DE102013007857A1 - Method for operating a braking system in fully automatic driving and motor vehicle - Google Patents

Abstract

A method for operating a brake system (4) in a motor vehicle (1) having a driver assistance system (2) designed for fully automatic, independent vehicle guidance, wherein in a fault-free operating phase of the brake system (4) the motor vehicle (1) is in a safe state, in particular standstill Causing, braking measures in a timely sequence of comprehensive action plan depending on operating parameters, comprising at least one ego parameter describing the current operating state of the motor vehicle (1) and / or at least one environmental parameter describing the surroundings of the motor vehicle (1), determined and constantly updated using current operating parameters the current action plan is stored in a storage means (10), and that the motor vehicle (1) is brought into the safe state using the current action plan by an emergency module (19) if a fault in the braking system (4) occurs becomes.

Description

The invention relates to a method for operating a brake system in a motor vehicle having a driver assistance system designed for fully automatic, independent vehicle guidance. In addition, the invention relates to a motor vehicle.

Brake systems in modern motor vehicles combine a variety of functions, so that they are becoming more complex according to their design. Examples of control functions commonly used on brake systems include Electronic Brake Force Distribution (EBV), Anti-lock Braking Systems (ABS) and Electronic Stability Control (ESC), all of which make braking safer and more comfortable. The control of the operation of modern brake systems is therefore usually organized so that, for example, provided as a higher-level control function, an electronic stability control, the subordinate ABS controller and / or EBV controller are provided. Overall, the controller structure of a brake system nowadays builds on a variety of sensor signals, signals from other vehicle systems, plausibility checks, distributions and control circuits for vehicle movement and for wheel and motor control, so that results in an extremely complex interaction.

Accordingly, such modern braking systems are designed so that they go in case of failure in a safe system state. This means that modern brake systems are often implemented as so-called "failsafe" brake systems. In this case, fallback levels are defined, some of which may still be electronic, but are often mechanical and / or hydraulic. When a safety-relevant fault occurs in the electronic system controlling the brake system, the vehicle safety is ensured by deactivating the electronic components by resorting to the mechanical and hydraulic components, that is, at least the driver's mechanical penetration of the brake pedal is basically ensured as a fallback level.

There are also more complex structures of failsafe brake systems known in which sub-controllers still remain active and the like. Thus, it is possible, for example, that in an error case, for example, if the electronic stability control fails as vehicle dynamics control system, the driver initially feels no immediate impairment of driving characteristics, after the ABS controller and the EBV controller are still active. Even in the case of failure of the ABS controller, the basic function of the braking system, namely stable braking with braking force distribution, is still present. In this embodiment, therefore, starting from the ESC full system, a plurality of fallback levels, namely, for example, in a signal error, a vehicle electrical system failure, a plausibility error or a communication error initially activating an ABS fallback level, in which case if a signal error of the speed sensor and / or a voltage drop below 7 V is present, can be attributed to an EBV fallback level. If even this is no longer operable, there is still mechanical penetration.

Such fail-safe fallback concepts or overall so failsafe braking systems are in their interpretation of the fact that the driver is "in the loop", so entrusted with the driving task and the motor vehicle leads.

Lately, the research activity on fully automated driver assistance systems designed for independent vehicle guidance has been increased. The fail-operational brake described here can not be applied to such systems since it assumes that the driver has the attention and responsibility for the driving operation during the operation of the brake system. For example, in a fully automated driver assistance system, a communication failure between the controller requesting a brake delay and the control unit controlling the brake delay and thus controlling the operation of the brake system, the desired deceleration could not be maintained, with the driver distracted by fully automated driving through other activities can not be at short notice in a detected and communicated error, the vehicle management can take over again. A major difference between a safety concept for non- or partially automated driver assistance system functions and fully automated driver assistance system functions is the time reserve until the driver should completely take over the driving operation himself. In semi-automated driver assistance systems, such as ACC systems and the like, the driving task by the driver is not delivered, that is, the driver is still responsible for the driving of the motor vehicle and should be "in the loop", so that at any time a complete takeover of the driving by the driver should be able to be implemented.

Such a permanent monitoring is no longer necessary for fully automated driver assistance systems designed for independent vehicle guidance, so that a longer time may pass before the driver can actually perform the driving task himself. Therefore, additional precautions are needed to ensure the safety of the motor vehicle as soon as possible during operation of the brake system System limit and / or a system failure, summarized as an error occurs.

The invention is therefore based on the object to provide a method for operating a brake system, which allows for an independent vehicle guidance by a fully automated driver assistance system ensuring a safe state of the motor vehicle within a sufficient time reserve.

To achieve this object, the invention provides in a method of the type mentioned above that in a fault-free operating phase of the brake system, a safe state of the motor vehicle, in particular the standstill, inducing braking measures in a timely comprehensive action plan as a function of operating parameters, comprising at least one the current operating state of the motor vehicle descriptive Egoparameter and / or at least one environment of the motor vehicle descriptive environmental parameters is determined and constantly updated based on current operating parameters, the respective current action plan is stored in a memory means, and that by an emergency module when an error of the brake system the motor vehicle is placed in the safe state using the current action plan.

Here, the expression of the error of the brake system is to be understood here wide, because it includes all the normal operation of the brake system severely affecting or completely excluding errors that may be present outside of the brake system, for example in case of failure a communication link, the fully automatic driver assistance system or a Failure of electrical energy. The method is carried out by one or more control devices of a motor vehicle or generally control devices.

The basic idea of the present invention is thus to define a safe state, for example the stoppage of the motor vehicle on the currently traveled lane or an adjacent traffic lane, for example a hard shoulder. Based on the current operating state of the motor vehicle, described by the operating parameters, therefore, a braking measures, thus desired braking deceleration, comprehensive action plan can be determined, which brings about this safe state, possibly taking into account further boundary conditions. Thus, during fault-free operation, a braking profile is generated as an action plan and kept constantly up to date, in which case the action plan is used in the event of an error. Consequently, the condition of the motor vehicle and the environment was taken into account for the maximum possible time, so that, for example, also what will be discussed in more detail below, steering interventions realized by the brake system and / or a longitudinal system can be present in the action plan in a timely manner. for example, if the currently traveled lane is to be kept. Thus, if, for example, the motor vehicle is brought to a standstill on the currently traveled lane as a safe state, this means that when the action plan is carried out, the motor vehicle automatically carries out the driving maneuver "deceleration to a stop on the currently traveled lane". The usual operation of the brake system is thus replaced by the implementation of the action plan, which is therefore advantageously stored in an independent, dedicated storage means. The braking commands contained in the action plan are generated in accordance with the current situation of the motor vehicle and lead to a result that is as safe as possible, which provides a time reserve in which the driver can then take over the driving task again. The action plan allows a transfer of the motor vehicle in the safe state without intervention by the driver. For typical error cases in which the usual implementation of a generated by the driver assistance system delay request is no longer possible, such as signal error, plausibility error or communication error, so that the actual control function, such as an electronic stability control, is no longer available, thus a fallback level for the braking system is used, the motor vehicle are moved to the safe state.

This realization of an emergency brake control which ultimately replaces the usual brake control based on the action plan can be achieved particularly advantageously if the storage and / or use of the action plan takes place in an additional control unit independent of a control unit implementing the functions of the brake system. This means that the brake system is no longer controlled by the control unit responsible for the fault-free operating phase, which is no longer able to perform its task due to the fault, but is taken over by the additional control unit, which is solely responsible for storing and using the action plan and functionally independent of the responsible in the error-free operating phase control unit. It should be noted, however, that it is quite possible that still available sub-functions of the competent in the error-free operation phase control unit can be addressed by the additional control unit, which will be discussed in more detail below. That way exists Overall, an independent of the functioning of the actually responsible control unit additional control unit, which can still execute the action plan, so that the motor vehicle is moved to a safe state. If, for example, the control unit responsible for the error-free operating phase generally fulfills the function of an electronic stability control, the conversion control unit can be understood as a kind of ESC add-on.

It is particularly expedient if a built-in control unit, in particular an ESC control unit, built-in for the brake system auxiliary control unit is used. In other words, the control unit, which is in any case responsible for the control of the brake system, extended to the additional unit, which is therefore also in spatial proximity to the possibly responsive interfaces and the like, therefore ideally is largely independent of longer, error-prone communication links. The additional control unit is integrated into the already existing infrastructure. It is therefore an integration of the functions of the brake system realizing control unit and the additional control unit in the control unit, in particular the ESC control unit given. It should be noted that it is of course also conceivable to integrate the additional control unit in other control devices or even provide as a separate unit.

It is also particularly advantageous if the additional control unit, at least when using the action plan, is supplied with an energy source assigned only to the additional control unit. It is also a possible fault case that the electrical energy supply of the motor vehicle fails, so that it can be extremely expedient if the additional control unit, which indeed implements the emergency module, can still remain active. Even with a complete failure of the electrical power supply, the driver is thus provided a time reserve until it can take over the control itself, for example, for the still existing mechanical penetration, the safety of the motor vehicle is maintained as far as possible, since the situational, before Action Plan, which is kept up to date, and which can also be followed due to the independent

As already indicated, it is also extremely expedient if the additional control unit implementing the emergency module uses an interface, which is also addressed by the control unit implementing the functions of the brake system, for outputting control variables to components of the brake system for realizing the action plan. This not only means that the predetermined output format for manipulated variables, ie control parameters, which is used in error-free operation is also realized by the additional control unit, but also that also hardware components that realize this interface are addressed by both control units. This results in a simplified realization.

In addition, the additional control unit implementing the emergency module can also be implemented in a cost-effective manner, generally speaking, since it merely requires an addition of standard components, in particular in a control unit which is associated with the braking system anyway. A memory means and a computing device accessing thereto, in particular a microprocessor, may already be sufficient, wherein additionally the energy source assigned to the additional control unit, for example a battery, may be installed.

In common system architectures, a braking system deceleration request is provided by vehicle systems that are in their role "decision makers." In the present case, the fully automatic driver assistance system designed for independent vehicle guidance supplies the default, which is then implemented in the brake system, in particular the control unit used during the fault-free operating phase, in order to implement the further functionalities, in particular ESC, ABS and EBV. This means that the fully automatic driver assistance system evaluates operating parameters anyway, in particular the operating parameters used to determine the action plan. Therefore, it is useful if the action plan is determined and updated by the driver assistance system. If a control unit and the auxiliary control unit implementing the emergency module are expediently implemented in a control unit, both the current action plan and the delay requests necessary for the operation of the driver assistance system are sent to the control unit.

In a further refinement of the invention, at least one safety criterion relating to the safety of the motor vehicle and / or at least one other road user and / or at least one further requirement descriptive requirement can be taken into account for the determination and updating of the action plan. For example, if the safe state has been defined as "standstill on the currently traveled lane", it is expedient to determine the action plan in such a way that, on the one hand, the safety of one's own and the other, surrounding motor vehicles is ensured, but also other boundary conditions resp Requirements such as driver guidance should be considered. For example, it is conceivable to provide a kind of cascaded braking as an action plan, wherein For example, initially for a certain period of time, for example two seconds, a rather weak braking is provided, which then increases slowly for further periods of time until the standstill is reached. In this way, on the one hand occurs to a sudden, strong braking, which increases the safety of the driver and avoids a surprise effect on other road users, on the other hand, the driver is gently pointed out that an error occurs when the motor vehicle starts, increasingly strong brake. In order to be able to determine such concrete action plans, the security and / or request criteria are provided according to the invention. Safety and / or requirement criteria may also affect the performance of the braking system. If the action plan has been determined by the driver assistance system on the basis of a currently desired speed of the motor vehicle, a request criterion may relate, for example, to the fact that the mean braking deceleration can also be implemented as a function of the definition of the safe state by the brake system. Requirements can also serve to fulfill legal requirements, so that a requirement criterion can for example provide that the maximum brake pressure build-up time must meet the legal requirements. These examples show that the determination of the action plan can be configured in such a way as to be parametrizable or with boundary conditions, so that the highest possible level of safety can be guaranteed as well as the feasibility of the action plan, whereby, of course, requirement criteria can also be tailored to the comfort of the driver.

In this context, it may be expedient if at least one safety criterion and / or requirement criterion is checked again by the emergency module and / or at least one additional criterion, in particular a maximum permissible braking delay, is checked. Consequently, a kind of plausibility check can be carried out in the emergency module, whereby a check against universally valid global limit values, for example for the braking deceleration, can also follow. In particular, subsystems of the braking system are known which can not provide the full braking power, for example, at individual wheels driving brake components. Such (especially in addition) can also be checked in the context of the use of the action plan (in particular again).

A particularly advantageous development of the method according to the invention provides that the action plan contains at least one steering measure to be implemented by means of wheel-selective braking and / or a steering system. It is preferred to implement steering measures by wheel-selective braking, after then no dependence of the availability of an electrically driven steering system, which may also be affected by the error, is necessary. However, such may of course also be included in the process of the invention. The impression of steering moments in the movement of a motor vehicle by means of wheel-selective braking is already known in the prior art and does not need to be explained in detail here. However, such a functionality can be used particularly advantageously in the context of the present invention so that a direction correction, for example to keep a currently traveled lane or to change to an adjacent traffic lane, for example a hard shoulder, can be generated by the brake system itself by wheel-selective or page-individual braking interventions are implemented via the components of the brake system.

It is, as already indicated, expedient if the steering measures are determined as a function of a further course of a traffic lane traveled by the motor vehicle as described by environmental data. This again clearly shows how advantageous it is to keep the action plan constantly up-to-date, since in this way it can be avoided, for example, that the motor vehicle leaves the current traffic lane when transferring to the safe state or even a target traffic lane, for example a hard shoulder not reached.

The emergency module can be realized by suitable sub-functions. In a particularly advantageous embodiment, it can be provided that an error is detected by the emergency module in a diagnosis subfunction and / or in an action plan management sub-function of the emergency module at least one of the concrete execution of the action plan determining execution parameters is determined and / or in a conversion subfunction of the braking measures of the action plan to be used as output parameters of the emergency module to be used control parameters for at least one brake component of the brake system. It can therefore be an appropriate subdivision of the emergency module in sub-functions, which can also be referred to as sub-modules and can be realized by different hardware and / or software components, which support certain specific functionalities.

Thus, first of all, a diagnostic sub-function may be provided which is necessary for determining whether an error has occurred. Only then, if there is an error, an action plan management sub-function can be called, which is particularly true, which will be discussed in more detail below, if the specific execution of the action plan are defined in more detail by further execution parameters should. Finally, a conversion sub-function can be provided which converts the brake measures, which may still be abstractly present in the action plan, into corresponding output parameters which can be used, for example, for interfaces for controlling the brake components of the brake system. The diagnostic sub-function can also be used as part of a plausibility check, which means that it can be checked, for example by exchanging data with the brake module, whether the activation of the emergency module was correct. Overall, this results in a well-maintainable overall structure of the emergency module.

In a particularly preferred embodiment, it may be provided that a fault type of the present error is detected in the diagnosis subfunction, whereupon the action plan management subfunction selects one of a plurality of execution variants of the action plan contained in the action plan and / or adapts and / or adjusts the action plan depending on the type of error selects an output destination for output parameters to be output. The basic idea here is that if the type of error of the error occurred is known, the action plan or the operation of the emergency module can also be adapted to the nature of the error case and thus the best possible implementation of the action plan is realized. This will be explained in more detail by way of examples.

Thus, it can be provided that, in the event of a failure of an input data for a sensor in the error-free operating phase controlling the operation of the brake system controlling brake module and / or a communication link to the brake module as the output target downstream of the signal processing subfunction of the brake module is selected, in particular the output parameters are determined and output directly by the action plan management subfunction. If, for example, an error is not present in the brake module itself, whose functions can be realized, for example, in the control unit controlling the operation of the brake system during the fault-free operating phase, subfunctions of the brake module would continue to be advantageously used as long as it is supplied with suitable data. If, for example, a communication connection usually delivers intentional braking delays from the driver assistance system, these braking delays can also be supplied by the emergency module using the action plan, where expediently no conversion into activation parameters has to take place, but the braking delay of the action plan is directly linked to a corresponding subfunction of the emergency function Brake module can be delivered, which then advantageously still can perform its other functions. In another embodiment, it is also conceivable to store sensor data in the action plan so that the last sensor data available during the determination of the action plan can be present in it and, if appropriate, also forwarded to the brake module. Thus, despite a communication failure or sensor failure still a large part of the usual functions of the brake system still exist and can be used only with a changed data source, since corresponding input data are now provided by the emergency module. It should be noted at this point that at each system shutdown or any system limit of the fully automatic, trained for independent vehicle management driver assistance system such an error for the brake system can be generated, which then also triggers the consequences mentioned here after the driver assistance system as a source of braking delays and can be replaced by the emergency module.

Another expedient embodiment, which can of course be used in combination with the aforementioned example, provides that when an error detected failure of the brake module as an output destination output parameter of the brake module receiving interface and / or at least one brake component of the brake system is selected, in particular the Output parameters of the emergency module are determined by the conversion subfunction. Thus, if the brake module itself has failed, it is no longer available as an output destination, so that the implementation sub-function can be used particularly expediently in order to achieve the output goals which are appropriate here, ie suitable interfaces for receiving control parameters or even the components of the brake system itself, to control accordingly.

As has already been briefly indicated, there are various possibilities of controlling brake components of a brake system, for example for wheel or at least part-selective brakes or else for the usual braking operation. A wheel-selective braking allows partially only lower braking delays, but in addition the possibility of a steering influence. Consequently, different action plans may be suitable for different activation variants, so that expediently, different implementation sub-functions may also be provided for these activation variants. Thus, an advantageous embodiment of the invention that a trained for a brake with all wheels and trained for a wheel-selective braking implementation subfunction are used, the latter also may be referred to as a "lateral dynamic interface".

A further advantageous embodiment of the present invention provides that at least one communication from and to the emergency module takes place via a communication connection assigned only to the emergency module. It is therefore expedient to further safeguard the functionality of the emergency module to provide special communication connections that are independent of other communication connections of the motor vehicle, in particular of a bus system of the motor vehicle, and thus can also be used in case of failure of the usual communication system of the motor vehicle. Suitably, these are not only suitable for the emergency module can receive data, but in particular also that a possibility for controlling the brake components of the brake system is ensured by the emergency module. Thus, the emergency module independent communication facilities for the transmission of data are assigned.

In addition to the method, the present invention also relates to a motor vehicle, comprising a brake system and at least one control device designed for operating the brake system, which is designed to carry out the method according to the invention. All embodiments of the method according to the invention can be analogously transferred to the motor vehicle according to the invention, with which therefore also the stated advantages can be obtained. In particular, the control device can thus be formed by at least one control device, which carries out the steps of the method according to the invention. It is particularly advantageous if, as described, the motor vehicle comprises a brake control unit which has two functional units, namely a control unit to be used in the fault-free operating phase for operating the brake system, the brake module designated in the subclaims, and an additional control unit which is the emergency module realized. The additional control unit is advantageously associated with an energy source, which feeds the additional control unit in case of failure of the other electrical power supply of the motor vehicle.

Further advantages and details of the present invention will become apparent from the embodiments described below and with reference to the drawing. Showing:

1 a schematic diagram of a motor vehicle according to the invention,

2 a flow chart of the method according to the invention, and

3 a drawing for interaction of the functional components and modules of the present invention.

1 shows a schematic diagram of a motor vehicle according to the invention 1 , The car 1 has a fully automatic driver assistance system designed for independent vehicle guidance 2 on, in which in a control unit 3 Operating parameters of the motor vehicle are evaluated to corresponding request data for other vehicle systems, here not shown in detail steering system, not shown in detail engine control system and a brake system 4 to generate the fully automatic operation of the motor vehicle 1 enable. For example, to the brake system 4 or its control unit 5 via a vehicle bus 6 , For example, a CAN bus, as a communication link sent a brake delay request.

As input data, the driver assistance system processes sensor data of various sensors as well as data of other vehicle systems which describe the operating state of the motor vehicle (ego parameters) and / or the surroundings of the motor vehicle 1 describe (environmental parameters). Fully automatic driver assistance systems designed for independent vehicle guidance have already been proposed in the prior art and will not be described in detail here.

That of the driver assistance system 2 sent brake delay request is from a control unit 7 the brake control unit 5 receive, where it is used in error-free operation, to implement various functions different, not specified here brake components 8th of the brake system 4 via appropriate control parameters (manipulated variables) to control. The entire functions / sub-functions that make up the braking system 4 is operated in error-free operating phases, will be referred to collectively hereinafter as the brake module, that is, the control unit 7 implements the sub-functions of the brake module.

An exemplary construction of the brake system 4 or its operating levels will be briefly explained below. The brake module, which is controlled by the control unit 7 is realized, may have a subfunction for signal processing, are processed in the received data accordingly. An adaptation function determines therefrom, if appropriate on the basis of transmitted data modified, setpoint values for the vehicle movement, for example taking into account the yaw rate, the slip angle and the like. Central content of the brake module is a regulation for the vehicle movement itself, from which the concrete Control parameters emerge, which then via an interface to downstream, not in the control unit 7 contained control circuits can be output. Such downstream controllers may be, for example, a brake slip control and a traction control, which are implemented via their own hardware and / or software components. A setpoint for the brake slip and setpoints for the traction slip and the locking torque are passed on to the brake slip control and the traction control system respectively. Subordinate to the actually executing components, for example, still a hydraulic and power model, from which then the actual control values for valves, pumps and other brake components 8th It should be noted that, of course, also influence on the engine torque of in 1 the clarity not shown drive motor of the motor vehicle 1 can be taken. Thus, various functions can be realized, with full functionality of the brake system 4 , so in error-free operation, first the function of electronic stability control (ESC).

If certain errors now occur, it is generally known the operation of the brake system 4 to degrade in stages over certain fallback levels ("ESC degradation"). If, for example, signal errors, vehicle electrical system errors, plausibility errors or communication errors occur, the ESC full system degrades to an ABS fallback level, which still provides the functions of the anti-lock braking system (ABS) and electronic brake force distribution (EBV). If there is now also a signal error of the speed sensor or a voltage dip below 7 V, the next fallback level is the EBV fallback level, in which only the electronic brake force distribution is made available. Further errors lead to the fact that only the mechanical fallback level exists, thus a brake actuation takes place solely on the basis of the mechanics actuated by the driver.

But now it is the driver assistance system 3 active, the driver is no longer directly available as a fallback, because he does not necessarily devote his attention to the driving task, so that the driver should be given a time window within which the motor vehicle 1 safely continue to operate, but the full functionality of the braking system 4 or this input data supplying vehicle systems is no longer given. For this purpose, it is provided that the motor vehicle 1 is spent in a safe and comfortable way to a standstill on its own lane or an adjacent hard shoulder.

In order to realize this as independently as possible from the errors that may occur, it is now initially provided that the control unit 3 is designed to, in a fault-free operating phase of the brake system 4 to determine a braking action in a timely action (delay profile) comprehensive action plan. This action plan, when performed, leads to the safe state of the motor vehicle 1 cause. It is determined as a function of at least a part of the said operating parameters, comprising the ego parameters and the environmental parameters, and then kept up-to-date, for example, at specific time intervals for the current situation of the motor vehicle 1 customized. The current action plan is via the vehicle bus 6 or a dedicated communication link to the controller 5 transferred, there concretely an additional control unit 9 that implements the function of an emergency module. In the control unit 9 becomes the current action plan in a storage means 10 stored.

If an error occurs, the emergency module takes over at least partially the control tasks of the previously described brake module, wherein, in the event of failure of an electrical power supply of the motor vehicle 1 to realize the additional control unit 9 (and only this) an electrical energy source 11 assigned. The emergency module controls the braking system 4 when an error occurs using the current, in the storage means 10 reserved action plan such that the motor vehicle 1 is spent in the safe state.

Thus form the controller 3 and the controller 5 a control device that realizes the inventive method.

A concrete embodiment of the method according to the invention will now be described with the aid of 2 and 3 be explained in more detail.

2 shows a schematic flowchart of the method according to the invention. The curly bracket symbolizes 12 the error-free phase of operation, the curly bracket 13 the error case.

In one step 14 the action plan is determined or updated, for which purpose the operating parameters intended for this purpose are observed. In addition to the operating parameters, the determination of the action plan also includes safety criteria and requirements criteria, so that a driving maneuver is ultimately described by the action plan, the safety related and other requirements, such as performance capabilities of the braking system 4 , Comfort requirements and legal requirements may be sufficient type the stoppage of the motor vehicle 1 brought about by observing the operating parameters on the current situation of the motor vehicle 1 is turned off. It should be noted that in addition to the braking measures (and / or described by braking measures), the action plan may also include steering measures taken either by the braking system 4 in itself or by driving a steering system can be met, for example, if during the transfer to the safe state, the current lane of the motor vehicle is to be held or on another track, such as a hard shoulder to be directed, it being preferred according to the invention to dispense with the control of a steering system, as this could also be affected by the or an error. After the emergency module in the brake control unit 5 is realized, it is ultimately already "on site" to the brake components 8th head for.

The exact determination of such an action plan is not described here, as in the prior art, a variety of variants and procedures for determining such a driving maneuver are known, which will not be discussed here in detail.

The action plan, which is obtained as a result, for example, a cascading intensifying braking on the current lane, is in its updated version in one step 15 to the additional control unit 9 transferred and in the storage means 10 filed after passing through the control unit 3 of the driver assistance system 2 was determined. Sets the normal, error-free operating phase according to the curly brace 12 Continue, schematically displayed check in step 16 , the update of the action plan and the transmission of the current action plan continue.

However, if an error occurs, it will be in one step 17 the emergency module is active and executes the action plan from the storage means 10 out.

This and the existing options should by 3 be explained in more detail.

It puts 3 a purely functional representation is, where, as already indicated, sub-functions of the brake module 10 in the control unit 7 be realized, sub-functions of the emergency module 19 within the additional control unit 9 ,

The emergency module 19 now has a diagnostic subfunction 20 which ultimately monitors whether an error has occurred, the functionality of the braking system 4 affects, and if so, also determines a type of error, which then to an action plan management sub-function 21 is forwarded. The action plan management subfunction has access to the type of error and the action plan in the storage means 10 , which according to the arrow 22 from the controller 3 was received, and now determines certain execution parameters that describe how the emergency module 19 the action plan is actually implemented with the type of error now present.

It should first be noted that the action plan may contain several variants that are assigned to different types of errors to be able to adequately respond to different errors, in which case the action plan management sub-function selects the variant corresponding to the type of error. It is also conceivable to adapt the action plan, if it exists only in one variant, depending on the type of error. For example, it can be distinguished whether a steering system of the motor vehicle 1 is still controllable, with a variant that also contains steering measures for the steering system, can be discarded when the steering system is no longer available, for example, in a complete failure of the electrical power supply of the motor vehicle 1 ,

On the other hand, the action plan management subfunction selects 21 also the concrete mode Operandi of the emergency module 19 , here the output destination and the form of the output parameters that the emergency module 19 generated. For example, if there is an error, the brake module 18 merely refuses necessary input data, such as a failure of the driver assistance system 2 or the communication link, here the vehicle bus 6 , the output destination may be a subfunction 23 of the brake module 18 be that of a signal processing subfunction 24 of the brake module 18 is subordinate. In this case, as output parameters, here directly from the action plan management subfunction 21 , compare arrow 25 , the subfunction 23 exactly the input parameters are supplied, for example a brake delay request, otherwise the signal processing subfunction 24 would have delivered. It will be in this way still most of the beneficial features of the brake module 18 , in particular largely the electronic stability control received.

However, the error affects a complete failure of the brake module 18 (Concretely, the control unit 7 ), becomes a conversion subfunction 26 of the emergency module 19 used to derive control parameters from the action plan as output parameters that are in the format of the output values of the brake module 18 correspond and to a the brake module 18 downstream regulator circle 27 be given via an appropriate interface, arrow 28 , This may, in principle, be the utilization of the ABS fallback level described above or the EBV fallback level described above that still exist. The output parameters of the emergency module become 19 So delivered to the top functional component of the corresponding fallback level, it should be noted that in more serious failures also an immediate control of the brake components 8th the braking system is possible, arrow 29 , Corresponding output destinations and the format of the output parameters are provided by the action plan management subfunction 21 selected. Accordingly, the implementation subfunction is used.

Here is the implementation subfunction 26 is designed such that it determines the output parameters in response to a wheel-selective control, that is, a braking operation can be performed rad- or partselektiv to impart to the motor vehicle such a steering torque, which can serve to keep the currently traveled lane or on an adjacent Lane, for example, a hard shoulder to change. Corresponding measures are already included in the action plan. However, since the maximum braking deceleration is reduced in such a wheel-selective brake control, it can be provided in other embodiments of the present invention that for a complete braking with all wheels another implementation sub-function is realized.

It should be noted at this point, which is not shown in detail in the figures here that for the emergency module 19 realizing control unit 9 It is also possible to provide own communication devices, for example separate lines to components to which the output parameters can be forwarded, but also a separate communication link to other vehicle systems, for example the driver assistance system 2 if communication even in case of failure of the vehicle bus 6 still be possible. This provides further protection.

Claims (14)

Method for operating a brake system ( 4 ) in a driver assistance system designed for fully automatic, independent vehicle guidance ( 2 ) having motor vehicle ( 1 ), characterized in that in a fault-free operating phase of the brake system ( 4 ) a safe state of the motor vehicle ( 1 ), in particular the standstill, bringing about, braking measures in a timely sequence comprehensive action plan as a function of operating parameters, comprising at least one of the current operating state of the motor vehicle ( 1 ) descriptive Egoparameter and / or at least one the environment of the motor vehicle ( 1 ) and constantly updated on the basis of current operating parameters, the respective current action plan being stored in a storage means ( 10 ) and that by an emergency module ( 19 ) in the event of a fault of the brake system ( 4 ) the car ( 1 ) is placed in the safe state using the current action plan. Method according to Claim 1, characterized in that the storage and / or use of the action plan in one of the functions of the braking system ( 4 ) implementing control unit ( 7 ) independent additional control unit ( 9 ) he follows. A method according to claim 2, characterized in that a in a control unit ( 5 ), in particular an ESC control unit ( 5 ), for the braking system ( 4 ) built-in additional control unit ( 9 ) is used and / or the additional control unit ( 9 ), at least when using the action plan, with only the supplementary control unit ( 9 ) associated energy source ( 11 ) is supplied. Method according to claim 2 or 3, characterized in that the additional control unit ( 9 ) also one of the functions of the brake system ( 4 ) implementing control unit ( 7 ) used interface for the output of manipulated variables for the realization of the action plan. Method according to one of the preceding claims, characterized in that the action plan by the driver assistance system ( 2 ) and / or on the safety of the motor vehicle ( 1 ) and / or at least one other road user related safety criterion and / or at least one further requirements descriptive requirement criterion are taken into account Method according to claim 5, characterized in that by the emergency module ( 19 ) at least one safety criterion and / or requirement criterion is checked again and / or at least one additional criterion, in particular a maximum permissible braking deceleration. Method according to one of the preceding claims, characterized in that the action plan contains at least one wheel measure to be implemented by wheel-selective braking and / or a steering system. A method according to claim 7, characterized in that the steering measure in response to a further environment described by environment Course one of the motor vehicle ( 1 ) traffic lane is determined. Method according to one of the preceding claims, characterized in that by the emergency module ( 19 ) in a diagnostic subfunction ( 20 ) an error is detected and / or in an action plan management subfunction ( 21 ) of the emergency module ( 19 ) at least one execution parameter determining the concrete execution of the action plan is determined and / or in an implementation subfunction ( 26 ) from the braking measures of the action plan as output parameters of the emergency module ( 19 ) to be used for at least one braking component ( 8th ) of the braking system ( 4 ) be determined. Method according to claim 9, characterized in that in the diagnostic subfunction ( 20 ) an error type of the present error is detected, whereupon the action plan management subfunction ( 21 ) selects one of a plurality of execution plans of the action plan contained in the action plan depending on the type of error and / or adapts the action plan and / or an output target for by the emergency module ( 19 ) selects output parameters. Method according to Claim 10, characterized in that in the event of a failure of an input data determined as an error for a fault-free operating phase, the operation of the brake system ( 4 ) controlling brake module ( 18 ) and / or a communication link to the brake module ( 18 ) as the output destination downstream of the signal processing subfunction ( 23 ) of the brake module ( 18 ), in particular the output parameters being derived directly from the action plan management subfunction ( 21 ) and / or in the event of a failure of the brake module identified as an error ( 18 ) as the output destination an output parameter of the brake module ( 18 ) receiving interface and / or at least one brake component ( 8th ) of the braking system ( 4 ), in particular the output parameters of the emergency module ( 19 ) by the implementation subfunction ( 26 ). Method according to one of claims 9 to 11, characterized in that one for a brake with all wheels and one designed for a wheel-selective braking conversion subfunction ( 26 ) be used. Method according to one of the preceding claims, characterized in that at least one communication from and to the emergency module ( 19 ) via only the emergency module ( 19 ) assigned communication connection takes place. Motor vehicle ( 1 ) comprising a braking system ( 4 ) and at least one for operating the brake system ( 4 ) formed control device, which is designed for carrying out a method according to one of the preceding claims.

Images