Article written by Siemens VDO Automotive

Authors: Dr. Martin Pellkofer, Dr. Andreas Mayer

Simulation of worst-case scenarios

The electronic wedge brake (EWB) is a brake-by-wire system with a dry actuator at each wheel. The strong self-reinforcement resulting from the wedge principle leads to comparatively low power consumption of the actuators and hence, the system is not bound to 42 V technology. Additional major advantages as compared to conventional hydraulic brake systems are higher dynamics leading to shorter braking distance, reduced space requirements, personalization of the brake pedal feel, extended diagnostic possibilities and others. An electrical brake system also poses special challenges to safety engineering as the system has to be operational in case of a single fault and must not lead to a dangerous situation in this case. Special focus has to be put on the two dangerous cases of undesired braking and on insufficient brake force at one or more wheels. Once undesired braking is detected, a fail-silent-mechanism is activated in the corresponding actuator that completely releases the brake on this wheel.

To provide functional safety of the braking system, the impact of brake malfunctions on vehicle dynamics and controllability by the driver must be known and accounted for. In simulations, driving situations have been evaluated, in which malfunctions have the most negative effects, and counteracting measures have been developed. As an example, the case of undesired braking is discussed with activation of the fail-silent mechanism at the wedge brake unit. Secondly, some results are presented concerning insufficient braking while driving in a curve at high speed.

1. Undesired braking

The term "undesired braking" is used here with the meaning that the measured brake force on a wheel unit is significantly higher than the corresponding brake force demand (roughly speaking >30%). From functional safety point of view an important question is how fast the fail-silent mechanism has to be effective. Some simulation results are shown here to answer this question.

For the simulations, the commercial software CarMaker® of IPG Automotive GmbH and Matlab Simulink are used. The brake force controllers of our test vehicles and a model of the wedge brake actuator have been integrated into the Simulink-based framework of CarMaker. Furthermore, the "IPG-DRIVER", i.e. the driver model in CarMaker, controls the steering wheel angle to follow the curved track. The driving scenario is as follows: The car is driving on a circular track with radius r=250 m in counter-clockwise direction, the coefficient of friction is µ=1.0 and the velocity is v=120 km/h. After 15 s an undesired braking occurs with a brake force of 40 kN blocking one or more wheels completely. After an additional period of time ΔT= {50, 100, 250, 500 ms} the fail-safe mechanism of the defective wheel unit is activated and the brake force becomes zero. The effects ofthe braking pulse on vehicle dynamics and on the driver's steering activity depending on the pulse length ΔT have been investigated.

A malfunction can occur on one or more wheels. To reference the 14 different cases of malfunctions in a simple way, the following syntax is used: The number 0 stands for "no malfunction" and the number 1 for a malfunction on the corresponding wheel. In this chapter, the malfunction is an undesired braking and in the next chapter an insufficient braking. The four wheels are listed in consecutive order: front-left, front-right, rear-left and rear-right. For example, in case 0101 two malfunctions occur at the same time, namely on the front-right and rear-right wheels.

For the discussion, different signals and quantities have been evaluated and calculated, e.g. lateral distance between vehicle's center of gravity to the middle of lane, time to lane crossing, distance to lane crossing, yaw rate, sideslip angle, steering wheel angle and their integrals and gradients. Here, some examples and the criticality are discussed in dependence of the type of malfunction and ΔT.

Figure 1 shows the lateral distance for ΔT = 250 ms (top) and 50 ms (bottom). For ΔT = 250 ms and the cases 0011 and 1011 the driver is not able to keep the car on the curved track. In cases 1101 and 1100, the maximum lateral distance is larger than 1.5 m and the vehicle leaves the lane. In the remaining uncritical cases, the vehicle remains in lane. For ΔT = 50 ms the vehicle temporarily leaves the lane only in the case 1011. This case is very unlikely because 3 malfunctions must happen at the same time.

In summary, the value ΔT should be as low as possible to avoid negative effects on vehicle dynamics. By all means, the value ΔT should be lower than 100 ms. However, it is preferable to have ΔT=50 ms or lower to get lower yaw rates, side slip angle rates and steering wheel angles (not shown).

2. Insufficient braking

In the second scenario, the car is driving on the same curved track as in the previous section with v=120 km/h counter-clockwise. In contrast to the previous paragraph, higher brake functions (ESC including ABS) are available. When the driver performs a full braking, a total loss of brake performance on one or more wheels occurs. For example in case 0110, the brake force remains zero on the front right and rear left wheel.

In addition to lateral distance and yaw rate (figure 3), the changes of sideslip and steering wheel angles over the first 5 seconds of insufficient braking are suitable measures of the controllability of the vehicle (figure 4, table 2).