DE102011005395A1 - Method for controlling brake assembly of motor car, involves fulfilling condition of activation when driving stability function of brake assembly is provided by antilock braking system and electronic stability control/active yaw control - Google Patents

Abstract

The method involves monitoring hazard condition i.e. collision occurrence, of a motor vehicle (2). A driver independent brake intervention is executed (5) when the hazard condition is recognized, and condition of activation is fulfilled. The condition of activation is fulfilled when driving stability function of a brake assembly is provided by an antilock braking system (ABS) and an electronic stability control/active yaw control (ESC/AYC). Information is stored according to availability of driving stability function of the brake assembly when the condition of activation is fulfilled. An independent claim is also included for a device for controlling a brake assembly of a motor car, comprising a monitoring unit.

Description

The invention relates to a method according to the preamble of claim 1 and a device according to the preamble of claim 11.

From the DE 10 2004 058 814 A1 is a so-called "post-crash braking" method and a device for controlling a brake system of a motor vehicle, in which the presence of a collision of the motor vehicle by the airbag control unit triggers the function. In the case of an existing collision, a driver-independent, ie automatic braking intervention takes place, wherein the intensity of the braking intervention is withdrawn as a function of a return condition. It is further described that a determination is to be made as to whether the vehicle is manageable after the collision by the driver or not, with a driver-independent braking intervention is then performed when the vehicle is considered unmanageable.

Furthermore, in the WO 2010 046 160 A1 a similar method is described, in which the return condition for the Bremseningriff is explained in more detail. In this case, the autonomous braking is only canceled when the driver signals by targeted operation of an accelerator pedal over a certain minimum period of operation to have the vehicle (again) under control.

The object of the present invention is to improve the post-crash braking method known from the above-cited documents as well as a braking device provided for carrying out this method.

This object is achieved according to the invention by a method according to claim 1 and a device according to claim 11.

The invention accordingly relates to a method for controlling a brake system of a motor vehicle with a driving stability function. The brake system preferably comprises an electronic brake control device, in which at least the control function anti-lock braking system (ABS) and electronic stability program (ESC: Electronic Stability Control ESC / AYC: Active Yaw Control) are executed. According to the method, the presence of a dangerous situation of the motor vehicle, in particular the occurrence of a collision, is monitored. If a dangerous situation, in particular a collision, is detected, a driver-independent brake intervention is carried out if an activation condition is met. This activation condition is considered fulfilled when the driving stability function of the brake system is or was available.

It is possible to use the method described above in connection with environmental monitoring systems known per se, such as environment sensor-based emergency braking assistance systems (CMS: Collision Mitigation Systems). These systems are usually based on arranged on the front of the vehicle radar sensor. The systems record the environment in front of the vehicle and can calculate / estimate the risk of collision with vehicles or objects in front. These environment-based systems aim to assist the driver in critical, collision-threatening emergency braking situations, such as pre-filling the brake system or lowering the trigger thresholds for the hydraulic brake assist. Advanced systems automatically initiate braking of the vehicle, possibly even independently of the driver. This is limited depending on the design of the system in time and / or in the strength and / or in the body speed (gradient) or even unlimited. A combination with haptic warning systems (FCW: Forward Collision Warning), which generate a jolt by a brief automatic brake pressure buildup, is also possible.

A safety-relevant problem is the possible destabilization of a vehicle by an automatic brake pressure build-up, which can occur either by the inventive function "Post Crash Braking" or the system CMS described above. In this case, both the height of the brake pressure and the pressure increase gradient can lead to destabilization. An automatic brake pressure build-up by a function can be activated (in the specified use case (emergency braking situation, collision)) or unintentionally (in non-use case (normal drive)). The risk of destabilization due to an unwanted automatic brake pressure build-up must be analyzed in a hazard analysis (according to ISO 26262 ) with at least ASIL C (the maximum permissible failure rate of a safety function is described in safety classes, eg ASIL (Automotive Safety Integrity Level).) This case (destabilization by an unwanted automatic brake pressure build-up) must therefore be prevented by appropriate safety measures.

However, a major technical challenge is often the fulfillment of such high requirements from the functional safety (nach ISO 26262 ). The technical safety concept following from the functional safety concept sometimes requires a high expenditure for the realization. A common example is redundant and independent signal processing in control units, such as an air bag control unit for firing front airbags, to meet the ASIL D safety level.

In automatic brake pressure build-up functions, a simple safety measure to prevent or limit the risk of destabilization is as follows: The amount of brake pressure, and particularly the pressure build-up gradient, is preferably limited in the automatic brake pressure build-up of the invention to reduce the risk of vehicle destabilization or to prevent. In particular, the limitation may also be adapted to the driving state (for example, stronger limitation when cornering, since there is an increased danger of destabilization). However, these measures are generally in conflict with the functional requirements of such functions in which a high brake pressure to be built as quickly as possible, such. B. Emergency Braking Systems (CMS).

According to a preferred embodiment of the invention, the destabilization of the vehicle by a suspension control system or stabilization function such as ABS (Antilock Braking System) and / or ESC (Electronic Stability Control) and / or AYC (Active Yaw Control) is prevented. This is done either exclusively or in combination with the above-mentioned measures of (possibly partial) brake pressure and / or brake pressure gradient limitation.

Activation of an automatic brake pressure build-up by a function in which a high brake pressure is to be built up as quickly as possible requires, for example, the availability and readiness of the stabilization function (s) Antilock Brake Control (ABS) and / or Driving Stability Program (ESC / AYC). If an automatic brake pressure build-up is requested by one of the above functions (eg CMS, PCB) and the functions ABS or ESC / AYC are not available and ready (eg due to an electrical fault or a functional condition), then no automatic brake pressure build-up performed. In the case of a functional state (eg by ESC button "ESC OFF"), a forced change of this state of ABS or ESC / AYC can also take place and then an automatic brake pressure build-up can be carried out.

The height of the pressure built up automatically by the method of the invention preferably corresponds to a vehicle deceleration in a range between about 0.2 g and 0.8 g, in particular about 0.5 g, where g is the gravitational acceleration. It is alternatively possible to carry out the brake pressure increase up to the maximum possible brake pressure.

Preferably, the driver-independent braking intervention after the occurrence of said danger situation is carried out in such a way that an activation of an automatic braking function takes place. This can either be an automatic brake pressure build-up without driver brake actuation or a brake pressure boosting the driver brake actuation.

In the following, a distinction is made between the use case and the non-use of the function "post crash braking" according to the invention.

In the case of use, for example, there is an actual collision. Within the function "Post Crash Braking" function, a failure of the functions ESC / AYC and possibly also ABS is preferably accepted without an automatic brake pressure build-up being canceled or not activated by the "Post Crash Braking" function.

In the case of non-use (no collision or intended activation), destabilization according to functional safety requirements due to an unintentionally activated "Post Crash Braking" function must at least be secured with the security level "ASIL C". Accordingly, as a safety measure either the activation of an automatic brake pressure build-up or the prevention of destabilization by stabilizing functions ABS or ESC / AYC (or their availability information) must be carried out accordingly. This can be done (on the one hand) by a correspondingly secure activation path, at least the "ASIL C" level. However, this is technically feasible only with increased effort, especially in the airbag control unit. Today's airbag control devices meet the "ASIL D" requirements for preventing inadvertent activation of the front airbags by providing two independent activation paths, which include both the sensors and the signal processing with the deployment decision. The signal processing takes place on the one hand on a microcontroller and on the other hand via an ASIC (Safing path). Since the safing path is implemented in today's airbag control units via an ASIC, this information can not be transmitted over a CAN data line without much additional effort. The microcontroller path via which the activation signal (crash signal) for the PCB function can be sent via CAN fulfills ASIL B requirements regarding an unwanted activation. Since the activation path therefore offers only an "ASIL B" -compliant activation path in a cost-effective manner (without hardware modifications to the airbag control unit), the availability of ABS or ESC / AYC must be ensured as a further security measure to safeguard destabilization in the unwanted activation case (non-use case). As already stated above, to activate an automatic print build-up by the "Post Crash Braking" function, the positive availability information of the stabilization functions ESC / AYC and / or ABS is required automatic brake pressure build-up requested by any of the described functions, and if the ABS or ESC / AYC functions are not available and ready (eg, by an electrical fault or a functional condition), then no automatic build up of brake pressure is performed.

In a "Post Crash Braking" feature like in the DE 10 2004 058 814 A1 In the event of a collision, it is very likely that the ESC / AYC function will be switched off (failed) by an error monitor since the measuring ranges of the inertial sensors (lateral acceleration, yaw rate) are generally exceeded and the sensors in goes to an error state or supplies implausible or invalid values. This can already happen very quickly after the crash pulse acting on the vehicle (time t ₀ ) (about 60 ms after t ₀ ). In addition, other causes due to the crash can cause a failure or a shutdown of the function ESC / AYC and / or ABS. As has already been described above, the situation may occur in the case of use that ABS and / or AYC function (s) have already failed before the "Post Crash Braking" function, in particular by a crash signal from the airbag control unit, requests an automatic buildup of brake pressure , Therefore, because of the safety mechanism required in an ASIL B activation path (as described above: positive availability information to enable automatic brake pressure build-up), in most cases no activation will be performed, although it would be intended.

Occurs at a first time t _0, the danger situation, according to a preferred embodiment of the method, the activation condition is met as if the driving stability function of the brake system at an earlier, second time t _{2 was} available.

According to a further preferred embodiment of the method, information AY-state is stored about a availability of the driving stability function of the brake system. In this case, the activation condition is considered fulfilled if it is detected on the basis of the availability information that the driving stability function was available at a second time t ₂ , which is earlier than a first time t ₀ , at which the dangerous situation occurs.

Preferably, the availability information is repeatedly stored after a predetermined first time interval Δt_z, in particular in a first memory variable A_n1. The information stored in particular in the first memory variable A_n1 is expediently not used for checking the activation condition during a predetermined second time interval Δt_c after the memory has been stored.

It is furthermore preferred to additionally store the information about the current availability of the driving stability function after a predetermined second time interval Δt_c in each case after the storage in the first memory variable A_n1 in a second memory variable A_n2. It is expedient to use the information stored in the second memory variable A_n2 for checking the activation condition if the information stored in the first memory variable A_n1 is not used to check the activation condition.

According to an alternatively preferred embodiment of the method, if there is a subsequent time t ₂₀₀ after which the danger situation in the brake system can be determined on the basis of latencies after the first time t ₀ at which the dangerous situation occurs, then the activation condition is fulfilled considered when the driving stability function of the brake system at the time t ₀ was available.

Preferably, latency availability information about availability of the driving stability function of the brake system is formed and the activation condition is considered fulfilled if it is recognized from the latency availability information that the driving stability function is considered available at a third time t ₃ , which is at or after the first time t ₂₀₀ , at which the information about the dangerous situation arrives.

The latency availability information (AY-state) is preferably set after the lapse of a latency t _lat to the logical state of the actual error signal Fahrstabilitatsfunktion, the measurement of the latency t _lat in particular begins at the time when the driving stability function is no longer available.

The invention also relates to a device for controlling a brake system according to claim 11.

Further preferred embodiments will become apparent from the subclaims and the following description of an embodiment with reference to figures.

Show it

1 a first embodiment of the invention,

2 A second embodiment of the invention and

3 a third embodiment of the invention.

As in 1 are represented by one or more sensors 1 the presence of a dangerous situation, in particular a collision, of the motor vehicle monitored. After in block 2 At a time t ₀ a dangerous situation, in particular a collision, the motor vehicle has been detected is in block 3 a decision on the existence of an activation condition is satisfied and, if the activation condition is met, in block 5 a driver-independent brake intervention performed. According to the exemplary embodiment described here is in block 4 Information about the availability of a driving stability function (ESC / AYC, ABS) buffered (buffered). This availability information will be the decision making in block 3 based on.

The availability information of the driving stability function (s) ESC / AYC and possibly ABS is preferably buffered in such a way that at the time of the activation decision (Block 3 ) for automatic brake pressure build-up (triggered, for example, by the crash signal of the airbag control unit (block 1 ) is always a state information from a time t ₂ shortly before the crash event (crash time t ₀ ) is present. This (historical) state information is used instead of the state information of the driving stability function (s) at the time of the activation decision in the activation decision.

The period Δt_z of the intermediate storage (corresponds to the age of the state information) is advantageously greater than the time Δt_c, which is required for detection, processing and transmission of the crash information after t ₀ from the system (crash sensors, airbag control unit, data line, electronic brake control unit) ("Worst Case "). This time Δt_c can be approximately 200 ms by way of example. The period Δt_z can be approximately 300 ms by way of example. The period Δt_z may also be variable within a minimum and a maximum time (eg approximately 250-500 ms).

A further advantage of this exemplary embodiment is that in the event of non-use, an automatic brake pressure buildup triggered by a (incorrectly transmitted or received) crash signal is only carried out if the stabilization function (s) ESC / AYC and possibly ABS before the time Δt_z (for example 300 ms). was still available and ready (positive availability information). The probability that the availability state has changed in the period Δt_z (for example, 300 ms) (from "available" to "not available") is so small in the case of non-use (normal travel, no collision) that it can be neglected. In the case of use (eg collision), on the other hand, the probability that the function ESC / AYC is switched off within the period Δt_c after crash time t ₀ by an error monitoring or fails as a consequence of the crash pulse is very high, as shown above. By using the state information of a time t ₂ shortly before t ₀ (t ₀ + Δt_c <t ₀ + Δt_z) in the (expected) case of a positive availability information an activation of the automatic pressure build-up is enabled (see also 2 ).

Thus, the activation path can be cost-effectively executed according to the security level "ASIL B" and at the same time the effective field (= the number of useful situations in which the "Post Crash Braking" function can take effect) can be considerably extended.

• – Umsetzung programmiertechnisch im Elektronischen Bremssteuergerat,
• – Δt_z = 2 × Δt_c,
• – Verwendung von zwei Speichervariablen A_n1 und A_n2,
• – Abspeichern der aktuellen Verfügbarkeitsinformation ESC/AYC und/oder ABS in A_1 [0,1] (z. B. Wert 0 entspricht „nicht verfügbar”, Wert 1 entspricht „verfügbar”),
• – Erneutes Abspeichern der aktuellen Verfügbarkeitsinformation ESC/AYC und/oder ABS in A_n1 [0,1] nach Δt_z [ms], wieder erneutes Abspeichern nach Δt_z [ms], usw,
• – jeweils Blocken der Verwendung der Zustandsinformation in A_n1 [0,1] fur den Zeitraum Δt_c [ms] nach dem Zeitpunkt des Abspeicherns,
• – Abspeichern der aktuellen Verfugbarkeitsinformation von ESC/AYC und/oder ABS in A_n2 jeweils Δt_c [ms] nach Abspeichern von A_n1 (jeweils wenn Blocken der Verwendung von A_n1 beendet),
• – wenn Verwendung der Zustandsinformation in A_n1 geblockt, dann Verwendung der Zustandsinformation in A_n2.

In a further advantageous exemplary embodiment, the buffering of the status information takes place in accordance with one or more of the following measures / features:

• - Implementation by programming in the electronic brake control unit,
• Δt_z = 2 × Δt_c,
• Use of two memory variables A_n1 and A_n2,
• Storing the current availability information ESC / AYC and / or ABS in A_1 [0,1] (eg value 0 corresponds to "not available", value 1 corresponds to "available"),
• - again storing the current availability information ESC / AYC and / or ABS in A_n1 [0,1] after Δt_z [ms], again saving again after Δt_z [ms], etc,
• Blocking the use of the state information in A_n1 [0,1] for the period Δt_c [ms] after the time of the storage,
• Storing the current availability information of ESC / AYC and / or ABS in A_n2 in each case Δt_c [ms] after storing A_n1 (in each case if blocks of the use of A_n1 are terminated),
• If use of the state information is blocked in A_n1, then use the state information in A_n2.

Preferably, the availability information of the functions ESC / AYC and possibly ABS is buffered in such a way that at the time of the activation decision for the automatic brake pressure build-up (eg triggered by the crash signal of the airbag control unit) always a state information from a time t ₂ shortly before Crash event (eg time t ₂ = t ₀ -Δt, with crash time t ₀ and predetermined time interval Δt> 0) is present. This (historical) state information is used instead of the current state information at the time of the activation decision in the activation decision.

3 shows the time course of logic error signals in an exemplary brake system, in contrast to the example according to 2 works without a buffer for storing the availability information. The exemplary embodiment gemaß 3 is opposite to the example in 1 further simplified. With 4 ' is the above-described availability signal of the said driving stability function (s) ESC / AYC and optionally designated ABS. If an error occurs in these functions, the corresponding error signal changes 4 ' after a time t _failure after the crash time t ₀ from the logical value "1" (no error) to the logical value "0" (sensor error). If no error occurs, the activation condition is in block 3 even in the event of a crash, so that a driver-independent brake intervention can be performed. However, in the event of a crash, it must be ensured that in the case of an error, the availability signal does not change state before the utility function has been activated. According to the example described here, therefore, additional latency availability information "AY-state" is formed, which is used instead of the availability information 4 ' the decision making in block 3 based on this availability information is provided with a latency.

With 2 ' is the signal indicating the collision, which is determined by the crash sensor 2 is produced. This signal is received due to latencies only after a time t ₂₀₀ in the brake control unit. Within the brake control unit, the logical signal changes 2 ' then from "0" (no crash) to "1" (crash). As shown in part a), in the case of use no driver-independent activation in block 5 be possible because the brake system due to the error signal 4 ' was already deactivated before the arrival of the crash information at the time t _failure .

In order to avoid that in the case of use no activation of block 4 is more possible is, according to the example described here third embodiment in block 3 used the additional availability signal "AY-state". This additional signal is only used within the software of the brake system. The logical state of the "AY-state" signal normally corresponds to the state of the signal 4 ' except for the difference that the signal "AY-state" only after latency t _lat with the state of the signal 4 ' is overwritten. The time t _lat begins to run after the detection of a sensor error at the time t _failure . This can be done, for example, by the falling edge of the signal 4 ' in the software of the brake system, a payer starts, and only after the expiration of the counter overwriting the signal "AY-state" with the error signal 4 ' is made. At time t ₃ , the state of the signal "AY-state" is checked in the brake system. The time t ₃ is at or after the time t ₂₀₀ at which the information about the dangerous situation arrives. Since the value of "AY-state" is overwritten with the actual error state of the sensor only after expiration of the _{latent time} t _lat , it is also possible to use the sensor unit without the use of a memory 4 It can be stated that the vehicle dynamics sensors were available within the latency period t.sub.t _lat (and before the crash). The activation condition 3 is then considered fulfilled.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• DE 102004058814 A1 [0002, 0018]
• WO 2010046160 A1 [0003]

Cited non-patent literature

• ISO 26262 [0008]
• ISO 26262 [0009]

Claims (12)

Method for controlling a brake system of a motor vehicle having a driving stability function (ESC / AYC, ABS), in which the presence of a dangerous situation of the motor vehicle, in particular the occurrence of a collision, is monitored and a driver-independent braking intervention is carried out in the event of a detected dangerous situation, in particular collision ( 5 ), if an activation condition is fulfilled ( 3 ), characterized in that the activation condition ( 3 ) is satisfied, if the driving stability function ( 4 , ESC / AYC, ABS) of the brake system is or was (AY-state, 4 ' ). Method according to Claim 1, characterized in that, when the dangerous situation occurs at a first time (t ₀ ), the activation condition ( 3 ) is satisfied, if the driving stability function ( 4 , ESC / AYC, ABS) of the brake system at an earlier, second time (t ₂ ) was available (AY-state, 4 ' ). A method according to claim 1 or 2, characterized in that an information (AY state) on an availability of the driving stability function ( 4 , ESC / AYC, ABS) of the brake system is stored and that the activation condition is considered fulfilled when using the availability information ( 4 ' ) is detected that the driving stability function was available at a second time (t ₂ ), which is earlier than a first time (t ₀ ) at which the dangerous situation occurs. Method according to claim 3, characterized in that the availability information ( 4 ' , AY-state) repeatedly after a predetermined first time interval (.DELTA.t_z), in particular in a first memory variable (A_n1) is stored. Method according to Claim 4, characterized in that the information stored, in particular in the first memory variable (A_n1), during a predetermined second time interval (Δt_c) after storage is not used to check the activation condition. Method according to at least one of claims 4 or 5, characterized in that the information about the current availability of the driving stability function additionally repeats after a predetermined second time interval (Δt_c) in each case after the storage in the first memory variable (A_n1) in a second memory variable (A_n2). is stored. Method according to Claim 6, characterized in that the information stored in the second memory variable (A_n2) is then used to check the activation condition if the information stored in the first memory variable (A_n1) is not used to check the activation condition. A method according to claim 1, characterized in that, if at a after the first time (t ₀ ), at which the danger situation occurs, lying later time (t ₂₀₀ ), from which the danger situation in the brake system due to latencies is determined, the activation condition ( 3 ) is met when the driving stability function ( 4 , ESC / AYC, ABS) of the brake system was available at the time (t ₀ ) ( 4 ' ). Method according to Claim 1 or 8, characterized in that latency availability information (AY state) is formed via availability of the driving stability function (ESC / AYC, ABS) of the brake system and that the activation condition (A) 3 ) is satisfied, if it is recognized from the latency availability information (AY state) that the driving stability function at a third time (t ₃ ) is available, which is at or after the first time (t ₂₀₀ ), at which the information about the Dangerous situation arrives. A method according to claim 8 or 9, characterized in that the latency availability information (AY state) after latency (t _lat ) on the logic state of the actual error signal ( 4 ' ) of the driving stability function (ESC / AYC, ABS) is set, wherein the measurement of the latency (t _lat ) starts in particular at the time when the driving stability function (ESC / AYC, ABS) is no longer available. Device for controlling a brake system of a motor vehicle with a driving stability function (ESC / AYC, ABS) comprising a monitoring means for monitoring the presence of a dangerous situation of the motor vehicle, in particular a collision, and a brake control means for performing a driver-independent brake intervention when at a first time (t ₀ a hazard situation, in particular collision, is recognized and, if an activation condition is met, characterized by an evaluation means for checking the presence of the activation condition, the activation condition being considered fulfilled, if the driving stability function (ESC / AYC, ABS) of the brake system is earlier , second time (t ₂ ) was available. Device for controlling a brake system of a motor vehicle with a driving stability function (ESC / AYC, ABS), in particular according to claim 11, characterized in that in this one Method according to one of claims 1 to 10 is performed.

Images