Electric brake system for a motor vehicle

[0002] The present invention relates to a decentralized electric brake system (brake by wire) for a motor vehicle, which takes into account in particular the high technical demands with regard to safety and availability due to its decentralized designed.

[0003] A previously proposed electric brake system is described, for example, in German Published Patent Application No. 196 34 567. The brake system described there has a decentralized structure, where a pedal unit to form the reference input variable intended by the driver, optionally a processing unit for taking into account additional functions as well as wheel pair units to control or regulate the controlling elements of the wheel brakes are connected by one or more communication systems. Furthermore, the brake system receives power from at least two on-board electric systems. This guarantees sufficient safety and availability of the brake system. With this known system, wheel pair units are provided, and two wheel brakes are assigned to each unit. The wheel pair units each have essentially two microcomputers which monitor one another. Each microcomputer is assigned to another wheel brake and controls it according to the setpoints. The resulting operating reliability and availability are not optimal for all applications.

[0004] An object of the present invention is to provide measures for optimizing the operating safety and availability of an electric brake system, in particular in the area of wheel brake control units.

[0005] The operating safety and availability of the brake system according to the present invention is optimized by assigning each wheel brake a control unit which contains a self-monitoring and control system-monitoring computer system. Each of these wheel units implements control of the wheel brake application force or wheel braking torque for each wheel brake individually.

[0006] It is especially advantageous in one embodiment that, due to the redundancy of the communication system connecting the units, the brake function of only one wheel is lost even in the event of a failure in the power source or in a communication system.

[0007] It is especially advantageous that monitoring of the sensor for the brake application force or the braking torque of a wheel is made possible. This effectively prevents wheel brake malfunction as a result of a sensor error.

[0008] In addition, self-monitoring of proper functioning of the computer system of a wheel unit is provided, implemented by various calculations and a query/response communication between a microcomputer system and a monitoring component.

[0009] FIG. 1 shows a first embodiment of the structure of an electromechanical brake system according to the present invention.

[0010] FIG. 2 illustrates a structure of a pedal unit employed in the system according to the present invention.

[0011] FIG. 3 shows a structure of a processing unit employed in the system according to the present invention.

[0012] FIG. 4 is a first illustration of a wheel unit employed in the system according to the present invention.

[0013] FIG. 5 is a second illustration of a wheel unit employed in the system according to the present invention.

[0014] FIG. 6 illustrates a second embodiment of an electromechanical brake system according to the present invention.

[0015] FIG. 7 illustrates a third embodiment of an electromechanical brake system according to the present invention.

[0016] FIG. 8 shows a structure of a wheel unit employed in the the third embodiment of the electromechanical brake system according to the present invention.

[0017] A method of controlling or regulating the operating brake function and the parking brake function of the brake system of a motor vehicle is achieved according to the present invention. Due to the decentralized division of the brake system and the redundancies in the system, braking functionality is maintained at a high degree, and the operating safety of the brake system is ensured whenever static and dynamic faults occur. In addition, fault states are saved for service purposes and optionally signaled. The abbreviations for components and signals used in the text and the figures are listed in the addendum.

[0018] FIG. 1 shows a first embodiment of the structure of an electromechanical brake system according to the present invention and the signals exchanged in each case. This system is characterized by a decentralized structure based on the system components: pedal unit 10, four wheel units 12, 14, 16 and 18, power diagnostic unit 20 and processing unit 22.

[0019] Pedal module 10 of the electromechanical brake system is responsible primarily for detecting the driver's intention regarding braking, analyzing of the overall system status, and initiating release strategies in the event of an error.

[0020] Each wheel unit (12, 14, 16, 18) is composed of a wheel module (12a,14a,16a,18a), wheel sensors (see example, n₁, F_1i, s_1H, etc.) and an actuator (12b,14b,16b,18b). Each wheel module (12a,14a,16a,18a) includes a microcomputer system, a monitoring component, and the power electronics for controlling the actuator.

[0021] The electric system receives power from the two independent on-board electric systems E₁and E₂. Two wheel units in each case receive power from the same power source. With the system structure illustrated in FIG. 1, a diagonal division is assumed, i.e., the wheel units (12, 14) for the left front and right rear wheels receive power from the same power source E₁.

[0022] The same applies to the wheel units (16, 18) for the right front and left rear wheels, which receive power from power source E₂. An embodiment where the two wheel units of one axle are assigned to one power source is also possible. However, it will not be considered further here. With this division, the procedures described below are likewise used with the same advantages. The wheel units are arranged in proximity to the respective wheel brake, while the pedal unit and processing unit are mounted together or separately at a central location.

[0023] The data exchange between the individual components of the brake system is accomplished using two independent communication systems K₁and K₂, preferably implemented as serial bus systems, e.g., CAN. Communication systems K₁and K₂receive power from the different on-board electric systems. Furthermore, the connection to the control unit of the engine management is implemented by communication system K₃.

[0024] In each wheel module (12a,14a,16a,18a), control of the respective actuator (12b,14b,16b,18b) for adjusting the desired brake application force or the desired braking torque is implemented. To do so, either the wheel brake application force and/or the wheel braking torque is/are detected by sensors in each actuator (12b,14b,16b,18b). The electromechanical actuator (12b,14b,16b,18b) acts on the brake application paths of disk brakes or drum brakes by way of a gear stage without an intermediate hydraulic stage. The wheel unit (12, 14, 16, 18) therefore regulates the brake application force and the braking torque individually for each wheel. The required reference input variable is preset via the respective bus system.

[0025] In a preferred embodiment, the actuator (12b,14b,16b,18b) of a wheel unit also contains an electromagnetically operated rack-out device (controlled via i_1K, i_2K, i_3K, i_4K) which executes the parking brake function and also locks the brake system in the prevailing position without any power consumption in steady-state braking phases. A reset device is also integrated into the actuator (12b,14b,16b,18b) of each wheel (controlled via i_1R, i_2R, i_3R, i_4R), which would cause a safety disconnect of the respective wheel in the event of any type of fault that could prevent one wheel's brake from being released. To be able to handle these types of faults in the failure of a power diagnostic unit (20), the reset device is controlled by the next wheel unit on the same axle (e.g., from 18afor 12b). With the diagonal division of the power circuits considered here, the two wheel units of one axle always receive power from different power sources. Therefore, in the event of a failure in one power source in any state, at least the respective actuator will be released by the reset device.

[0026] The power diagnostic module (20) determines the charge state of the power supply units and relays this information (c₁, c₂) to the pedal module (10).

[0027] A detailed description of the functions and structure of the system components of the electromechanical brake system is given in the following sections with reference to FIGS. 2 through 5.

[0028] FIG. 2 shows the basic design of the pedal module (10).

[0029] The object of these system components is to detect the driver's braking intention, specifically with regard to the operating brake and the parking brake, and to form the required reference input variables for the front and rear axle wheels; to detect and analyze the status messages of all the system components of the electromechanical brake system; to analyze the prevailing overall state of the brake system, optionally initiating release measures and signaling the fault state to the driver and/or storing it in the error memory; to initialize all components of the brake system after turning on the ignition or operating the brake when the ignition is turned off; to turn off the brake system after a road trip is concluded; and to control the brake light.

[0030] The driver's intention regarding the operating brake is detected by independent sensors b₁, b₂and b₃, which preferably detect the analog intention of the driver (brake pedal angle and/or the force of operation) on the brake pedal in various implementations. The sensors receive power from different power supplies E₁and/or E₂, e.g., sensors b₁and b₂receive power from power supply E₁, and sensors b₂and b₃receive power from power supply E₂. The driver's intention regarding operation of the parking brake is detected by sensors b₄and b₅(likewise by detecting the deflection of the parking brake lever, for example), which receive power from the different power supplies. Each analog sensor for detecting the driver's intention regarding the operating brake as well as one for the parking brake can also be replaced by a binary sensor.

[0031] Pedal module (10) itself is designed to be fault-tolerant, e.g., by implementation in the form of a redundant microcomputer system with microcomputers P₁and P₂, also containing the required peripheral, memory, and watchdog modules plus a monitoring component P₃. Microcomputers P₁and P₂and monitoring component P₃communicate via internal communication channel C, which is implemented by a serial bus system or serial interfaces, for example. Independent programs Pr1 and Pr2 are implemented within microcomputer systems P₁and P₂. Sensor signals b₁through b₅are detected and stored by computer program Pr1 via input interface U₁and made available to microcomputer P₂via communication channel C. In a similar marmer, sensor signals b₁through b₅are detected and stored by computer program Pr2 via input interface U₂and transmitted to microcomputer P₁. Thus, six measured values representing the driver's intention regarding operation of the operating brake and four measured values representing the driver's intention regarding operation of the parking brake are available in both computers.

[0032] A representative signal value b_B,repfor the driver's intention regarding the operating brake is determined from the measured values for operation of the operating brake by majority selection in each microcomputer P₁and P₂. This is done by weighting possible individual faults, and by not including individual measured values that exceed the others by a certain amount to form the reference values. Reference values calculated in microcomputers P₁and P₂are designated as b_B,rep,1and b_B,rep,2. If reference value b_B,rep,1exceeds a predetermined limit, the brake light is controlled by signal U_BL.

[0033] Representative signal values are also calculated in both microcomputers P₁and P₂from the measured values representing the driver's intention regarding operation of the parking brake. The representative signal values determined in microcomputers P₁and P₂are designated as b_F,rep,1and b_F,rep,2. These representative signal values are the maximum values of measured sensor signals b₄and b₅when the passenger vehicle is standing still (determined by analyzing one or more wheel speed signals), and when the vehicle is moving (i.e., not at standstill), they are the minimum values of these two sensor signals.

[0034] The reference input variable for the desired average brake application force or the desired average braking torque of a wheel when braking with the operating brake is calculated from reference values b_B,rep,1and b_B,rep,2both microcomputers using a stored pedal characteristic. This reference input variable is designated as F_B,res,1in microcomputer P₁and as F_B,res,2in microcomputer P₂.

[0035] The driver's intention regarding the average brake application force or the average braking torque of a wheel when operating the parking brake is also determined from sensor signals b_F,rep,1and b_F,rep,2in microcomputers P₁and P₂using a stored predetermined characteristic. This reference input variable is designated as F_F,res,1in microcomputer P₁and as F_F,res,2in microcomputer P₂.

[0036] The reference input variables calculated in a microcomputer for the driver's intention regarding the operating brake and the parking brake are made available to the other microcomputer via internal communication channel C. In both microcomputers, F_B,res,1is compared with F_B,res,2and F_F,res,1with F_F,res,2. If the comparison values in each pair match within a predetermined tolerance limit, a resulting variable is formed for the driver's intention regarding the operating brake F_B,resby arithmetic averaging of variables F_B,res,1and F_B,res2, and the resulting variable for the driver's intention regarding the parking brake F_F,resis formed by arithmetic averaging of variables F_F,res,1and F_F,res,2.

[0037] If the comparison values do not match, the fault-free signal values for the driver's intention regarding the operating brake as well as the parking brake are detected unambiguously by monitoring component P₃on the basis of the computer monitoring described below. In both microcomputers P₁and P₂, the fault-free signal values are assigned to variables F_B,resand F_F,res.

[0038] The resulting average brake application force F_resof a wheel is obtained from signals F_B,resand F_F,resaccording to the equation F_res=maximum(F_B,res, F_F,res). In an alternative embodiment, F_rescould also correspond to the resulting average braking torque of a wheel which is required due to operation of the operating brake or parking brake. The desired brake application forces and braking torques F_Vfor the wheels of the front axle and F_Hfor the wheels of the rear axle are calculated from F_resin the sense of a suitable division.

[0039] The pedal module transmits the setpoints for the brake application forces and braking torques F_Vand F_Hvia communication systems K₁and K₂to the connected components of the electromechanical brake system.

[0040] Faults that would lead to unintentional braking or an incorrect reference input variable for the wheel brake application force and wheel braking torque are detected by different detections and calculations. Corrupted memory contents, which would lead to an identical error effect, are also detected. Monitoring component P₃communicates with microcomputers P₁and P₂by way of internal bus system C. This component serves to monitor the program sequences in programs Pr1 and Pr2 and also to check the computing capability of microcomputers P₁and P₂. To guarantee reliability in the event of a computer error in P₁or P₂, programs Pr1 and Pr2 must nevertheless run properly in this error case, or the fact that the program is not running properly must be detected reliably. If a program is not running properly, the respective computer channel is disconnected, and the error is signaled by signals d_P1and d_P2. In the embodiment shown here, functionality is monitored by a query/response communication. Microcomputers P₁and P₂retrieve a query from the monitoring component and answer it, taking into account all safety-relevant program parts within a predetermined interval of time. The queries are to be preset so that a correct response is given only with error-free functioning of these program parts, in particular the computer function test (RAM test, ROM test, etc.) and the command status check (with regard to addition, subtraction, etc.). The partial responses formed from the subprograms are combined to form an overall response in each microcomputer. In the monitoring component, the overall responses supplied by microcomputers P₁and P₂are checked with regard to the interval of occurrence and bit-accurate correspondence to the correct response for the query and optional error control strategies such as signaling and channel disconnection are initiated. The functionality of the monitoring component is tested by microcomputers P₁and P₂using suitable test questions. These test questions can be answered correctly by the monitoring component only if the function is completely correct.

[0041] Furthermore, internal error states and error signal messages d₁, d₂, d₃and d₄of the connected the connected wheel units and error message d_Vof the processing unit are detected in the pedal module and stored in an error memory. Furthermore, status signals c₁and c₂of the power diagnostic unit are detected. This detection takes place during a test phase before the start of a journey and also in all operating phases of a journey. All the errors and status signals are analyzed in the pedal module by using predetermined tables in which an action to be carried out is stored for each type of error and each status. As a result of this analysis, messages for release strategies in the various components of the brake system are initiated in the travel phase in accordance with the risk potential of the error states and are transmitted to the processing unit and the wheel units by signals r₁, r₂, r₃, r₄and r_V. Safety-relevant faults are signaled to the driver by error signals d_P1and d_P2. The driver is also signaled when error states are detected in the test phase before starting a journey. With safety-critical errors, initialization of the brake system is terminated and release of the parking brake is prevented. When safety-critical operating states occur during a journey, intervention in the engine management can be implemented to reduce the available driving torque.

[0042] The other components of the electromechanical brake system are initialized by the pedal module using signal lines z₁and z₂after turning on the ignition or even when operating the brakes when the ignition is turned off. Furthermore, the system components are turned off by these signals in a controlled manner at the end of the journey.

[0043] Access to the brake system and a readout of the error memory for the overall system are made possible for service personnel via service interface d_s.

[0044] The power diagnostic unit (20) is responsible for monitoring the power supply units (batteries) with regard to adequate capacity for the power required for the braking operations. Therefore, at least the power required for the minimum braking effect stipulated by law must be guaranteed. Monitoring is performed by suitable sensors L₁and L₂, e.g., for measuring the charging current and the load current, and a mathematical model. This model takes into account the electrochemical and physical properties as well as the history, e.g., the number of exhaustive discharges, of the power supply units. The power diagnostic unit (20) is preferably implemented in the form of a redundant microcomputer system which receives power from both power sources and whose subsystems can exchange data via an internal bus system.

[0045] The higher-level functions of the brake system are implemented in the processing unit (22). These include in particular the calculations of reference input variables F₁, F₂, F₃and F₄for the brake application forces and braking torques of each individual wheel. The calculations are performed by including known principles such as taking into account the wheel-specific rotational speeds in full braking in the sense of an anti-skid system, taking into account a drive slip control function, implementing drive dynamics control to prevent overspeed states by including additional sensors, e.g., for steering wheel angle δ_L, transverse acceleration a_yand yaw angle velocity ψ, taking into account the thickness of the brake lining for each individual wheel in partial braking with the goal of achieving uniform brake lining wear, implementation of a hill-holder function, taking into account the load state to achieve an optimum distribution of braking force to the wheels of the front and rear axles, achieving an adaptive braking force distribution between the wheel on the inside of the curve and the wheel on the outside of the curve on one axle as a function of the measured steering angle to achieve improved drive dynamics, correcting the individual braking forces in the event of failure of one wheel unit, controlled interventions in the engine management with a braking intention via communication system K₃and intervening in the engine management in the case of a safety-critical fault in the brake system. In addition, the measured actual values of controlled variables F_1i, F_2i, F_3iand F_4iare also available to the processing unit for calculation of reference input variables F₁through F₄for each individual wheel. In addition, reference variables regarding drive dynamics can optionally be determined to support the monitoring functions within the wheel units. Details are explained in the description of the functions of the wheel unit.

[0046] The processing unit (22) according to FIG. 3 has a redundant design due to two microcomputer systems R_V1and R_V2which exchange calculated data via an internal communication channel C1. Via the two communication systems K₁and K₂, the processing unit (22) receives the individual rotational speeds (n₁through n₄) for each wheel as well as the actual values of the brake application force and the braking torque (F_1ithrough F_4i) from the wheel units (12 through 18), and from the pedal unit (10) it receives the reference input variables for the brake application force and the braking torque for the wheels of the front axle F_Vand for the wheels of the rear axle F_H.

[0047] In the event of a failure of one computer channel in the pedal unit (10), the data transport via the connected communication system is interrupted. With this error constellation, the processing unit (22) relays reference input variables F_Vand F_Has well as messages (r₁through r₄) for the individual axles received from the other computer channel of the pedal module (10) for the release strategies to the connected wheel units (12 through 18). In addition, with this error, the diagnostic messages (d₁through d₄) of the wheel units can be relayed to the functional computer channel of the pedal module. The failure of microcomputer P₂in the pedal module (10) will be considered as an example. In this error case, the messages from the pedal module (10) can be relayed to wheel modules 2 and 4 via communication system K₁and the processing unit. The diagnostic messages from wheel modules 2 and 4 take the opposite route. In addition, to calculate the reference input variables for the individual wheels as needed for a drive dynamics control function, the required parameters (steering angle, transverse acceleration and rotational rate) are determined in the processing unit (22).

[0048] The above-mentioned calculations are performed independently in the two computer systems R_V1and R_V2and then compared. If the results are inconsistent, the processing unit is shut down and an error status message d_Vis sent via the communication system.

[0049] Control of the brake application forces and braking torques for each individual wheel is implemented within the wheel units (12 through 18). Communication systems K₁and K₂supply the reference input variables for this purpose.

[0050] The wheel units (12 through 18) receive power from different electrical power sources, namely wheel units 12 and 14 from power source E₁and wheel units 16 and 18 from power source E₂. The connection of the wheel units (12 through 18) to the other system modules is also implemented with different communication systems. Wheel units 12 and 14 communicate via K₁, and wheel units 16 and 18 communicate via K₂.

[0051] Wheel unit 12 according to FIG. 4 is considered below. The other wheel units are designed accordingly. Wheel unit 12 serves to regulate the brake application force or the braking torque of a wheel and to initiate a retraction strategy when there is a disturbance in actuator 18bof wheel unit 18. Wheel unit 12 communicates with the other system components via communication system K₁. The wheel unit receives the following variables via this system:

[0052] F₁: Reference input variable for each individual wheel for regulating the brake application force or the braking torque of the wheel. This variable is supplied at the time of an ABS, ASR or FDR (drive dynamics control) intervention by the processing unit (22). This reference input variable could also be calculated specifically by the processing unit (22) for the following functions in another embodiment:

[0053] a) to achieve uniform wear on all brake linings of a vehicle;

[0054] b) to adapt the distribution of the driver's intention regarding the total brake torque among the wheels of the front and rear axles as a function of the instantaneous axial load distribution;

[0055] b) to achieve an adaptive braking force distribution between the wheel on the inside of the curve and the wheel on the outside of the curve on one axle as a function of the measured steering angle to achieve improved drive dynamics.

[0056] F_v: Substitute reference input variable for the front axle for the brake application force or the braking torque of a wheel of the front axle. (For the wheel units assigned to the rear axle, substitute reference input variable F_His used accordingly). Reference input variable F_Vis formed from the driver's intention regarding the operating brake and the parking brake and supplied to the two wheel units of the front axle and to the processing unit. The axle-specific reference input variable is used within a wheel unit to regulate the brake application force or the braking torque if no different reference input variable for each individual wheel has been formed in the processing unit or in the event of failure of the processing unit.

[0057] r₁: Control message to initiate a revised processing sequence in the wheel unit. This message is formed by the pedal unit or the processing unit from the incoming error signal messages from the connected system modules.

[0058] The signals arriving via the communication system are stored redundantly in memory cells S_iof microcomputer system R_1A. In other embodiments, the following signals arriving via communication systems K₁can also be processed for monitoring the function of the wheel unit:

[0059] a_R2, a_R3, a_R4delays in the other wheels

[0060] a_V,refreference value of the delay difference between the wheels on the front axle

[0061] S_R2, S_R3, S_R4slip of the other wheels

[0062] ΔS_V,refreference value for the slip difference between the wheels on the front axle

[0063] V_Festimated vehicle speed

[0064] The following signals are sent via communication system K₁as output variables of the wheel unit to the connected system modules:

[0065] n₁processed rpm signal of the respective wheel

[0066] d₁cyclic error signal message of the wheel unit

[0067] F_1imeasured actual value of the controlled variable

[0068] In other embodiments, the following variables are also needed by wheel unit 12 for function monitoring in the other wheel units:

[0069] a_R1delay of the respective wheel

[0070] S_R1slip of the respective wheel

[0071] These signals are supplied to the other system modules via communication system K₁:

[0072] Wheel unit 12 has the following components:

[0073] a) Microcomputer system R_1Awith the respective peripheral, memory and watchdog modules,

[0074] b) Monitoring component R_1B

[0075] c) Electric motor M_1Hincluding the required gear stage for converting the rotational motion into a feed motion of the brake lining of a disk brake or a drum brake

[0076] d) Electromagnetically operated rack-out device Ku₁which acts on a shaft inside the torque flow between the electric motor and the brake lining, said shaft being closed in the currentless state by a spring element, ensuring in this state that the prevailing angular position of the shaft is maintained. The design of this rack-out device must ensure that each controlled brake application force acting on the brake disk must be maintained.

[0077] e) Reset module M_1Rimplemented in the form of an electric motor or electromagnetically operable rack-out device. This module receives power from power source E₂and is driven by wheel unit 18.

[0078] f) Power electronics LE_1Hfor controlling electric motor M_1H

[0079] g) Power electronics LE_1Kfor controlling the electromagnetically operated rack-out device Ku₁

[0080] h) Power electronics LE_2Rfor controlling reset module M_2Rwhich is integrated into wheel unit 18.

[0081] Items c), d) and e) are referred to below as actuator 12bof wheel unit 12.

[0082] The following input signals coming from the respective wheel are sent to microcomputer system R_1Avia peripheral input modules and stored redundantly in memory cells S_i: wheel rpm n₁, the actual value for the wheel brake application force and/or for wheel braking torque F_1i, the brake application path and/or angle of rotation of the gear stage or electric motor S_1Hand optionally the motor current i_1Hof the actuator.

[0083] Within microcomputers R_1Areference input variable F_1Fis selected from variables F₁and F_Vwhich are received cyclically over the communication channel. Control difference x_d1is formed from this by using instantaneously measured value F_1ifor the wheel brake application force or the wheel braking torque according to the equation:

[0084] x_d1(t)=F_1F(t)−F_1i(t)  (1)

[0085] Using predetermined limit values ε and μ and intervals T_ε and T_μ the comparisons can be performed according to

[0086] |x_d1(t)|≦ε for 0<t<T_ε  (2)

[0087] |d x_d1(t)/dt|≦μ for 0<t<T_μ  (3)

[0088] If conditions (2) and (3) are met, no control actions are taken on the actuator. If this condition is not met, the required instantaneous manipulated variable for correcting the wheel brake application force or the wheel braking torque is calculated by using a digital control algorithm and taking into account the manipulated variable output most recently (e.g., of a PI controller or a PID controller). This manipulated variable is output in the form of a PWM signal u_1Hto power electronics LE_1K. In addition, electromagnetically operated rack-out device Ku₁is controlled by control signal f₁and power electronics LE_1K, permitting a rotational motion of the motor to achieve a change in wheel brake application force. If conditions (2) and (3) are met while the brake application force or the wheel braking torque is being corrected, control of electromagnetically operated rack-out device Ku₁is terminated and then electric motor M_1His switched to no current. To avoid an unwanted change in wheel brake application force because of a malfunction of microcomputer system R_1A, control of the electric motor by current i_1His made possible only if release signal g_1Has well as release signal e_1Hfrom monitoring component R_1Bare present at the control part of power electronics LE_1H(see AND link in LE_1H).

[0089] To be able to avoid an unintentional reduction in the wheel brake application force to be maintained by the rack-out device, control of rack-out device Ku₁by current i_1Kis possible only when release signal g_1Hand release signal e_1Hare both supplied by monitoring component R_1B(see AND link in LE_1K). By including the electromagnetic rack-out device in the control process, when the driver's intention is for approximately steady-state braking, the required brake application force can be applied first via the electric motor and then, without consuming electricity, it can be maintained by the spring forces within the electromagnetically operated rack-out device. Thus, the brake application forces required in operating the parking brake of a motor vehicle can be initiated and maintained without power consumption in a simple manner. To release the brake on one wheel, the rack-out device is first opened by control signal f₁and then electric motor M_1His driven at a negative voltage. If this release is prevented by an error in the actuator, e.g., by jamming of the gear stage in the actuator, this fault can be recognized unambiguously by the measured wheel brake application force or wheel braking torque. This is done, for example, by comparing the control and the wheel rpm, optionally the angle of rotation. Jamming is recognized if, for example, no change in angle of rotation of the electric motor is recognized despite the control and/or the respective wheel has brake slip when there is no control. The regulation is then terminated and an error message d₁is sent over the communication system. This message is analyzed in the pedal unit (10) and an error elimination measure is initiated resulting from this. From a release message r₂sent via communication system K₂, wheel unit 18 shown in FIG. 5 receives the message to reset device M_1Rin actuator 12bvia power electronics LE_1Rand control signal i_1R. Since reset device M_1Ris controlled by power source E₂, the brake function of the wheel assigned to wheel unit 12 can be released even when there is a failure in power source E₁.

[0090] Wheel unit 12 reacts similarly to a release message r₁containing information on releasing the wheel assigned to wheel unit 18 which is braked in an error case. This type of message leads to output of signal u_2R, activating power electronics LE_2R. Control signal i_2Rfor the response of the reset device in actuator 18b,however, is activated only if release signals g_2Rand e_2Rare available (see AND link in LE_2R).

[0091] The accuracy of the measured actual value of the wheel brake application force and/or the wheel braking torque can be guaranteed by analytical redundancy. With an implementation of this redundancy according to the present invention, one or more of the following measures can be carried out.

[0092] Comparison of the actual values of the wheel brake application force or the wheel braking torque with a reference variable F_r,a. To determine F_r,a, first the change in position or angle of rotation measured variable s_1Hafter the start braking time is measured and then converted to the physical dimension of a force or a torque by using a function given by the design. This function takes into account all the elasticities of the components arranged within the force flow of the actuator. In the case of wheel braking torque control, a temperature-dependent friction model of the brake disk is also implemented in the function (e.g., modeling the heating and cooling of the disk).

[0093] Comparison of the actual value of the wheel brake application force or wheel braking torque within reference variable F_r,b. To determine F_r,b, the current of electric motor M_1His measured during a steady-state braking phase and then converted to the physical dimension of a force or a torque by using a previously determined function. This function first takes into account the design data of the electric motor and the gearing, optionally also taking into account a temperature and friction model. Furthermore, the instantaneous effective input voltage as well as the direction of rotation before reaching the steady-state operating point are taken into account. In the case of wheel braking torque control, a temperature-dependent friction model of the brake disk can also be implemented in the function.

[0094] Another method is based on a comparative analysis of wheel delay in the partial braking range. Calculation of wheel delay in individual wheel units is started by a message from the processing unit at time T_x. The delay of the wheel assigned to wheel unit 12 is calculated according to the equation:

[0095] a_R1(T_x)−C₁[n(T_x)−n(T_x−T_a)]  (4)

[0096] where T_ais the cyclic sampling time at which the rpm determination is performed on each wheel unit, and C₁is a constant fixed by wheel geometry and sampling time.

[0097] Delay difference Δa_v(T_x) of the front axle wheels is formed from the delay values a_R1(T_x) and a_R2(T_x) for the wheels of front axle:

[0098] Δa_v(T_x)=a_R1(T_x)−a_R2(T_x)  (5)

[0099] Value a_r2(T_x) required for this is sent from wheel unit 18 via communication system K₁. With proper functioning of the brake application force or braking torque control, the following applies for delay difference Δa_v(T_x)

[0100] |Δa_v(T_x)−Δa_v,ref(T_x)|<ε_a  (6)

[0101] where Δa_v,refis a reference value for the delay difference of the wheels on the front axle. ε_adescribes an error limit value that can be parameterized. Reference value Δa_v,refis calculated in the processing unit by a mathematical model using the cyclically detected measurement variables pertaining to drive dynamics, namely steering wheel angle δ_L, transverse acceleration a_yand yaw angle velocity Ψ and taking into account an estimated vehicle speed v_F. If condition (6) is violated, this indicates a fault in the brake application force sensor or the braking torque sensor of one of the wheels. Using both wheels of an axle for fault detection eliminates disturbing influences acting on both wheels. In this method it is assumed that the functionality of the control algorithm and the manipulated variable output as well as fault-free detection of rpm on both wheels of the front axle are ensured by other monitoring methods. A detected fault is allocated to wheel unit 12 or wheel unit 18 by including both wheel delay values a_R3(T_x) and a_R4(T_x) for the rear axle (e.g., by comparing the individual variable with the corresponding variable of a rear wheel).

[0102] Another method is based on a comparative analysis of individual wheel slip values in the partial braking range. Calculation of slip in individual wheel units (12 through 18) is started by a message from the processing unit at time T_x. Within wheel unit 12, the slip of the respective wheel with wheel rpm n₁and estimated vehicle velocity v_Fis calculated by the equation:

[0103] S_R1(T_x)=1−C₂n₁(T_x)/v_F(T_x)  (7)

[0104] Constant C₂is determined by wheel geometry. Slip difference Δs_vbetween the wheels on the front axle can be calculated by the following equation by using wheel slip s_R2(T_x), which is sent from wheel unit 18 via the communication system:

[0105] Δs_V(T_x)=s_R1(T_x)−s_R2(T_x)  (8)

[0106] The following must apply for slip difference Δs_v(T_x) with correct functioning of the brake application force and braking torque control:

[0107] |Δs_V(T_x)−Δs_V,ref(T_x)|_s<ε_s  (9)

[0108] where Δs_v,refis a reference value for the slip difference of the wheels on the front axle, ε_sdescribes an error limit value that can be parameterized. Reference value Δs_v,refis calculated in the processing unit by a mathematical model of drive dynamics using cyclically detected measured variables, namely steering wheel angle δ_L, transverse acceleration a_yand yaw angle velocity Ψ and taking into account the reference input variables for brake application forces and/or wheel braking torques for each individual wheel:

[0109] Δs_V,ref(T_x)=f₁{δ_L, a_yΨ, F₁, F₂, F₃, F₄}  (10)

[0110] In another embodiment, an improved reference variable Δs_v,refcan be determined by taking into account measured values and estimates for wheel loads F_N1, F_N2, F_N3and F_N4. In addition, Δs_v,refis formed in the processing unit by using an expanded dynamic model. In this way, influences caused by wheel load displacement are taken into account in the calculation. If condition (9) is violated, a fault in the brake application force sensor or braking torque sensor of one of the wheels can be deduced. It is assumed that the functionality of the control functions as well as fault-free detection of rpm on both front axle wheels can be guaranteed by other monitoring methods. A recognized fault is allocated to wheel unit 1 or wheel unit 2 by including both slip values s_R3(T_x) and s_R4(T_x) for the wheels on the rear axle (e.g., by comparing the individual variable with the corresponding variable of a rear wheel).

[0111] The monitoring concept of the wheel module is structured with four logic levels L₁, L₂, L₃and L₄and two hardware levels. Microcomputer system R_1Aand monitoring component R_1Bwork on the hardware levels.

[0112] Monitoring component R_1Bcommunicates with microcomputer system R_1Avia an internal bus system. This component serves to check the computational ability of this microcomputer system and to monitor the program sequences inside the computer. Mutual monitoring of these components is made possible by the selected type of data communication between microcomputer system R_1Aand monitoring component R_1B. The following functions are assigned to the logic levels:

[0113] A level 1 is implemented in microcomputer system R_1A. It carries out the following functions: calculating the control function for controlling electric motor M_1H; controlling electromagnetically operated rack-out device Ku₁; controlling reset module M_2R; performing calculations to check the accuracy of the measured actual value of the wheel brake application force or wheel braking torque F_1ithrough the analytical redundancy described here.

[0114] A level 2 is also tied into microcomputer R_1A. This level is responsible for checking the accuracy of calculations performed in level 1 by using algorithms different from those in level 1. Furthermore, input data stored redundantly in memory cells S_iis used to perform the calculations, thus permitting detection of errors due to corrupted memory contents. The regulator function is checked by a parallel-connected mathematical model of the regulator, which is calculated with redundantly stored data for alternative reference input variables F₁and F_vand actual value F_1iof the wheel brake application force or wheel braking torque. If there are significant deviations between the model output variable and the calculations performed in level 1, an error status is detected. Furthermore, proper functioning of the controlled system is also checked in level 2. This is done with a mathematical model of the controlled system, describing the dynamic relationship between the manipulated variable and controlled variable F_1ieven taking into account disturbance variables. The manipulated variable calculated in the control algorithm in level 1 is sent to this model. An error state is recognized if there are significant deviations between the model output variable and measured actual value F_1iof the wheel brake application force or wheel braking torque. Control signals f₁for the electromagnetically operated rack-out device or u_2Rfor the reset module are also checked for accuracy in level 2 and error states are optionally detected. The models used are derived from the physical relationships.

[0115] When an error is detected in level 3 as well as level 2, respective release signals g_1Rand g_2Rare reset, and an error message d₁is sent via communication system K₁.

[0116] Level 3 is implemented in microcomputer R_1A. To guarantee reliable functioning of the wheel unit in the case of a computer error or program error, the programs in levels 1 and 2 must nevertheless run properly even in the event of an error, or the fact that they are not running properly must be detected reliably. In the embodiment presented here, this is monitored by a query/response communication in levels 3 and 4. Microcomputer system R_1Aretrieves a query from the monitoring computer and answers it, taking into account all safety-relevant program parts within a predetermined interval of time. A query can be answered correctly only if error-free rung of the programs for the computer function test and the command status check is ensured. Partial responses formed from the partial programs are summarized into an overall response and sent to level 4 in the monitoring component.

[0117] This level is implemented in the monitoring component. The overall response here supplied by microcomputer R_1Ais checked with regard to the interval of time of arrival and bit-accurate matching of the proper response for that query. If the query-response communication with level 3 does not run properly, release signals e_1Hand e_2Rare stopped in monitoring component R_1B.

[0118] In another embodiment (variant 2), the functions of two wheel units of one axle or one diagonal are integrated into a wheel pair unit according to the previous descriptions.

[0119] In variants 1 and 2 of the electromechanical brake system, two wheels are always no longer ready for braking in the event of failure of one power supply or one of the communication systems K₁or K₂. This disadvantage is avoided in embodiment 3. FIG. 7 shows the structure of this variant and FIG. 8 shows its wheel unit. This variant differs from variant 1 presented above in particular in that the wheel modules of the front wheels are each connected to the other system modules by redundant communication systems K₁and K₂and the wheel modules of the front wheels receive power from both power sources.

[0120] The functions described here are implemented by suitable programs running in suitable computers.

[0121] In addition to the use with electromechanical brake systems, the procedure described here can also be used with similar advantages with other electric brake systems, e.g., with electrohydraulic or electropneumatic brake systems.

[0122] Addendum: List of Notation

[0123] a_R1, a_R2, a_R3, a_R4wheel delay

[0124] a_V,ref, a_H,refreference value for the delay difference between wheels on the front axle and between those on the rear axle

[0125] a_ytransverse acceleration

[0126] b₁, b₂, b₃measurement signals indicating the driver's intention (e.g., brake pedal angle)

[0127] b₄, b₅measurement signals indicating the driver's intention regarding the parking brake

[0128] b_B,rep,1, b_B,rep,2reference values indicating the driver's intention regarding the operating brake

[0129] b_F,rep,1, b_F,rep,2reference values indicating the driver's intention regarding the parking brake

[0130] C internal communication system

[0131] c₁, c₂diagnostic signals indicating the charge state of the power supply systems

[0132] d control signal of a diagnostic unit

[0133] d_P1, d_P2status messages regarding the state of the electromechanical brake system

[0134] d_Sservice interface in the pedal module

[0135] d_Verror signals of the processing unit

[0136] d₁, d₂, d₃, d₄error messages of the wheel units

[0137] E₁, E₂power supply

[0138] e_1H, e_2H, e_3H, e_4Hlogic control signal for the power electronics of a wheel unit

[0139] e_1R, e_2R, e_3R, e_4Rlogic control signal for the power electronics of the reset device of a wheel unit

[0140] F_B,res,1, F_B,res,2reference input variable for the total force of the operating brake

[0141] F_resreference input variable for the driver's intention regarding the braking force

[0142] F_Hreference input variable for the brake application force (or wheel braking torque) for wheels on the rear axle

[0143] F_Freference input variable for the parking brake force

[0144] F_F,res,1, F_F,res,2reference input variable for the total force of the parking brake

[0145] F_Hreference input variable for the brake application force (or the wheel braking torque) for the wheels on the rear axle

[0146] F₁, F₂, F₃, F₄reference input variable for the wheel braking force or wheel braking torque for each individual wheel

[0147] F_1F, F_2F, F_3F, F_4Fselected reference input variable for the wheel braking force or wheel braking torque for each individual wheel

[0148] F_1i, F_2i, F_3i, F_4iactual value for wheel braking force or wheel braking torque

[0149] f₁, f₂, f₃, f₄control signal for electromagnetic coupling in a wheel unit

[0150] g_1H, g_2H, g_3H, g_4Hlogic control signal for the power electronics in a wheel unit

[0151] g_1R, g_2R, g_3R, g_4Rlogic control signal for the power electronics of the reset device in a wheel unit

[0152] i_1K, i_2K, i_3K, i_4Kcurrent for controlling an electromagnetic rack-out device in a wheel unit

[0153] i_1H, i_2H, i_3H, i_4Hcurrent for controlling the electric motor in a wheel unit

[0154] i_1R, i_2R, i_3R, i_4Rcurrent for controlling the reset device in a wheel unit

[0155] K₁, K₂, K₃communication devices

[0156] LE_1H, LE_2H, LE_3H, LE_4Hpower electronics for controlling the electric motor

[0157] LE_1K, LE_2K, LE_3K, LE_4Kpower electronics for controlling the electromagnetically operated rack-out device

[0158] LE_1R, LE_2R, LE_3R, LE_4Rpower electronics for controlling the reset device

[0159] L₁, L₂Sensor for determining the charge state of a power supply

[0160] n₁, n₂, n₃, n₄measured values for wheel rpm

[0161] P₁, P₂microcomputers in the pedal module

[0162] P₃monitoring component in the pedal module

[0163] r₁, r₂, r₃, r₄control signals for initiating a change in processing sequence in the wheel units

[0164] s_H1, s_H2, s_H3, s_H4brake application path of the brake disk or brake drum or angle of rotation of the electric motor or the gear stage

[0165] s_R1, s_R2, s_R2, s_R4wheel slip

[0166] S₁through S_nmemory cells in the wheel modules

[0167] U₁, U₂input interfaces of the pedal unit

[0168] u_BLcontrol signal of the brake light

[0169] u_1H, u_2H, u_3H, u_4Hcontrol signal for the power electronics of the electric motor in the wheel unit

[0170] u_1R, u_2R, u_3R, u_4Rcontrol signal for the power electronics of the reset device in the wheel unit

[0171] v_Festimated vehicle speed

[0172] x_d1, x_d2, x_d3, x_d4control difference in a wheel unit

[0173] z₁, z₂signal for initializing and disconnecting the components of the brake system

[0174] δ_Lsteering angle

[0175] ψ yaw angle velocity

[0176] Δs_V,ref, Δs_H,refreference value for the slip difference between the wheels on the front axle and rear axle