Electromechanical brake system

[0002] The present invention generally relates to vehicle brakes and more particularly relates to an electromechanical brake system and a process for controlling an electromechanical brake system.

[0003] The investigation of electrical brake systems is part of the development of modern brake technology. The hydraulic cylinder which in present-day systems presses the brake lining against the brake disc is replaced here, at each disc, by a highly efficient electric motor. The electric brake does not need any mechanical or hydraulic parts, as a vacuum brake power booster or a tandem master cylinder does. Moreover, the electric brake can take over other functions currently handled by a brake, and future ones as well, such as those of an anti-blocking system (ABS), a traction aid or anti-slip regulator (ASR), an electronic stability program (ESP), or an automatic intervention by the brakes such as can be provided for in distance-control systems.

[0004] One example for such a system is shown in WO 95/13946. This so-called electronic brake system displays a central module and another module allocated to the brake circuits or wheel component groups. The central module in this case can carry out ABS and ASR calculations, adjust the distribution of the braking force, and calculate the required brake pressure specifically for each wheel.

[0005] A micro-processor system is known from DE 195 29 434 A1 (P7959) in which two synchronized central units receive the same input information and handle it with the same programs on one or a number of chips. The two central units are connected via separate bus systems to the fixed-value and the write-read memories, and also to input and output units.

[0006] The bus systems are connected to one another by driver levels and bypasses which make it possible for the two central units jointly to read and process the data made available to them, including check-data and commands. This system makes it possible to save memory space. Only one of the two central units is connected to a full-scale fixed-value and a write-read memory, whilst the memory capacity of the second processor is limited to memory space for check-data, but access to all data is possible via the bypasses, so this means that both central units are each able to process the complete program.

[0007] In patent applications DE 197 16 197 A1 (P9009) and DE 197 20 618 A1 (P9018), micro-processor systems are described for regulating those aspects that are critical to safety and are equipped to process the one program with at least three central units, if possible all arranged on one chip. There are also fixed-value memories and write-read memories with additional memory spaces for check-data, input and output units, and comparison units which check the output signals from the central units to ensure that they tally. The central units are connected to one another via bus systems which make it possible for the central units to read and process the incoming data jointly, including the check-data and commands, on the basis of the same program.

[0008] The central units in this already familiar system are enlarged to make two complete control signal circuits and wired up in such a way that, if one fails, a majority decision enables the defective central unit to be recognized and an emergency function to be maintained.

[0009] Finally, a wiring arrangement is known from DE 197 17 686 A1 which is likewise suitable for a safety-critical control system and is constructed as two or more circuits, with each circuit containing a complete micro-processor system which processes the incoming data redundantly and supplies a fault-recognition signal if a fault or a deviation occurs between the data-processing results obtained redundantly. If a fault is recognized, the system switches over to an emergency function in which either the circuit is switch off or the actuators are handled by both the circuits of the intact micro-processor system. The two systems are provided with their own periphery, consisting of signal registration, actuator operation, and energy supply (7,8).

[0010] DE 195 10 525 A1 discloses a process for controlling or regulating the brake system of a motor vehicle in which a brake pedal actuation by the driver is registered by at least two measuring devices for two different values and by which the braking request of the driver is determined by means of the registered signals and changed into required values for wheel brakes and which controls or regulates the wheel brakes whereby the braking request of the driver is formed by at least two values independently from one another and is then further processed.

[0011] In the present invention, the basic objective is to create an electromechanical brake system and a procedure for controlling an electromechanical brake system, especially for motor vehicles, which is reliable but also inexpensive in construction and needs only limited expenditure of time and money in its installation.

[0012] The invention is based on the idea that, when a wiring arrangement of the type described above is used that is suitable for safety-critical regulation systems, designed with in-built redundancy, and capable of running in emergency mode, the operating safety required for a brake-by-wire system can also be guaranteed. It is possible to do without redundancy in the computer module that serves to control the individual wheel modules. Redundancy can then also be dispensed with for the bus systems that connect the control circuit(s) with the wheel modules. The state of the wheel module is monitored with at least one signal that provides information on the wheel rotation behavior, and in the event of a fault the wheel module can be transferred to the safe state via a switch-off path.

[0013] In this invention, an electromechanical brake system, especially for motor vehicles, can contain a pedal simulator for redundantly registering when the driver uses the brake pedal by means of a suitable sensor system. Also, a central module can be provided which calculates the desired braking value on the basis of output signals. In addition to this, at least one brake module can be provided to control at least one wheel brake, with the control being based on the desired braking value. In addition to this, a data transfer unit is provided which creates a data link between the central module and the brake module in which the central module can display a fault-recognition circuit capable of discovering a fault in the calculation of the desired braking value.

[0014] An important point is that the central module must be capable of running in emergency mode and can thus make a vital contribution to the required high level of operating safety of the system.

[0015] The central module can take higher functions into account in calculating the desired braking value, and can also display at least three redundant computers which calculate the desired braking value on the basis of the output signals from the sensor system. Higher functions of the brake system such as ABS, ASR, and ESP can also be implemented on at least two of these redundant computers in the central module.

[0016] According to this invention, the wheel brake modules and the wheel brakes can both function as individual systems with a simple interface and offer a low-costs total system. This applies particularly if the central module is integrated into the pedal simulator. Moreover, with the system architecture of this invention it is possible, without suffering any additional disadvantage such as increased cabling or reduced freedom from interference, to install a double or TT circuit division. The installation cost for the car manufacturer is minimal and the cabling cost only very slight. In addition to this, clear and simple interfaces are provided in the central module and the wheel modules to make the whole system easy to test and to reduce the complexity of communications between the individual modules. With short analog wiring and a highly efficient amplifier, fitted close to the actuator, a high level of active and passive suppression can be achieved. This invention also enables a very low level of “degradation”—loss of function—to be achieved in the event of a fault, and sensors make it impossible for safety-critical tension to affect one brake, whether the driver intends to brake or not, as a result of a fault in any one computer, the functional electronics, or the actuator.

[0017] FIG. 1 shows a schematic block wiring diagram corresponding to a preferred embodiment of this invention.

[0018] The illustration shows a pedal simulator 1 with a schematically indicated brake pedal 2. The brake pedal 2, or alternatively the movement of brake pedal 2, can for instance be registered by a sensor system 3, which displays at least three sensors, such as two travel and one force sensor. The output signals from this sensor system 3 can be analog, but it is also conceivable that the sensor system could issue some or all digital signals, or other signals, or other dimensions.

[0019] Each of these output signals is sent to a central module 6, e.g. via separate circuits, and picked up there in separate measurement channels. These measurement channels can display analog/digital converters (not shown in the figure), which convert analog into digital signals.

[0020] However, it is also conceivable that the redundant signals from the pedal simulator 1 are simply transferred to the central module 6 and there each divided into at least two measurement channels. If, for instance, three pedal sensors are used, it is advantageous to lead the signals onto three separate measurement channels or three separate display analog/digital converters (assuming the pedal sensors issue analog sensors), in which case at least two of the computers 11, 12, 13 in the central module 6 will receive the converted data. As a result, these two computers in the central module 6 will receive identical input data.

[0021] It should be noted at this point that the data transmitted by pedal simulator 1 can be faulty. The data consolidation, meaning the recognition of defective sensors or hardware, including the amplified or the A/D converter, and the calculation of the desired braking value, is done in central module 6.

[0022] A data bus 5 is also provided which connects the central module 6 to two each of the brake modules 7, in which case brake module 7 contains one pair of actuators and one pair of wheels 8,9. Each of these pairs 8,9 is then allocated to a vehicle wheel (VR=front right, VL=front left, HR=rear right, and HL=rear left).

[0023] The following paragraphs now give a functional description by way of an example of the system architecture of the kind shown in the diagram.

[0024] In summary, the invention involve architecture redundancy and safety concepts for electromechanical brake systems (brake-by-wire). This brake system contains the pedal simulator 1 with the redundant sensor system 3, a triple-redundant central module 6, and four wheel brake modules 7. The wheel brake modules 7 consist of a computer 11 (R1, R2, R3, R4), an electronic system, an actuator 8, actuator-specific sensors, and one allocated wheel 9. The central module 6 and the wheel modules 7 are connected with at least one data bus 5. The central module 6 is integrated into a housing 10 in the pedal simulator 1.

[0025] The driver's decision to brake is communicated by pedal simulator 1, for instance via the sensors described above, in which case the sensors are preferably designed to be redundant and dissimilar, for instance to detect pedal travel or the force exerted by the foot. As has already been described, only these sensor signals can be transmitted, singly or double, to the central module 6. The signals are distributed in this case to at least two measurement channels, so that redundancy can be achieved here as well.

[0026] The central module 6 can initially be provided in such a way that all the functions (the basic braking function, monitoring the pedal simulator 1, and the higher braking functions) are the same in all the computers 11, 12, 13 of the central module 6 (this embodiment is not illustrated in the figure). The results obtained by the three computers are sent via a fault-tolerant voter/monitor structure as a faultless output value.

[0027] This provides a fault-tolerant structure for these functions.

[0028] As is shown in the diagram, a dissimilar sub-division can also be achieved in the central module 6. In this case, the higher functions such as ABS, ASR, and ESP are implemented on only two of the computers, 11, 13. The handling of the basic braking functions and the monitoring of the pedal simulator 1 can be implemented on all three computers, 11, 12, 13. All three computers, 11, 12, 13, have access to at least two separate measurement channels (not illustrated).

[0029] The higher functions are monitored by a comparison unit (not illustrated), and in the event of a fault these functions are switched off in the computers 11, 13, which creates a “fail-silent” function. It should be noted in particular that, if a fault occurs in the handling of the higher functions, it is of course not always necessary to shut down the whole of computers 11, 13; it can be sufficient to deactivate only the part of the program that is affected. The results of the pedal function, i.e. the handling of the basic braking function without any interference from the higher functions, is consolidated and monitored by the voter/monitor 4. In the event of the failure of the higher functions, the desired braking value is issued directly to brake module 7 without any interference from the higher functions.

[0030] If a fault occurs only in the area of the higher functions, there will still be the three computers 11, 12, 13 available for the basic braking function, but if any one of the three computers 11, 12, 13 is defective it can be isolated by the voter/monitor 4 and switched off. The voter 4 would, for instance, select a desired braking value from the three outputs of the computers 11, 12, 13. The monitor would then check to see whether the selected signal deviates from the non-selected signals, by being worse or wrong, and would select a different signal from the selected one if it detects a deviations.

[0031] There is no necessity to switch off two of the computers 11, 12, 13 in the event of a fault. The reliability of the brake system is thus equal to or greater than with the computer structure with the same sub-division, see above. This applies of course in connection with the provision of two power supply sources, Bat1 and Bat2. If three power supply sources are used, a further increase in redundancy could be achieved for the same sub-division (see above). The brake modules 7 consist of a brake module computer 11 (R1, R2, R3, R4) in the electronic system, the actuator 8 with its actuator-specific sensors for such readings as the actuator current, voltage, and position, and a switch-off unit 14 which can be tested and regulates the voltage supply of actuator 8.

[0032] The external switch-off unit 14 ensures that a fault in the electronic system cannot affect the switch-off function.

[0033] Redundancy is not necessary within the wheel module 7 because this is monitored by the central module 6. If the wheel module 7 itself perceives a fault, e.g. through the electronic monitoring of the actuator control unit, an additional actuator control unit can be excluded by the appropriate control of the electronic system in wheel module 7.

[0034] The central module 6 can monitor the state of wheel module 7 via the return-message circuit coming from the wheel module. It is advantageous here to use a bus structure such as CAN.

[0035] Central module 6 can be used for monitoring wheel sensor systems that cannot be influenced by wheel module 7 through faults; for instance, the braking torque can be monitored with the aid of an r.p.m.-transmitter.

[0036] For these reasons, no redundancy is necessary in wheel module 7 in its connections to the wheel module. It is only necessary to have suitable devices available serving the central module 6 to switch off the output path to one or a number of wheel modules.

[0037] The brake module computer on brake module 7 does not need to be designed for fail-safe, because brake module 7 fulfils its specified function or, in the case of a fault, switches off automatically and reports the fault; alternatively, in the case of a computer fault it keeps still (fail-silent). The central module 6 is available as the monitoring level.

[0038] It should also be noted here that each of the brake modules 7 can also be used for two actuator/wheel pairs 8,9 (this would then be a circuit module).

[0039] The data bus 5 is produced at least as a single version, and connected to two wheel modules 7 and to module 6.

[0040] At least two independent sources of energy are necessary, Bat1 and Bat2. In the case of the brake modules 7, they can be sub-divided as shown in the figure, diagonally, or in a front-and-rear layout.

[0041] It can be said in summary that according to the present invention there is no loss of function in the event of a fault, or if there is that it will be very slight. Only in the event of one of the energy supply sources, Bat1 or Bat2, or a short-circuit affecting all the bus circuits to the two wheel modules 7, that two brakes can fail. This would then be a circuit failure. Otherwise, only one of the brake modules 7 would be affected at a time, or at the most the higher functions could fail if there were a failure within central module 6, and even then the basic braking function would still be completely intact. If the sub-division of the functions is the same for all three computers, 11, 12, 13, in the central module 6, the result of a computer fault would be no loss of function at all. In the event of a bus failure, the brakes of the relevant actuator/wheel pair 8, 9 would fail.

[0042] The system architecture is configured in such a way that, for instance, a fault could never result in only the rear wheel brakes being available. The system architecture allows a high brake delay in all fault conditions.

[0043] Also, the system architecture under this invention guarantees that no fault can propagate itself. A fault can be recognized before it has any effect on other functions or modules. Also, there is a high level of electromagnetic compatibility because interference radiation is kept to a minimum. The electronic system for controlling the actuators 8 is integrated into the relevant wheel module 7 and installed on or close to the relevant actuator 8. In addition to this, resistance to interference is also very high, particularly if central module 6 is installed close to or on the pedal simulator, because then the analog signal transmission route is short.

[0044] It should also be noted that the functions, systems, and modules under this invention and described above are covered, all together and in any combination, alone or in their entirety, by this invention.