FOCUS ON THE FUTURE. MORE EFFICIENCY AND SAFETY, MAXIMUM PERFORMANCE AND OPTIMUM DRIVING PLEASURE.

The automotive industry is undergoing a disruptive process of change. In addition to the increasing market penetration of electric vehicles, various SAE levels of automated driving will be realized from level 3 (Highly Automated Driving, HAD) and level 4 (Fully Automated Driving, FAD) up to level 5 (Autonomous Driving, AD), with the requirements on passenger car brake systems increasing at each level of automation. This trend is also accelerating the development of new brake systems. After initial solutions [1, 2, 3] in 2005, the replacement of vacuum brake boosters by electro-mechanical brake boosters (e-boosters) started 2013 with the launch of so-called two-box solutions which included an electric follow-up booster together with an ESC unit [4], followed in a timely manner by the first integrated one-box systems with pedal simulator in 2017 [5]. Solutions for HAD are currently being developed for a planned market launch in 2021. The newly designed compact X-Boost brake booster, TITLE FIGURE, is currently being developed by the company LSP Innovative Automotive Systems GmbH in collaboration with partners to meet HAD requirements. The principal structure of this booster is explained here for the first time and compared with an established e-booster with follow-up control [4]. Some critical failure modes will be addressed. In addition, the relevant topics on reliability, diagnosis possibility and full and partial redundancies will be discussed.

A comparison is meant to illustrate the advantages and disadvantages of brake boosters of different types: FIGURE 1 (a) shows as system 1 the e-booster with follow-up control which is controlled by an electric motor based on the measurement of the difference between pedal tappet travel and piston travel. The system 1 uses elastic elements; its control system is described in [4, 6, 7]. It is currently available on the market as a two-box solution in combination with an ESC unit. FIGURE 1 (b) shows an e-booster with a pedal simulator, the X-Boost, as system 2. The e-booster is controlled by an electric motor based on the measurement of the pedal tappet travel. The electric motor acts on a piston-cylinder unit, which is situated parallel to the Master Cylinder (MC) of the brake. The MC includes an auxiliary piston with a hydraulic connection to a pedal simulator, as well as a secondary piston which separates the two brake circuits, balances the pressure and enables single circuit Pressure Supply (PS). Due to a smaller auxiliary piston diameter than that of the secondary piston, a higher brake pressure is achieved in the mechanical fallback mode. System 2 is described in detail in [8] and is used as a two-box solution with a standard ESC unit. Another e-booster with pedal simulator, but different MC concept, is illustrated in [9].

The dimensioning of the brake system is, on the one hand, characterized by the pressure-volume characteristic with air gap of the disc brake and, on the other hand, determined by influence factors such as air bubbles in the brake fluid. The contributions of the influence factors of an intact brake system at a brake pressure of 100 bar are on the order of 40 % of the Tandem-MC (TMC) volume limit, FIGURE 2. The contributions of air bubbles and friction spread can be increased by vapor bubbles or fading in case of overheated brakes (dashed lines in FIGURE 2 (a)). The MC and the PS must be sized accordingly. The TMC of system 1 is designed in such a way that the wheel locking pressure of 100 bar is reached at about 65 % of the maximum pedal travel (base volume). With the influence factors of the brake, the pedal travel is longer (dashed curve in FIGURE 2 (b)). Just below 100 bar the volume limit of the TMC is reached. With system 2, the pedal characteristics are independent of these influence factors and also independent of other influences such as PS failure, brake circuit failure or ESC failure as well as regenerative braking and torque vectoring. The PS volume of system 2 is designed for wheel locking pressure. At larger volume demand, brake fluid volume is refilled. When refilling, the PS valve (DVV) is closed and the piston of the PS is pulled in the opposite direction to the pressure build-up. Thus, several vehicle types can be covered with a single MC size.

Some critical failure modes of both systems, which must be considered in any concept of a brake system, are illustrated in FIGURE 3 as F1 to F9. Both systems have in common the feature of a hydraulically closed solution in ABS operation, which is considered beneficial. However, a detailed analysis shows that there are significant differences in the effect of failures. For instance, at failure condition F6 a pedal fall through does not occur for system 2. In addition, failure condition F3 does not affect the pedal characteristics for system 2. When designing the systems, the aspects of reliability, diagnosis as well as redundancies and partial redundancies have to be considered and taken into account.

The development processes of nuclear power plants and of aerospace are applied to the development of brake systems for automation levels HAD to AD, since the highest safety levels are needed for AD. The usually relevant fallback solutions “fail silent” and “fail safe” will be replaced by “fail operational” with the start of the HAD phase. This means that in the event of a failure or of a partial failure, the basic functionality must be preserved.

While hardware and software development is subject to clear standards in the analysis method of failures, these do not yet exist in the area of mechanics and hydraulics. The basic methodology and approach is known. The aim is to create a functional and safety concept with a definition of diagnosis and distinguish between active and passive failures. In the case of hardware and software, ISO 26262 is applied. This involves the use of proven tools and sufficient experience with failure rates in order to prepare the analyses. In mechanics and hydraulics, the emphasis is on the application of FMEA and FTA. Failure analysis considers failures and their effects using failure rates of components and systems, expressed in ppm per vehicle life time. A problem is a new or modified design, if failure rates are not yet available. In order to meet the high safety standards, diagnosable redundancies for important functions are required. TABLE 1 shows possible failures, problems with their effects and diagnosis possibilities of some specific critical components of brake systems such as piston seals, solenoid valves and ball screws. With open brake systems, the wheel circuit is hydraulically connected to the reservoir by opening the outlet valve during ABS control. Undetected leaks in valves and seals (dormant failures) require special consideration with open brake systems. If a solenoid valve with a dormant failure, for example, connects both brake circuits, then a brake circuit failure leads to a PS failure and, as a worst-case scenario, the entire brake system may fail. For this reason, closed brake systems are preferable. In addition to these hydraulic and mechanical failures, failures in the vehicle electrical system are of great importance, as will be discussed in the following.

The vehicle electrical system gains importance in the HAD to AD levels. The following two main sources of failures have to be considered: – the electric connection to the energy distributor box with protection against short circuit – the availability of the power supply, especially while driving. TABLE 2 shows four possible variants of the vehicle electrical system connection for redundant systems. Variant 3 shows a solution in which the redundancy is limited to specific functions and their components. It is a pragmatic way to reduce cost. A redundant vehicle electrical system [11], TABLE 2, increases reliability. Since the non-redundant connector deemed not reliable enough due to many contacts and electrical connections, various OEMs have already introduced a redundant connector. On the other side, the vehicle electrical system is considered to be very reliable during driving [11].

As a result of the increasing automation of driving, brake systems are changing with regard to the modules and functions 1 to 7 as shown in TABLE 3. Depending on the requirements of the OEM and also of the authorities, the functionality of the modules 1 to 5 must be fully or partially redundant in order to achieve the required safety level. At level 2 (DAS), no redundant pressure supply is required. At this stage, redundant pedal sensors are already state of the art. A variation of pedal feel will still be accepted at this level. With level 3 (HAD), a redundant pressure supply with sufficient volume delivery is mandatory for the first time due to the influence factors explained before. In addition, as already pointed out, connecting the brake circuits in open brake systems with a reservoir (VB) must be avoided, and pedal simulators have to be exploited because of the benefits in pedal feel and volume demand. Additionally, the e-booster must also inherit an ABS pressure modulation function in the event of an ESC failure in order to ensure a high vehicle deceleration at all times. In a first step, an ABS select-low control will be implemented. With level 4 (FAD), three-fold redundancies are expected for sufficient system availability, with the rule “2 out of 3” for the pedal sensors. Also, a pedal simulator is mandatory due to the increasing recuperation performance requirements of e-vehicles and the lack of acceptance of the change in pedal characteristics, since FAD can be operated for a longer period of time and because at the transition to piloted driving the driver is not prepared for a change in pedal characteristics. A monitoring of the pressure supply by a redundant pressure sensor shall be provided. Moreover, a redundant ABS function with at least axleindividual control will be required, and partial redundancies will be introduced. Brake systems with closed circuit will show safety benefits during ABS operation. At level 5 (AD), on the one hand pedal travel sensors and pedal simulators and their characteristics are no longer relevant. On the other hand, the remaining components and partial systems will require triple redundancy, with the rule “2 out of 3” in the case of sensors, ESC unit and partial ECU, or multiple redundancy.

Brake systems for level 3 (HAD), and more often for level 4 (FAD), must be redundant or partially redundant. In the event of a failure, a high vehicle deceleration together with a reduced ABS function must be guaranteed. Also, construction volume and shorter length of the aggregate at the fire wall is becoming increasingly important. In the HAD phase, different systems compete such as two-box including an e-booster with a pedal simulator and an ESC unit, or one-box systems including a pedal simulator and a reduced additional pressure control aggregate. With FAD, a redundant integration into a one-box unit or an optimization of the two-box modules will follow. Additionally, a changeover to pure brake-by-wire solutions with new actuation concepts will be started.

X-Boost and ESC [8] meet HAD requirements and, in addition, a modular extension with small modifications is already defined for FAD. Due to the considerable technical challenges of driverless driving, the development of brake systems for AD will need some more time. However, new innovative solutions with the features of closed brake systems, redundancy of the ABS operation without functional limitations, including the use of the parking brake in the system solution as well as system-related E/E partial and full redundancies are already conceptionally available. From 2021 onwards, integrated one-box systems [5] as well as two-box solutions [4, 10] will coexist with different equipment rates in the main automotive markets of Europe, USA and China and achieve large quantities. ESC is assumed to be standard, since ESC systems are mandatory in every new vehicle in India from 2022 onwards.