0153] LE_1HLE_2HLE_3HLE_4H: Power electronics for activating the electric motor

[0154] LE_1KLE_2KLE_3KLE_4K: Power electronics for activating the electromagnetically operable disengaging device

[0155] LE_1RLE_2RLE_3RLE_4R: Power electronics for activating the resetting device

[0156] L₁, L₂: Sensor suite for determining the charge condition of an energy supply

[0157] n₁n₂n₃n₄: Measured values for wheel rotational frequencies

[0158] P₁, P₂: Microcomputer in the pedal module

[0159] P₃: Monitoring component in the pedal module

[0160] r₁, r₂, r₃, r₄: Control signals for initiating a modified processing sequence in the wheel units

[0161] S_H1, S_H2, S_{H3, SH4}: Brake application stroke of the brake disc or brake drum, or the rotational angle of the electric motor or of the gear stage

[0162] S_R1, S_R2, S_R3, S_R4: Slippage of the wheels

[0163] s₁through S_n: Storage cells in the wheel modules

[0164] U₁, U₂: Input interfaces of the wheel unit

[0165] U_BL: Activation signal for the brake light

[0166] u_1H, u_2H, u_3H, u_4H: Activation signal for the power electronics of the electric motor in the wheel unit

[0167] u_1R, u_2R, u_3R, u_4R: Activation signal for the power electronics of the resetting device in the wheel unit

[0168] V_F: Estimated values of the vehicle velocity

[0169] X_d1, X_d2, X_d3, X_d4: System deviation in a wheel unit

[0170] Z₁, Z₂: Signal for initializing and deactivating the components of the braking system

[0171] δ_L: Steering angle

[0172] ψ: Yaw-angle speed

[0173] ΔS_V,ref, ΔS_H,ref: Reference value for the slippage difference between the wheels of the front and rear axle, respectively