Fault tolerant electronic braking system

[0002] This invention relates to fault-tolerant electronic braking systems.

[0003] In recent years, automobile manufacturers have sought to replace many expensive mechanical components with electronic components. Future automotive designs contemplate the removal of even more mechanical components, particularly in respect of control linkages to the engine, wheels, etc., replacing them with ‘by-wire’ technology, partially derived from the ‘fly-by-wire’ technology associated with the aircraft industry.

[0004] For example, the hydraulic or mechanical braking system of an automobile may be replaced by a microprocessor controlled system, having a pedal which, upon actuation by the driver, transmits electronic signals to brake actuators located in proximity to the brakes. The brake actuators apply the brakes in dependence upon the electronic signals.

[0005] In safety critical applications, such as the brake system described above, the system must be fault-tolerant, such that if a fault should occur, at least some functionality of the system will continue. Known arrangements to provide fault-tolerance include redundant systems having two or more microprocessors which operate independently of each other and cross-check each other to detect faults.

[0006] A problem with this arrangement is that the larger the number of processors, the more cost is added to the system, and the fewer the number of processors, the greater the chances of all processors in the system developing a fault.

[0007] This invention seeks to provide a fault-tolerant electronic braking system which mitigates the above mentioned disadvantages.

[0008] According to the present invention there is provided a fault-tolerant electronic braking system for a vehicle, comprising: a user operated input arranged to provide a first signal in response to operation thereof; and, at least three braking nodes coupled to the user operated input, each node being arranged to control at least one brake actuator, each node having control means arranged for processing the first signal to provide a second signal for controlling the at least one brake actuator, and to provide a plurality of third signals to the at least two other control means, the third signals being expected second signal results of the at least two other control means; wherein each control means is arranged to compare the second signal with the third signals received from the at least two other control means such that errors detected between the second and third signals indicate faults in the at least three control means.

[0009] Preferably upon detection of a fault, each control means uses a voting scheme to determine which of the second and third signals is to be used as a fourth signal to control each of the brake actuators.

[0010] Each control means is also preferably arranged to transmit the fourth signal to the at least two other control means, in order to verify whether the voting scheme has been used correctly.

[0011] The at least three brake nodes are preferably distributed in mutually remote locations the vehicle. Preferably the first signal is adapted such that it is transmitted to the at least three brake nodes in a synchronous manner.

[0012] The first signal is preferably re-transmitted by each of the control means, for further fault detection. Preferably the at least three brake nodes comprise four brake nodes, each arranged to control one of four brake actuators.

[0013] In this way a fault-tolerant electronic braking system is provided which is cost effective, with improved fault-tolerance and enhanced fault-detection.

[0014] An exemplary embodiment of the invention will now be described with reference to the single FIGURE drawing which shows a preferred embodiment of a fault-tolerant electronic braking system in accordance with the invention.

[0015] Referring to the single FIGURE drawing, there is shown a fault-tolerant electronic braking system 5 for a vehicle (not shown), including first, second, third, and fourth wheel nodes having electronic control units (ECUs) 10, 20, 30 and 40, which are distributed in mutually remote locations of the vehicle. Each of the first, second, third, and fourth ECUs 10, 20, 30 and 40, are coupled to associated first, second, third and fourth brake actuators 15, 25, 34, 45 respectively.

[0016] The first, second, third, and fourth ECUs 10, 20, 30 and 40 respectively are also each coupled to first and second buses 7 and 8 respectively. The brake pedal unit 50 (shown as Pedal) is also connected to the first and second buses 7 and 8 respectively. The first and second buses 7 and 8 respectively are substantially identical and are both arranged to provide synchronous signals according to a Time Division Multiple Access scheme (TDMA) or similar.

[0017] High level functions of current braking systems may be integrated into the system 5 via a (high level) ECU 60 attached to the buses 7 and 8, or by a gateway to an ECU (not shown).

[0018] The brake pedal unit 50 has a transducer (not shown) and is arranged to provide first electronic signals to the first and second buses 7 and 8 respectively in response to a conventional force applied to a brake pedal (not shown) of the unit 50. The brake pedal unit 50 may be arranged to pre-process the signals.

[0019] Each of the first, second, third, and fourth ECUs 10, 20, 30, 40, can operate independently from the other ECUs if required, and are able to provide a processed result signal to the associated brake actuator 15, 25, 35 or 45 in response to the first signals received from the brake pedal unit 50. In this way a basic braking function is achieved, which is the minimum required for safe operation, not necessarily including higher level functions such as vehicle stability management or traction control. The provision of first and second buses 7 and 8 provides fault-tolerance in the case of a problem occurring therein.

[0020] In addition, each of the first, second, third, and fourth 10, 20, 30, 40, ECUs, performs a similar algorithm using the same first signals received from the brake pedal unit 50, and provides the first signals and the result signals to the other ECU's. In this way each of the first, second, third, and fourth ECUs 10, 20, 30, 40, can detect incorrect operation by comparing its received first signals and result signals with those of the other ECUs.

[0021] As four ECUs are available to check data against, it is possible to not only detect that there is a problem somewhere in the system 5, but also to identify the faulty ECU. A faulty ECU can therefore be identified, either by itself, or by the majority of the ECUs in the system 5 via a voting procedure, whereby the ECU having the most different results compared to the other ECUs is considered to be faulty.

[0022] After a fault has been identified, appropriate action can be taken, such as logging the fault, running diagnostics, or resetting or disabling the node. If an ECU is disabled due to a fault, the system 5 can be arranged such that the main braking function will be re-distributed across the operating ECUs.

[0023] As each ECU checks its operation against the other ECUs, faults can be detected that may be undetectable by using a simpler self-test type of checking in isolation. For example, an ECU may exhibit a fault where it decodes the received signals from the brake pedal unit 50 incorrectly, but the decoded value is still within the allowed range. The ECU would pass a self-test, and act on the faulty data if no other tests were performed, but with the described checking against other ECUs, the incorrect data would be detected.

[0024] As each ECU regularly re-transmits their received signals, the system 5 is able to survive faults that would otherwise cause it to be partially disabled.

[0025] For example, if the first ECU 10 cannot access the electronic signals from the brake pedal unit 50 directly due to a communications fault, it can use the electronic signals passed via the second, third or fourth ECUs 20, 30 and 40 respectively.

[0026] An advantage gained from this layout is that identical signals from the brake pedal unit 50 is available to all parts of the system 5 at the same time. This simplifies the error-detection task, as when correctly operating, all ECUs can perform identical operations on identical signals, and any differences indicate a fault.

[0027] It will be appreciated that alternative embodiments to the one described above are possible. For example, a single rear brake ECU could be used to replace the third and fourth ECUs 30 and 40, whereby the single rear brake ECU would be coupled to the third and fourth brake actuators 35 and 45 respectively.