Patent Description:
As background, <CIT>, <CIT>, and <CIT> describe (parking) brake systems which can switch to a type of backup brake in case the main brake fails. Automotive Safety Integrity Level (ASIL) is a risk classification scheme defined by the ISO <NUM> - Functional Safety for Road Vehicles standard. This is an adaptation of the Safety Integrity Level (SIL) used in IEC <NUM> for the automotive industry. This classification helps defining the safety requirements necessary to be in line with the ISO <NUM> standard. The ASIL is established by performing a risk analysis of a potential hazard by looking at the Severity, Exposure and Controllability of the vehicle operating scenario. The safety goal for that hazard in turn carries the ASIL requirements. There are four ASILs identified by the standard: ASIL A, ASIL B, ASIL C, ASIL D. ASIL D dictates the highest integrity requirements on the product and ASIL A the lowest. Hazards that are identified as "Quality Management" (QM) do not dictate any safety requirements. Under certain circumstances, the required ASIL classification of components can be lowered through a technique referred to as ASIL Decomposition. For example, a safety function implemented in an integrated device having high ASIL rating may be decomposed into independent sub-functions or components, with possibly lower ASIL. This can be advantageous, for example, with respect to improving system robustness and/or lowering production costs. However, it can be difficult to assure independent operation of the decomposed elements.

There is yet a need for an improved brake system and automotive actuator control which allows the use of cost-effective redundant circuits while maintaining the highest vehicle safety requirements.

The inventors find that, from the results of vehicle simulation analyses, the safety and stability of a vehicle can typically be ensured only with a fail operational concept and the use of expensive ASIL D compliant E/E Hardware components. So the use of redundant ASIL B components is typically not feasible without a special concept as this is not compliant to the ASIL D level diagnostic coverage and failure rate (especially to mitigate the random E/E Hw failures). As described herein, the Smart Brake Fail Operational Decomposed Actuator safety concept can achieve ASIL D requirements on system level with the use of lower complexity (ASIL B) E/E hardware components. According to a preferred embodiment, the Smart Brake Fail Operational Decomposed Actuator concept has two channels which both can be comprised of an ASIL B level control unit and inverter. According to the decomposition rules of the ISO <NUM> standard this by itself may not fulfill the integrity of the transition to degraded mode (safe state) and the ASIL D diagnostic coverage and failure rate of the system. To compensate for this the present teachings provide an additional mechanism which can independently select a respective channel.

The invention provides a brake system for braking a vehicle. The brake system comprises a respective brake actuator controller, preferably at least one for each wheel. The respective brake actuator controller is configured to apply a respective power signal to power a respective brake actuation mechanism. The respective brake actuation mechanism can then apply an amount of braking to the wheel. In particular, this can be based at least on a respective actuator control signal received by the brake actuator controller. The brake system further comprises a central controller configured to control the braking of the vehicle. This can be done by sending the respective actuator control signal to the respective brake actuator controller of each wheel, e.g. based on a brake intent signal received by the central controller. As described herein each brake actuator controller comprises a main brake circuit configured to provide the power signal based on a first actuator control signal received from the central controller. Furthermore each brake actuator controller comprises a backup brake circuit configured to independently provide the power signal, in case the main brake circuit fails, based on a second actuator control signal received from the central controller. Advantageously, each brake actuator controller comprises a switching circuit. The switching circuit is configured to exclusively relay the power signal received from either the main brake circuit or the backup brake circuit to the brake actuation mechanism based on a switching signal received from the central controller independently of the actuator control signals. For example, the central controller can be classified as ASIL-D to reliably decide whether to switch between the main and backup circuits in the respective brake actuator controller, so the required classification of these independent circuits can be lower, e.g. ASIL-B.

The brake system according to the invention preferably comprises an automotive actuator for applying a force or torque in an automotive component, in particular a brake actuator for braking a wheel. The actuator comprises an actuation mechanism. For example, the actuation mechanism comprises a clamping device or other actuated device for applying an amount of braking to the wheel, e.g. by clamping a brake disc connected to the wheel. Furthermore, the actuation mechanism comprises or couples to an electric motor operably connected to the actuated device via a transmission. The automotive actuator further comprises an actuator controller, e.g. the brake actuator controller as described earlier. In particular, the actuator controller comprises a main circuit configured to provide a power signal to the electric motor based on a first actuator control signal received from a central controller via a main network port. Furthermore, the actuator controller comprises a backup circuit configured to independently provide the power signal, in case the main circuit fails, based on a second actuator control signal received from the central controller via a backup network port. Furthermore, the actuator controller comprises a switching circuit configured to exclusively relay the power signal received from either the main circuit or the backup circuit to the actuation mechanism based on a switching signal received independently of the actuator control signals via a signal port separate from the main and backup network ports.

These and other features, aspects, and advantages of the brake system of the present invention will become better understood from the following description, appended claims, and accompanying drawing wherein:.

<FIG> illustrates a vehicle <NUM> with a brake system <NUM> for braking a vehicle <NUM>.

In some embodiments, e.g. as shown, the brake system comprises a respective brake actuator controller <NUM> for one or more wheels <NUM> of the vehicle <NUM>, preferably each wheel <NUM>. In one embodiment, the brake actuator controller <NUM> is configured to apply a respective power signal "Sp" to power a respective brake actuation mechanism <NUM> for applying an amount of braking BR to the wheel <NUM>. For example, this can be based at least on a respective actuator control signal "Sa" received by the brake actuator controller <NUM>. In other or further embodiments, e.g. as shown, the brake system comprises a central controller <NUM>. In one embodiment, the central controller <NUM> is configured to control the braking of the vehicle by sending the respective actuator control signal "Sa" to the respective brake actuator controller <NUM> of each wheel <NUM>. For example, this can be based on a brake intent signal "Si" received by the central controller <NUM>.

In some embodiments, each brake actuator controller <NUM> comprises at least a main brake circuit <NUM> and a backup brake circuit <NUM>. In one embodiment, the main brake circuit <NUM> is configured to provide the power signal "Sp" based on a first actuator control signal "Sa", e.g. received from the central controller <NUM>. In another or further embodiment, the backup brake circuit <NUM> is configured to (independently) provide the power signal "Sp", e.g. in case the main brake circuit <NUM> fails, based on a second actuator control signal "Sa" which can also be received from the central controller <NUM>. In a preferred embodiment, the brake actuator controller <NUM> comprises a switching circuit <NUM> configured to exclusively relay the power signal "Sp" received from either the main brake circuit <NUM> or the backup brake circuit <NUM> to the brake actuation mechanism <NUM>. Most preferably, this based on a switching signal "Sw" received independently of the actuator control signals Sa. For example, the switching signal "Sw" is also received from the central controller <NUM>.

Aspects of the present invention can also be embodied as an integrated brake actuator for braking a wheel <NUM>. For example, the brake actuator comprises the integrated components of the brake actuator controller <NUM> and brake actuation mechanism <NUM>. In one embodiment, the brake actuation mechanism <NUM> comprises a clamping device 20c for applying an amount of braking BR to the wheel <NUM>, e.g. by clamping a brake disc connected to the wheel <NUM>, and an (electric) brake motor <NUM> operably connected to the clamping device 20c via a brake transmission 20t. In another or further embodiment, the brake actuator controller <NUM> comprises a main brake circuit <NUM>, a backup brake circuit <NUM>, and a switching circuit <NUM>, as described herein. For example, the main brake circuit <NUM> is configured to provide a power signal "Sp" to the brake motor <NUM> based on a first actuator control signal "Sa" received from a central controller <NUM> via a main network port 51p. For example, the backup brake circuit <NUM> is configured to independently provide the power signal "Sp", in case the main brake circuit <NUM> fails, based on a second actuator control signal "Sa" received from the central controller <NUM> via a backup network port 52p. For example, the switching circuit <NUM> is configured to exclusively relay the power signal "Sp" received from either the main brake circuit <NUM> or the backup brake circuit <NUM> to the brake actuation mechanism <NUM> based on a switching signal "Sw" received independently of the actuator control signals Sa via a signal port 13p separate from the main and backup network ports 51p,52p.

An electric brake for a vehicle typically has an electromechanical actuation mechanism, configured to press a friction brake lining for braking against a brake body that is mounted to a vehicle wheel. The brake body, or rotor, is typically a brake disc or a brake drum. The actuation device typically has an electric motor and a rotation-to-translation conversion gear that converts a rotary driving motion of the electric motor into a translational motion for pressing the friction brake lining against the brake body. Worm gears, such as spindle gears or roller worm drives, are often used as rotation-to-translation conversion gears. It is also possible to convert the rotary motion into a translational motion by means of a pivotable cam, for instance. A step-down gear, for instance in the form of a planetary gear, is often placed between the electric motor and the rotation-to-translation conversion gear. Self-boosting electromechanical vehicle brakes have a self-booster that converts a frictional force, exerted by the rotating brake body against the friction brake lining that is pressed for braking against the brake body, into a contact pressure, which presses the friction brake lining against the brake body in addition to a contact pressure that is exerted by the actuation device. Wedge, ramp, and lever mechanisms are suitable for the self-boosting.

In some embodiments, the brake intent signal "Si" is generated based on user interaction with a service and/or parking brake <NUM>, and/or generated autonomously by a vehicle motion control system (not shown). In one embodiment, the brake intent signal "Si" is received directly or indirectly from the service and/or parking brake <NUM>. For example, the brake intent signal "Si" is generated when a brake pedal is operated. In another or further embodiment (not shown), the brake intent signal "Si" is generated autonomously by a motion controller of the vehicle. For example, the vehicle comprises a sensor system configured to detect impending danger and activate the brake system accordingly. So it will be understood that the brake system can also be operated as part of a partially or fully self-driving vehicle.

In some embodiments, the central controller <NUM> is configured to receive a sensor signal "Ss" from a motion sensor <NUM> measuring a motion of the vehicle and/or wheel <NUM>. In one embodiment, the central controller <NUM> is configured to send the switching signal "Sw" to the switching circuit <NUM> for relaying the power signal "Sp" of the backup brake circuit <NUM> instead of the main brake circuit <NUM>, or vice versa, based on the sensor signal "Ss". In another or further embodiment, the central controller <NUM> is configured to send the switching signal "Sw" to one or more brake actuator controllers <NUM> for switching the switching circuit <NUM>, if the central controller <NUM> determines, based on the sensor signal "Ss", that the measured motion of the vehicle and/or wheel <NUM> deviates from an expected motion corresponding to the actuator control signal "Sa" and/or brake intent signal "Si".

In some embodiments, the motion sensor <NUM> comprises a wheel speed sensor configured to individually measure the wheel speed of each wheel of the vehicle. In one embodiment, the central controller <NUM> is configured to receive a respective wheel speed signal from each wheel <NUM>. In another or further embodiment, the central controller <NUM> is configured to send the switching signal "Sw" for switching to the backup brake circuit <NUM> exclusively to the respective brake actuator controller <NUM> of the specific wheel. For example, the switching signal "Sw" is sent if it is determined that a measured wheel speed of a specific wheel deviates from an expected wheel speed corresponding to the actuator control signal "Sa" (that was sent to the respective brake actuator controller <NUM> of the specific wheel <NUM>). In this way, only the faulty brake actuator controllers <NUM> of a specific wheel may need to be switched to its backup circuit, while the controllers of the other wheels can remain to use their main circuit.

In other or further embodiments, the motion sensor <NUM> comprises an inertial sensor configured to measure acceleration and/or deceleration of the vehicle. In one embodiment, the central controller <NUM> is configured to receive an acceleration and/or deceleration signal from the inertial sensor and send the switching signal "Sw" for switching each of the brake actuator controller <NUM> from the main brake circuit <NUM> to the backup brake circuit <NUM>, or vice versa. For example, in case an overall braking behavior of the vehicle deviates from expected behavior, the problem may be immediately remedied by switching each of the brake actuator controller <NUM> to an alternate brake circuit <NUM>. For example, this can alleviate braking problems even if it cannot be directly determined which specific controller has failed.

In some embodiments, the central controller <NUM> is configured to periodically test the backup brake circuit <NUM> by switching the brake actuator controller <NUM> to use the backup brake circuit <NUM> instead of main brake circuit <NUM> absent any detected failure in the brake system <NUM>. In one embodiment, the central controller <NUM> is configured to periodically test the backup brake circuit <NUM> when the vehicle is parked by applying a parking brake using the backup brake circuit <NUM> and monitor subsequent motion of the vehicle and/or wheels. For example, when the vehicle or wheel starts moving after the brake is actuated using the backup brake circuit <NUM>, this is an indication there is a fault in the backup brake circuit <NUM>. By testing this during parking there is relatively low risk associated with the test.

In some embodiments, the central controller <NUM> is configured to output a warning signal if it is determined that either the main brake circuit <NUM> or backup brake circuit <NUM> fails expected operation. For example, the warning signal can be used to trigger a visual and/or auditory warning signal on a dashboard of the vehicle. In one embodiment, the central controller <NUM> is configured to switch operation of the vehicle to a degraded mode based on the warning signal. In another or further embodiment, operation of the vehicle is limited in the degraded mode compared to normal mode (when the brake system <NUM> is fully functional). For example, the maximum speed of the vehicle may be limited in the degraded mode.

<FIG> illustrates further details of a preferred components in a brake system <NUM>.

In some embodiments, the central controller <NUM> is configured to communicate with each brake actuator controller <NUM> using a set of at least two separate parallel cables between the central controller <NUM> and respective brake actuator controller <NUM>. For example, a first cable is configured to send the actuator control signal "Sa" to the main brake circuit <NUM> and a second cable is configured to send the actuator control signal "Sa" to the backup brake circuit <NUM>. In one embodiment, the central controller <NUM> is configured to send the actuator control signal "Sa" using two or more network cables arranged in parallel between the central controller <NUM> and brake actuator controller <NUM>. In another or further embodiment, the actuator control signal "Sa" is communicated using a message based protocol such as CAN or Ethernet. Such protocol can provide flexibility in communicating various types of information.

In a preferred embodiment, e.g. as shown, the central controller <NUM> is configured to communicate the switching signal "Sw" to each brake actuator controller <NUM> using at least one additional cable, e.g. separate from the set of at cables used for communicating the actuator control signal "Sa". In one embodiment, the actuator control signal "Sw" is communicated by applying a fixed voltage on a respective signal line. For example, the switching signal "Sw" can be simply communicated by switching between a high and low voltage, e.g. 5v and 0V, or any other voltage. Such way of communication can be relatively simple and robust so the chance of failure can be minimized. In one embodiment, the central controller <NUM> is configured to communicate the switching signal "Sw" to each brake actuator controller <NUM> using two signal lines. In another or further embodiment, the brake actuator controller <NUM> is configured to determine the switching signal "Sw" based on a combination of voltages received from the two signal lines. For example, in normal operation, an "on" or "high" voltage signal (<NUM>) is continuously provided on each of the signal lines. When both of the signals is switched to an "off' or "low" voltage (<NUM>) this can be used as an indication to operate the switching circuit <NUM>. This redundancy may prevent inadvertent switching when one of the signal lines is broken. Of course also other combinations of signals can be used. By switching the switching circuit <NUM> using a limited number of signals, e.g. one or two bits, the chance of failure for such switching can be lowered. In principle also more than two, e.g. three, signal lines can be used for further redundancy.

In some embodiments, e.g. as shown, each brake circuit <NUM>,<NUM> comprises a separate set of components. In one embodiment, the set of components includes a network port 11p, 12p configured to receive a respective actuator control signal "Sa". In another or further embodiment, the set of components includes an inverter 11i, 12i configured to generate a respective power signal "Sp". In another or further embodiment, the set of components includes a brake actuator processor 11c, 12c configured to control the main brake circuit <NUM> to generate the power signal "Sp" based on the actuator control signal "Sa". In one embodiment, (the components of) the respective brake circuits <NUM>,<NUM> are classified as ASIL-B or ASIL-C. For example, the brake actuator processor 11c, 12c can be a relatively simple processor, e.g. single core as opposed to a dual-core lockstep processor which is typically needed for being rated as ASIL-D.

In some embodiments, the switching circuit <NUM> comprises a signal port 13p configured to receive the switching signal "Sw", e.g. one or more voltages. In other or further embodiments, the switching circuit <NUM> comprises a switching relay 13r controlled by the switching signal "Sw" to form an electrical connection between an output of a respective inverter 11i, 12i of either the main brake circuit <NUM> or the backup brake circuit <NUM>. In a preferred embodiment, at least the components of the switching circuit <NUM> are classified as ASIL-D. As will be appreciated, the ASIL-D classification of the switching circuit <NUM> can be used to apply reliable ASIL decomposition of components in the brake actuator controller <NUM> by improved separation between the operation of the main and backup brake circuits, which can thus be of lower classification ASIL-B without compromising safety.

In some embodiments, e.g. as shown, the central controller <NUM> comprises at least one signal port <NUM> for receiving a sensor signal "Ss" from a motion sensor <NUM> measuring a motion of the vehicle and/or wheel <NUM>. In one embodiment, the central controller <NUM> comprises a sensor signal acquisition unit 54a configured to generate a conditioned sensor signal "Sc" based on the sensor signal "Ss" received from the signal port <NUM>. In another or further embodiment, the central controller <NUM> comprises a black-box actuator safety unit 54b configured to generate a safety mechanism result Sf based on the conditioned sensor signal "Sc". The safety mechanism result Sf can also be based on an indication Sa' of the actuator control signal "Sa", e.g. to compare the measured brake behavior (based on the sensor signal "Ss") with the expected brake behavior (based on the indication Sa'). In another or further embodiment, the central controller <NUM> comprises an actuator control safety unit 50f. For example, the actuator control safety unit 50f is configured to generate the switching signal "Sw" based on the safety mechanism result Sf, and/or to selectively output the actuator control signal "Sa" to one of a main network port 51p and a backup network port 52p based on the safety mechanism result Sf. For example, these ports 51p,52p are connected to the respective network ports 11p,12p of the main and backup brake circuits <NUM>,<NUM>.

In some embodiments, e.g. as shown, the central controller <NUM> comprises a brake system control module <NUM> configured to determine an individual brake intent for each wheel <NUM> based on the received brake intent signal "Si". The brake system control module <NUM> may also include other considerations, e.g. other sensor inputs. For example, the brake system control module <NUM> may implement an anti-lock braking system (ABS), electronic stability control (ESC), or other traction control. In one embodiment, the central controller <NUM> comprises an actuator control module 50a configured to individually generate a respective actuator control signal "Sa" for each wheel based on the individual brake intent signal. In another or further embodiment, the actuator control module 50a is configured to generate the generate a respective actuator control signal "Sa" for each wheel further based on a (conditioned) sensor signal "Sc" indicating a motion of the wheel.

Preferably, the central controller <NUM> is classified as ASIL-D. For example, the central controller <NUM> comprises a dual core lockstep processor. By providing the highly reliable central controller <NUM> with the decision function whether to use the main brake circuit <NUM> or the backup brake circuit <NUM> in each of the brake actuator controllers <NUM>, the overall chance of failure is further lowered. Typically, the units and modules as described herein with reference to the central controller <NUM> can be implemented in hardware and/or software components. While the functions are depicted as separate blocks, these blocks or functions can also be integrated, further subdivided, or omitted (e.g. because their respective function is not strictly necessary). For example, the functions of the brake system control module <NUM> and the actuator control module 50a can be combined. For example, the functions of the black-box actuator safety unit 54b can be integrated in the actuator control safety unit 50f and can also be made part of the brake system control module 50a. For example, the sensor signal acquisition unit 54a may be omitted and the sensor signal "Ss" directly input into the black-box actuator safety unit 54b and/or actuator control safety unit 50f. Also other variation will be apparent to the skilled person having the benefit of the present teachings. While it is recognized that the present teachings are especially beneficial in the control of a brake system, in principle the present teachings can also be applied to other automotive components that benefit from reliable control, in particular allowing the use of cost-effective redundant circuits while maintaining the highest vehicle safety requirements.

In interpreting the appended claims, it should be understood that the word "comprising" does not exclude the presence of other elements or acts than those listed in a given claim; the word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements; any reference signs in the claims do not limit their scope; several "means" may be represented by the same or different item(s) or implemented structure or function; any of the disclosed devices or portions thereof may be combined together or separated into further portions unless specifically stated otherwise. Where one claim refers to another claim, this may indicate synergetic advantage achieved by the combination of their respective features. But the mere fact that certain measures are recited in mutually different claims does not indicate that a combination of these measures cannot also be used to advantage. The present embodiments may thus include all working combinations of the claims wherein each claim can in principle refer to any preceding claim unless clearly excluded by context.

Claim 1:
A brake system (<NUM>) for braking a vehicle (<NUM>), the brake system comprising
for at least one, preferably each, wheel (<NUM>) of the vehicle, a respective brake actuator controller (<NUM>) configured to apply a respective power signal (Sp) to power a respective brake actuation mechanism (<NUM>) for applying an amount of braking (BR) to the wheel (<NUM>) based at least on a respective actuator control signal (Sa) received by the brake actuator controller (<NUM>);
a central controller (<NUM>) configured to control the braking of the vehicle by sending the respective actuator control signal (Sa) to each respective brake actuator controller (<NUM>) based on a brake intent signal (Si) received by the central controller (<NUM>);
wherein each brake actuator controller (<NUM>) comprises
a main brake circuit (<NUM>) configured to provide the power signal (Sp) based on a first actuator control signal (Sa) received from the central controller (<NUM>),
a backup brake circuit (<NUM>) configured to provide the power signal (Sp), in case the main brake circuit (<NUM>) fails, and
a switching circuit (<NUM>) configured to exclusively relay the power signal (Sp) received from either the main brake circuit (<NUM>) or the backup brake circuit (<NUM>) to the brake actuation mechanism (<NUM>)
characterised in that
the backup brake circuit (<NUM>) is configured to independently provide the power signal (Sp) based on a second actuator control signal (Sa) received from the central controller (<NUM>), and
the switching circuit (<NUM>) is configured to relay the power signal (Sp) based on a switching signal (Sw) received from the central controller (<NUM>) independently of the actuator control signals (Sa).