GB2443921A

GB2443921A - Fail-safe hydraulic braking system

Info

Publication number: GB2443921A
Application number: GB0721591A
Authority: GB
Inventors: Keith Lawrence Holding; Alan Leslie Harris
Original assignee: TRW Ltd
Current assignee: TRW Ltd
Priority date: 2006-11-02
Filing date: 2007-11-02
Publication date: 2008-05-21
Anticipated expiration: 2027-11-02
Also published as: GB0621849D0; GB2443921B; GB0721591D0

Abstract

A fail-safe braking apparatus comprises a brake pressure generator 200 which includes a brake pedal operable by a driver of a vehicle to indicate a driver demanded braking force, one or more friction brakes, a first system and a second system. The first system and the brake pressure generator 200 comprising a braking system of the brake by wire type which applies a pressure to the brakes in response to the driver demand applied to the brake pedal, the braking system having a mechanical push through mode for application of pressure to the brakes in the event of a failure of the braking system. The second system comprising an auxiliary safety system that determines a brake pressure to be applied to the brakes of the vehicle to enhance control of the vehicle, failure identifying means for identifying a failure of at least a part of the first system and a controller. The controller in the event of a failure of at least a part of the first system is adapted to employ functionality from the second system to provide a fail safe such that braking force dependent on the driver demand is applied to the brakes of the vehicle without the first system entering the push through mode. In another embodiment the invention relates to a brake pressure generator with a second driver brake demand measuring device.

Description

FAIL-SAFE HYDRAULIC BRAKING SYSTEM

The invention relates to fail-safe brake systems for vehicles of the kind in which a hydraulic brake pressure generator is used to activate the wheel brakes of a vehicle in order to achieve a deceleration according to the drivers demand. The brake pressure generator comprises a brake force generator, a hydraulic servo pressure source and an incorporated hydraulic master cylinder on which the generated brake force acts to create a hydraulic brake pressure which in turn is used to activate the frictional wheel brakes.

The brake pressure generator comprises an input element which is connected to the brake pedal, a housing and a primary piston displaceable in the housing, wherein the primary piston together with the housing encloses a primary chamber of a master cylinder for generation of a hydraulic brake pressure, a pedal simulation device connected to the force input element, a pedal actuation detection device for detecting a pedal actuation along the main axis and an force generating device for exerting an actuating force on the primary piston, wherein during normal operation the force input element is mechanically uncoupled from the primary piston. The force generating device in accordance with the detected pedal actuation exerts an actuating force on the primary piston wherein in the* event of a failure of the force generating device the force Input element Is * S..

mechanically connectable to the primary piston. *.... * S

In the unlikely event that the electronic control or servo-power assistance : components fail it is a requirement to still be able to provide a pressure to the friction brakes even without the assistance of the force generating device. In particular, even without the hydraulic or pneumatic servo-power assistance or without the electronic sensor elements working, a braking operation must still be able to be carried out. In such an event the brakes must allow a direct mechanical coupling between the brake pedal and the hydraulic brake circuit to allow a direct mechanical "push-through" to initiate a brake operation using the power of the drivers foot.

Such brake pressure generators are known for example out of the US

specification US 2006/0048512.

According to a first aspect the invention provides a fail-safe braking apparatus for a vehicle comprising; a brake pressure generator which includes a brake pedal operable by the driver of the vehicle to indicate a driver demanded braking force; one or more friction brakes; a first system and a second system, the first system when combined with the brake pressure generator comprising a braking system of the brake by wire type adapted to apply a pressure to the brakes in response to the driver demand applied to the brake pedal, the braking system having a mechanical push through mode for application of pressure to the brakes in the event of a failure of the braking system, the second system comprising an auxiliary safety system that is adapted to determine a brake pressure to be applied to the brakes of the vehicle to enhance control of the vehicle, failure identifying means for identifying a failure of at least a part of the first system; and a controller which in the event of a failure of at least a part of the first system is adapted to employ functionality from the second system to . : provide a fail safe such that braking force dependent on the driver *:*: demand is applied to the brakes of the vehicle without the first system entering the push through mode.

It is therefore possible that a single point failure in an above described first system, the braking system, does not force the brake pressure generator into a failure mode where only a "push-through" activation of the wheel brakes is possible. This is possible because the second system provides a back up and gives redundancy.

The second system may comprise an electronic stability control system or slip control system (ESP/SCS) which is adapted in normal use to apply pressure to one or more of the brakes to assist in maintaining stability of the vehicle. In the back up mode, the second system may operate independently of the first system to apply brake pressure according to the drivers demand. In this mode, the second system may effectively switch roles and function as a normal brake system in place of the first system.

A warning signal may be issued to the driver to alert them of the failure of the first system.

In another arrangement, both the first system and the second system may comprise individual brake systems when combined with the brake pressure generator, each system proving back up to the other and being fed with information from the shared brake force generator and having the ability to apply the brakes to each wheel of the vehicle.

Unlike prior art systems in which the brakes are split such that one circuit * *.

operates two brakes, and the other the remaining two, (typically each pair comprising one front and one rear brake) the invention may provide duplicate systems for controlling the same wheels. Thus, if the first system will normally apply braking to all wheels then in the event of a failure the second system can take over and apply braking to all the *:*. wheels. Thus, in the event of a failure no apparent compromise of braking performance needs to be made. This is not as preferred as using an alternative system such as ESP as a back up as it results in duplicated components which are not useful in any other time than a failure.

The first and second systems may include one or more valves connecting the brakes to a source of pressurised fluid, the valves being operated under control of a controller provided for each of the first and second systems. In the event of a failure of the controller of the first system, the controller of the second system may provide the braking functionality of the first system.

The first and second systems may include a respective device for measuring the brake demand made by the driver. Each device may be provided from a separate power supply. The devices may produce an output signal that varies continuously over a range of values as a function of the brake demand made by the driver, typically as a function of pedal position or pedal force.

In normal use the first system may employ the output of its respective device to determine the driver brake demand. In the rare event of a failure of the measuring device of the first system the output from the measuring device of the second system may be used as an alternative.

Alternatively, rather than the controller of the first system using signals * .1 from the device of the second system, the second system may be * S. instructed to perform the role of the first system. * *

One device may comprise a pedal travel sensor that determines how far the pedal has travelled when depressed by a driver. The other may ::.:1 comprise a pedal force sensor that measures the force applied to the pedal * 30 by the driver. Alternatively, they may both comprise pedal travel sensors or force sensors.

Each system may also include a respective pressure sensor. Each sensor may be operated independently, perhaps from its own power supply. It may measure that pressure of the brake fluid at the brakes.

Each of the first and second systems may include an electronic processor or controller which determines the force to be applied to the brakes as a function of the driver demand. The controller may generate one or more signals which are used to control one or more valves that regulate the flow of pressurised fluid to the brakes.

Both the first and second systems may be independent electrically. They may, for example, be connected to a common power supply through independent wiring. They may be connected to separate power supplies.

In this case the apparatus will include more than one battery.

By making these two sub-systems independently supplied with electrical power from two independent electrical supplies, a single point failure will not cause immediate loss of boost Preferably, the first system and second system are also adapted to provide a measure of a drivers braking force demand independently. Each system may include a sensor that measures the demand. The sensors may detect movement of the brake pedal, and may be position sensors. They may * 25 comprise potentiometers on linear displacement transducers. Again, this duplication avoids common mode failures.

* ,.I.S * * To achieve this, the invention guarantees that loss of one electrical supply *:*. will still enable an acceptable driver demand signal to be provided to the remaining brake system. Such an acceptable (i.e. safe and controllable) driver demand signal requires at least one proportional signal (could be either pedal force or pedal travel) and one validation signal (could be a switch or a second proportional signal) to remain active if one electrical supply fails. Additionally the acceptability requires that the proportional and validation for the two channels should use different technology.

Each of the first and second systems may be connected to independent CAN networks fitted to the vehicle. By CAN network we mean a signal bus that enables differing parts of each system to communicate with one another.

Each system may include a validation switch that enables the function of the respective driver demand systems to be validated. Again these may operate across separate CAN buses and from separate supplies.

The apparatus may include a brake pressure generator which comprises an input element which is connected to a brake pedal, a housing and a primary piston displaceable in the housing, wherein the primary piston together with the housing encloses a primary chamber of a master cylinder for generation of a hydraulic brake pressure, a pedal simulation device connected to the force input element, a driver brake demand measuring device for detecting a pedal actuation along the main axis and a pedal force generating device for exerting an actuating force on the primary piston, wherein during normal operation the force input element is mechanically uncoupled from the primary piston. * 25 S...

The force generating device in accordance with the detected pedal * **.

* actuation exerts an actuating force on the primary piston wherein in the event of a failure of the force generating device the force input element is * .* driver brake demand measuring device may be provided according to the 30 invention for each of the first and second systems.

According to a second aspect the invention provides a brake pressure generator which comprises an input element which is connected to a brake pedal, a housing and a primary piston displaceable in the housing, wherein the primary piston together with the housing encloses a primary chamber of a master cylinder for generation of a hydraulic brake pressure, a pedal simulation device connected to the force input element, a first driver brake demand measuring device for detecting a pedal actuation along the main axis and a pedal force generating device for exerting an actuating force on the primary piston, wherein during normal operation the force input element is mechanically uncoupled from the primary piston, characterised by further including a second driver brake demand measuring device for detecting a pedal actuation along the main axis.

The first and second driver demand measuring devices may comprise pedal travel sensors or they may comprise pedal force sensors. They may each be connected to a separate power supply so that if one supply fails at* least one sensor remains functional. They may provide an output that varies as a function of driver demand. This may vary linearly or exponentially across a range of values.

One of the driver brake demand measuring devices of the brake force generator may comprise a validation switch which may provide a binary indication of whether or not the driver is making a demand by depressing *. 25 the pedal. This may be used to validate the other sensor output.

I

* Of course, where two pedal travel sensors are provided the device may further include a first validation switch and a second validation switch, each switch providing an output that changes state on initial operation of 30 the brake pedal such as to provide a signal which can be used to validate the output of each of the first and second driver demand measuring devices.

A first measuring device and the first validation device may be connected to a common power supply, and the second measuring device and the second validation device may be connected to a second, different, power supply.

According to a third aspect the invention provides a method of processing signals in a brake apparatus according to the second aspect of the invention comprising using the output of the second driver brake demand measuring device to validate the output of the first driver brake demand measuring device.

There will now be described, by way of example only, two embodiments of the present invention with reference to and as illustrated in the accompanying drawings of which: Figure 1 shows the proposed hydraulic braking system. the electrical supply connections and the interaction with the vehicle CAN network.

Figure 2 shows a first proposed safety architecture Figure 3 shows a second proposed safety architecture S...

* * 25 S...

The arrangement of a fail safe braking apparatus for a vehicle shown in *.S...

* Figure. 1 comprises a brake pressure generator 1 consisting of a brake force generator 200, an incorporated master cylinder 205 and a servo *:*. pressure source 300.

S

S S *S

The brake force generator 200 comprises a housing 214 in which the input piston 204 extends which is connected to a not shown conventional brake pedal. The input piston 204 comprises input force sensor means 201 electrically connected to ECU 206 to detect the applied foot-force of the driver.

Furthermore the input piston 204 is operatively connected to the damping device 203 which is moveably fitted into the housing 214 and used to damp the input movement to create together with the pedal simulation device 202 a specified pedal-feel in order to give the driver the feeling that he is actuating a known standard braking device. The use of the pedal simulation device 202 together with the damping device 203 allows disconnecting the drivers input from the generation of brake force under normal braking conditions.

The pedal simulation device 202 comprises a piston where the end face built-up one wall of the following servo pressure chamber 211 while the other wall is built-up by the end face of the primary piston 213.

Like in any other conventional tandem master cylinders in front of the end face of the primary piston 213 a primary pressure chamber 212 is defined bordered by a secondary piston defining in front of its opposite end face a secondary pressure chamber. Both pressure chambers * *S comprising compensation ports connected to a fluid reservoir 307 and * 25 output ports connected to a two channel brake circuit where a slip control system 3 controls the behaviour of the attached wheel brakes 4. *..*.

S S

To pressurise the servo pressure chamber 211 of the brake force generator 200 a servo pressure source 300 is used delivering a hydraulic *:*. 30 servo pressure.

To create the hydraulic pressure, the servo pressure source 300 comprises a pressure pump 301 delivering fluid into the servo power supply line controlled by the solenoid valves 305,306. The pressure sensor 304 detects thereby permanently the hydraulic pressure in the hydraulic power supply line.

Additionally an accumulator 302 is used and connectable to the power supply line to store fluid pressure when the solenoid valve 303 is switched Into an open position In order to support at the very beginning the pressure built-up in the power supply line (prior art gives more

detailed description).

Furthermore the servo pressure source 300 power supply line is connected to the servo pressure chamber 211 in order to actuate the primary piston 213 to create a brake pressure in the output lines of the master cylinder 205 for brake operation.

To detect the movement of the input piston 204 the brake force generator comprises travel sensor means 207 detecting the movement of the damping, device 203 to which a permanent magnet is fixed, generating a position signal in the travel sensor 207. Additionally two electric switches 208, 209 are located with in or in the near of the travel sensor 207 able to receive the magnetic field input from the above described permanent magnet where one electric switch 208 is located after the other electric switch 209 and where a signal of the first electric switch 208 is generated when a deceleration of approx. 0,02g has been reached and where a signal *..

* of the second electric switch 209 is generated when a deceleration of approx. 0,2g has been reached. ** S * ** * .5 ** S * a * a *S

Additionally a pressure sensor 210 is located at the brake force generator detecting the pressure in one brake circuit generated by the master cylinder 205.

The brake pressure generator 1 comprises furthermore two electronic controllers, shown as control units 5, 206 where the electronic control unit 5 controls the servo pressure source 300 and where the electronic control unit 206 controls the brake force generator 200. Both electronic control units 5, 206 communicates via the electronic vehicle CAN network using the CAN connection line 15, 17, 18.

Two independent electrical power supplies 6, 7 are available to feed the electronic control units 5, 206, the integrated sensing means and the servo pressure source 300 as well as the slip control system 3.

A first proposed fail-safe architecture is shown in Figure 2 using two independent controllers or micro-processor units mPl and mP2 each separately connected to the independent electrical supplies 1 and 2.

The first micro-processor unit mPl receives a first proportional input i.e. from the travel sensor 207 out of Fig. 1 and a validation signal i.e. from a electric switch 208 and generates corresponding control signals to be send into a first line (CAN-i) of the connected vehicle CAN network. * ** * * S * ** I...

The second micro-processor unit mP2 receives a second proportional * input i.e. from the travel sensor 207 out of Fig. I., a validation signal i.e. *S**SS * from a electric switch 209 and signals from the pressure sensor 210 and generates corresponding control signals to be send into a second line (CAN-2) of the connected vehicle CAN network.

If electric supply-2 fails the brake pressure is obtained from the pressure sensor of the slip control system 3 because the slip control system 3 is supplied via electrical supply 1.

A second proposed architecture is shown in Figure 3 of the accompanying drawings and uses two independent micro-processor units mPl and mP2 each separately connected to the independent electrical supplies 1 and 2.

The first micro-processor unit mPl receiving a first proportional input i.e. from the travel sensor 207 out of Fig. I and a validation signal i.e. from a electric switch 208 and generates corresponding control signals to be send into a first line (CAN-i) of the connected vehicle CAN network.

The second micro-processor unit mP2 receiving a second proportional input i.e. from input force sensor 201 out of Fig. 1, a validation signal i.e. from a electric switch 209 and signals from the pressure sensor 210 and generates corresponding control signals to be send into a second line (CAN-2) of the connected vehicle CAN network.

If electric supply-2 fails the brake pressure is obtained from the pressure sensor of the slip control system 3 because the slip control system 3 is supplied via the independent electrical supply-i.

S...:. To increase the safety furthermore the pressure sensor 210 can be connected to one brake circuit while the pressure sensor of the slip control system 3 is connected to the other brake circuit.

* ..:*: * * * . S -* *S ** S S * * S *S

Claims

1. A fail-safe braking apparatus for a vehicle comprising; a brake pressure generator which includes a brake pedal operable by the driver of the vehicle to indicate a driver demanded braking force; one or more friction brakes; a first system and a second system, the first system when combined with the brake pressure generator comprising a braking system of the brake by wire type adapted to apply a pressure to the brakes in response to the driver demand applied to the brake pedal, the braking system having a mechanical push through mode for application of pressure to the brakes in the event of a failure of the braking system, the second system comprising an auxiliary safety system that is adapted to determine a brake pressure to be applied to the brakes of the vehicle to enhance control of the vehicle, failure identifying means for identifying a failure of at least a part of the first system; and a controller which in the event of a failure of at least a part of the first system is adapted to employ functionality from the second system to provide a fail safe such that braking force dependent on the driver demand is applied to the brakes of the vehicle without the first system *::: entering the push through mode.

2. A fail-safe braking apparatus according to claim 1 in which the second system comprises an electronic stability control system or slip * control system (ESPISCS) which is adapted in normal use to apply pressure to one or more of the brakes to assist in maintaining stability of *:*. the vehicle. ** S

* .. 30 * **

3. A fail-safe braking apparatus according to claim 2 in which in the event of a failure of at least part of the first system, the second system operates independently of the first system to apply brake pressure according to the drivers demand.

4. A fail-safe braking apparatus according to claim I or claim 2 in which both the first system and the second system comprise individual brake systems when combined with the brake pressure generator, each system proving back up to the other and being fed with information from the shared brake force generator and having the ability to apply the brakes to each wheel of the vehicle.

5. A fail-safe braking apparatus according to any preceding claim in which the first and second systems include one or more valves connecting the brakes to a source of pressurised fluid, the valves being operated under control of a respective controller provided for each of the first and second systems and whereby in the event of a failure of the controller of the first system, the controller of the second system provides the braking functionality of the first system.

6. A fail-safe braking apparatus according to any preceding claim in which the first and second systems each include a respective device for measuring the brake demand made by the driver. * ** * * S * I* ***

7. A fail-safe braking apparatus according to claim 6 in which each device is provided with power from a separate power supply.

8. A fail-safe braking apparatus according to claim 6 or 7 in which at least one of said devices comprises a pedal travel sensor that determines how far the pedal has travelled when depressed by a driver and another of said devices comprises a pedal force sensor that measures the force applied to the pedal by the driver.

9. A fail-safe braking apparatus according to claim 6 or 7 in which at both of said devices comprise pedal travel sensors or force sensors.

10. A fail-safe braking apparatus according to any preceding claim in which each system also includes a respective pressure sensor with each sensor being operated independently from its own power supply.

11. A fail-safe braking apparatus according to any preceding claim in which both the first and second systems are independent electrically.

12. A fail-safe braking apparatus according to any preceding claim in which both the first system and the second system are adapted to provide a measure of a drivers braking force demand independently.

13. A fail-safe braking apparatus according to any preceding claim in which each of the first and second systems are connected to independent CAN networks fitted to the vehicle.

14. A fail-safe braking apparatus according to any preceding claim in * which each system includes a validation switch that enables the function of the respective driver demand systems to be validated. S... * .

15. A fail-safe braking apparatus according to any preceding claim which further comprises a brake pressure generator which comprises an input element which is connected to a brake pedal. a housing and a primary piston displaceable in the housing, wherein the primary piston *..: 30 together with the housing encloses a primary chamber of a master cylinder for generation of a hydraulic brake pressure, a pedal simulation device connected to the force input element, a driver brake demand measuring device for detecting a pedal actuation along the main axis and a pedal force generating device for exerting an actuating force on the primary piston, wherein during normal operation the force input element is mechanically uncoupled from the primary piston.

16. A brake pressure generator which comprises an input element which is connected to a brake pedal, a housing and a primary piston displaceable in the housing, wherein the primary piston together with the housing encloses a primary chamber of a master cylinder for generation of a hydraulic brake pressure, a pedal simulation device connected to the force input element, a first driver brake demand measuring device for detecting a pedal actuation along the main axis and a pedal force generating device for exerting an actuating force on the primary piston, wherein during normal operation the force input element is mechanically uncoupled from the primary piston, characterised by further including a second driver brake demand measuring device for detecting a pedal actuation along the main axis.

17. A brake pressure generator according to claim 16 in which the first and second driver demand measuring devices respectively comprise either a pedal travel sensor or a pedal force sensors. * **

18. A brake pressure generator according to claim 16 or claim 17 in which each driver demand measuring device is connected to a separate * power supply so that if one supply fails at least one sensor remains functional.

19. A brake pressure generator according to any one of claims 16, 17 or 18 in which each driver demand measuring device produces a an output that varies continuously as a function of driver demand across a range of values.

20. A brake pressure generator according to claim 16 in which one of the driver brake demand measuring devices of the brake force generator comprises a validation switch which a provides a binary indication of whether or not the driver is making a demand by depressing the pedal.

21. A brake pressure generator according to claim 16 in which two pedal travel sensors or pedal force sensors are provided and which further includes a first validation switch and a second validation switch, each switch providing an output that changes state on initial operation of the brake pedal such as to provide a signal which can be used to validate the output of each of the first and second driver demand measuring devices.

22. A brake pressure generator according to claim 21 in which a first measuring device and a first validation device are connected to a common power supply, and a second measuring device and a second validation device are connected to a second, different, power supply.

23. A brake pressure generator substantially as described herein with reference to and as illustrated in the accompanying drawings. * **

24. A fail safe braking apparatus substantially as described herein with *.e.

reference to and as illustrated in the accompanying drawings. * ** 1 * * ** * * * * * ** ** S * S S * **