阅读说明：本技术 失效安全制动系统 (Fail safe braking system ) 是由 托马斯·莱贝尔 海因茨·莱贝尔 于 2020-02-12 设计创作，主要内容包括：本发明涉及一种用于车辆的制动系统,该系统具有：至少两个液压制动回路,每个液压制动回路具有至少一个液压作用的车轮制动器；以及切换阀,切换阀位于每个液压作用的车轮制动器上,切换阀各自将一个液压作用的车轮制动器连接至两个制动回路中的一个制动回路。根据本发明,制动系统还具有中央出口切换阀,该中央出口切换阀在制动回路中的至少一个制动回路与储存容器之间产生能够切换的液压连接,其中,在至少一个液压作用的车轮制动器中的压力上的降低通过打开中央出口切换阀和相关联的切换阀来实现。(The invention relates to a brake system for a vehicle, comprising: at least two hydraulic brake circuits, each having at least one hydraulically acting wheel brake; and switching valves on each hydraulically acting wheel brake, the switching valves each connecting one hydraulically acting wheel brake to one of the two brake circuits. According to the invention, the brake system further has a central outlet selector valve which produces a switchable hydraulic connection between at least one of the brake circuits and the reservoir, wherein a reduction in pressure in the at least one hydraulically acting wheel brake is achieved by opening the central outlet selector valve and the associated selector valve.)

1. A braking system for a vehicle, the braking system comprising the following components:

-at least two hydraulic brake circuits (BK1, BK2), each hydraulic brake circuit (BK1, BK2) having at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB 4);

-at least one pressure supply Device (DV) connected to a brake circuit (BK1, BK2) via hydraulic lines;

-switching valves (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4) for each hydraulically acting wheel brake (SV1, SV2, SV3, SV4), which each switchably connect one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK 2);

-at least one hydraulic connection switchable between the two brake circuits (BK1 and BK2) by means of at least one bypass switching valve (BP 1);

-at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and a storage (VB) by means of at least one outlet switching valve (ZAV);

-and a hydraulic brake pedal system, the hydraulic output of which is switchably coupled to at least one brake circuit (BK1, BK2) by means of a feed switch valve (FV);

wherein the pressure reduction in the at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) is performed by opening the outlet switching valve (ZAV) and the associated switching valves (SV1, SV2, SV3, SV 4).

2. A braking system according to claim 1, wherein said at least one pressure supply Device (DV) comprises a rotary pump.

3. The braking system according to claim 2, wherein the rotary pump is designed as a gear pump or a multiple piston pump, in particular as a three piston pump.

4. A braking system according to claim 3, wherein the pressure supply Device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a non-return valve (RV3) which is closed towards the pressure supply Device (DV) or via a solenoid valve.

5. A braking system according to claim 3, wherein the multiple piston pump is directly connected to at least one of the brake circuits (BK1, BK2), wherein direct connection means that there is no valve or no pressure influencing device between the multiple piston pump and at least one of the brake circuits (BK1, BK 2).

6. Braking system according to any one of the preceding claims, wherein the pressure supply Device (DV) has a motor, wherein the motor is preferably a brushless dc motor, in particular with redundant windings and/or a connection with a 2x3 phase control.

7. A braking system according to any one of the preceding claims, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that are open when de-energized and the bypass switching valve (BP1) is a bypass switching valve that is open when de-energized and the outlet switching valve (ZAV) is an outlet switching valve that is closed when de-energized and the feed switching valve (FV) is a feed switching valve that is open when de-energized.

8. A braking system according to any one of the foregoing claims, wherein said switching valves (SV1, SV2, SV3, SV4) are designed and connected such that residual pressure in wheel brakes (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) in the de-energized state.

9. The brake system according to any one of the preceding claims, wherein the two hydraulic brake circuits (BK1, BK2) have exactly one, two or more pressure sensors (DG).

10. Braking system according to any of the preceding claims, wherein ABS and/or ESP control can be performed by means of at least one of the switching valves (SV1, SV2, SV3, SV4) and the outlet switching valve (ZAV).

11. A braking system according to any one of the preceding claims, wherein there is no valve between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK 2).

12. A braking system according to any one of the preceding claims, wherein there is no valve between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV 4).

13. The brake system according to any one of the preceding claims, wherein in particular only the outlet switching valve (ZAV) switchably connects the brake circuit (BK1, BK2) to the reservoir (VB).

14. Braking system according to any one of the preceding claims, wherein each wheel brake (RB1, RB2, RB3, RB4) has in particular only an associated switching valve (SV1, SV2, SV3, SV 4).

15. The brake system as claimed in one of claims 1 to 12 or 14, wherein there is a second outlet switching valve (ZAV2), which second outlet switching valve (ZAV2) is connected directly to the output of the pressure supply (DV) or to an associated check valve (RV3) and is connected in a switchable manner to a reservoir (VB), in particular wherein in particular only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuit (BK1, BK2) to the reservoir (VB)).

16. The brake system according to any one of claims 1 to 10 or 13 to 15, wherein the two hydraulic brake circuits (BK1, BK2) are connected to one another via the bypass switching valve (BP1) and a further bypass switching valve (BP2), the bypass switching valve (BP1) and the further bypass switching valve (BP2) being connected in series, wherein the outlet switching valve (ZAV) is connected to a line portion between the two bypass switching valves (BP1, BP 2).

17. Braking system according to any one of the preceding claims, wherein there is additionally an isolating switch valve (TV) which is connected directly to the output of the pressure supply (DV) or to an associated non-return valve (RV3) and directly to at least one of the switch valves (SV1, SV 2).

18. Braking system according to any one of the preceding claims, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ).

19. The brake system according to any one of the preceding claims, wherein the brake system further has a stroke simulator (WS).

20. A braking system according to claim 19, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the twin master cylinder (DHZ) via an optional switchable stroke simulator isolation valve (15).

21. Braking system according to any one of the preceding claims, wherein the single master cylinder (SHZ) or the twin master cylinder (DHZ) has a force-travel sensor (KWS), or wherein the single master cylinder (SHZ) or the twin master cylinder (DHZ) does not have a force-travel sensor (KWS).

22. The brake system according to any one of the preceding claims, wherein the brake system is designed as a brake-by-wire system.

23. The brake system according to any one of the preceding claims, wherein the hydraulic brake pedal system has an exhaust opening which is connected to the reservoir (VB) via a parallel circuit of a throttle valve (Dr1) and a check valve (RV1) which is closed towards the reservoir (VB).

24. A braking system according to any one of the preceding claims, wherein the braking system further has an open and closed loop control unit (ECU) which performs open and/or closed loop control of the braking system.

25. A braking system for a vehicle, the braking system comprising the following components:

-at least two hydraulic brake circuits (BK1, BK2), each hydraulic brake circuit (BK1, BK2) having at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB 4);

-at least one pressure supply Device (DV) connected to a brake circuit (BK1, BK2) via hydraulic lines;

-switching valves (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4) which each switchably connect one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2), for each hydraulically acting wheel brake (RB1, RB2, RB3, RB 4);

-at least one hydraulic connection switchable between the two brake circuits (BK1 and BK2) by means of at least one bypass switching valve (BP 1);

-at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and a storage (VB) by means of at least one outlet switching valve (ZAV);

-and a hydraulic brake pedal system, the hydraulic output of which is switchably coupled to at least one brake circuit (BK1, BK2) by means of a feed switch valve (FV);

wherein the at least one pressure supply Device (DV) comprises a rotary pump.

26. Braking system according to claim 25, wherein the rotary pump is designed as a gear pump or a multiple piston pump, in particular as a three piston pump.

27. The brake system according to claim 26, wherein the pressure supply Device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that closes toward the pressure supply Device (DV).

28. The brake system according to claim 26, wherein the multiple piston pump is directly connected to at least one of the brake circuits (BK1, BK2), wherein direct connection means that there is no valve or no pressure influencing device between the multiple piston pump and at least one of the brake circuits (BK1, BK2), and optionally one or more check valves can be integrated in the multiple piston pump.

29. Braking system according to any one of claims 25 to 28, wherein the pressure supply Device (DV) has a motor, wherein the motor is a brushless dc motor, in particular with redundant windings and/or a connection with a 2x3 phase control.

30. A braking system according to any one of claims 25 to 29, wherein the pressure supply Device (DV) is part of a Hydraulic Control Unit (HCU) and the Hydraulic Control Unit (HCU) has only exactly one pressure supply.

31. A braking system according to any one of claims 25-30, wherein pressure reduction in said at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) is performed by opening said outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV 4).

32. The braking system according to any one of claims 25 to 31, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that are open when de-energized, and the bypass switching valve (BP1) is a bypass switching valve that is open when de-energized, and the outlet switching valve (ZAV) is an outlet switching valve that is closed when de-energized, and the feed switching valve (FV) is a feed switching valve that is open when de-energized.

33. A braking system according to any one of claims 25-32, wherein said switching valves (SV1, SV2, SV3, SV4) are designed and connected such that residual pressure in said wheel brakes (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) in the de-energized state.

34. The brake system according to any one of claims 25 to 33, wherein the two hydraulic brake circuits (BK1, BK2) have exactly one, two or more pressure sensors (DG).

35. Braking system according to any of claims 25 to 34, wherein ABS and/or ESP control can be performed by means of at least one switching valve (SV1, SV2, SV3, SV4) and the outlet switching valve (ZAV).

36. A braking system according to any one of claims 25 to 35, wherein there is no valve between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK 2).

37. A braking system according to any one of claims 25 to 36, wherein there is no valve between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV 4).

38. The brake system according to any one of claims 25 to 37, wherein in particular only the outlet switching valve (ZAV) switchably connects the brake circuit (BK1, BK2) to the reservoir (VB).

39. The braking system according to any one of claims 25 to 38, wherein each wheel brake (RB1, RB2, RB3, RB4) has in particular only the associated switching valve (SV1, SV2, SV3, SV 4).

40. The brake system as claimed in one of claims 25 to 37 or 39, wherein there is a second outlet switching valve (ZAV2), which second outlet switching valve (ZAV2) is connected directly to the output of the pressure supply (DV) or to an associated check valve (RV3) and is connected in a switchable manner to the reservoir (VB), in particular wherein in particular only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) connect the brake circuit (BK1, BK2) in a switchable manner to the reservoir (VB)).

41. The brake system according to any one of claims 25 to 35 or 38 to 40, wherein the two hydraulic brake circuits (BK1, BK2) are connected to one another via the bypass switching valve (BP1) and a further bypass switching valve (BP2), the bypass switching valve (BP1) and the further bypass switching valve (BP2) being connected in series, wherein the outlet switching valve (ZAV) is connected to a line section between the two bypass switching valves (BP1, BP 2).

42. A braking system according to any one of claims 25 to 41, wherein there is additionally an isolating switch valve (TV) which is connected directly to the output of the pressure supply (DV) or to an associated non-return valve (RV3) and directly to at least one of the switch valves (SV1, SV 2).

43. The brake system according to any one of claims 25 to 42, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ).

44. A braking system according to any one of claims 25 to 43, wherein said braking system further has a stroke simulator (WS).

45. The brake system according to claim 44, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the twin master cylinder (DHZ) via an optional switchable stroke simulator isolation valve (15).

46. Braking system according to any one of the preceding claims, wherein the single master cylinder (SHZ) or the twin master cylinder (DHZ) has a force-travel sensor (KWS), or wherein the single master cylinder (SHZ)) or the twin master cylinder (DHZ) does not have a force-travel sensor (KWS).

47. The braking system of any one of claims 25 to 46, wherein the braking system is designed as a brake-by-wire system.

48. The brake system according to any one of claims 25-47, wherein the hydraulic brake pedal system has an exhaust opening that is connected to the reservoir (VB) via a parallel circuit of a throttle valve (Dr1) and a check valve (RV1) that closes towards the reservoir (VB).

49. A braking system according to any one of claims 25 to 48 wherein the braking system also has an open and closed loop control unit (ECU) which performs open and/or closed loop control of the braking system.

Technical Field

The invention relates to a hydraulic brake system having at least two brake circuits and at least one pressure supply unit.

Background

The requirements, in particular safety requirements (for example of a two-circuit brake system), have a major influence on the design of the brake system and become more stringent with the degree of automation of the motor vehicle (zero to five levels of the SAE J3016 standard). For example, in the case of one-level or higher-level automatic driving (for example, for an adaptive cruise control system), the braking force must be ensured even if the vehicle driver does not actuate the brake pedal. This requires at least one pressure supply unit in the hydraulic brake system and a correspondingly configured electronic sensor and control unit. The acceptance of a fault is also dependent on the level of automation. In level 2, a single fault is allowed if a braking operation of at least about 0.3g is possible, whereas in level 3, a braking operation of at least about 0.5g should be ensured even in the case of a single fault. For three and higher stages, the ABS/ESP function must be ensured as well, even in the event of a single fault. Generally, if the probability of failure based on ppm and FIT data is low, a double failure is accepted. It is desirable that double failure of complete brake failure not occur.

Disclosure of Invention

The invention relates to a brake system having two brake circuits. At least two-level requirements according to the SAE J3016 standard are preferably fulfilled, wherein, in addition, double faults leading to a complete failure of the brake system can be avoided and so-called potential single faults can be identified in time by redundancy and diagnosis.

According to a first aspect, the invention relates to a braking system for a vehicle, comprising the following components:

-at least two hydraulic brake circuits (BK1, BK2), each hydraulic brake circuit (BK1, BK2) having at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB 4);

-at least one pressure supply Device (DV) connected to a brake circuit (BK1, BK2) via hydraulic lines;

-switching valves (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4) for each hydraulically acting wheel brake (SV1, SV2, SV3, SV4), which each switchably connect one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK 2);

-at least one hydraulic connection switchable between the two brake circuits (BK1 and BK2) by means of at least one bypass switching valve (BP 1);

-at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and a storage (VB) by means of at least one outlet switching valve (ZAV);

-and a hydraulic brake pedal system, the hydraulic output of which is switchably coupled to at least one brake circuit (BK1, BK2) by means of a feed switch valve (FV);

wherein the pressure reduction in the at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) is performed by opening the outlet switching valve (ZAV) and the associated switching valves (SV1, SV2, SV3, SV 4).

Aspect 2: the brake system according to aspect 1, wherein the at least one pressure supply Device (DV) comprises a rotary pump. The rotary pump is generally cheaper than a proportional plunger pump.

Aspect 3: the brake system according to aspect 2, wherein the rotary pump is designed as a gear pump or a multiple piston pump, in particular as a three piston pump.

Aspect 4: the brake system according to aspect 3, wherein the pressure supply Device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that is closed toward the pressure supply Device (DV) or via a solenoid valve.

Aspect 5: the brake system according to aspect 3, wherein the multiple piston pump is directly connected to at least one of the brake circuits (BK1, BK2), wherein directly connected means that there is no valve or no pressure influencing device between the multiple piston pump and the at least one brake circuit (BK1, BK 2). By the proper design of the multiple piston pump, the back flow of the brake fluid can be prevented by the operation of the pump itself, so that a valve for preventing the back flow can be omitted.

Aspect 6: the brake system according to any one of the preceding aspects, wherein the pressure supply Device (DV) has a motor, wherein the motor is preferably a brushless dc motor, which in particular has redundant windings and/or a connection with a 2x3 phase control.

Aspect 7: the brake system according to any one of the preceding aspects, wherein the switch valves (SV1, SV2, SV3, SV4) are switch valves that are open when de-energized, and the bypass switch valve (BP1) is a bypass switch valve that is open when de-energized, and the outlet switch valve (ZAV) is an outlet switch valve that is closed when de-energized, and the feed switch valve (FV) is a feed switch valve that is open when de-energized.

Aspect 8: the brake system according to any one of the preceding aspects, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected such that residual pressure in the wheel brakes (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) in the de-energized state. In this way, an undesirable residual pressure in the brake system in the event of a fault can be avoided.

Aspect 9: the brake system according to any one of the preceding aspects, wherein the two hydraulic brake circuits (BK1, BK2) have exactly one, two or more pressure sensors (DG). The single pressure sensor of the two brake circuits (BK1, BK2) is sufficient for pressure detection. For increased safety, in each case one pressure sensor can be used in each brake circuit. Other redundant sensors may additionally be used.

Aspect 10: the brake system according to any one of the preceding aspects, wherein ABS and/or ESP control may be performed by means of at least one of said switching valves (SV1, SV2, SV3, SV4) and said outlet switching valve (ZAV).

Aspect 11: the brake system according to any one of the preceding aspects, wherein no valve is present between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK 2). It is preferred to connect two switching valves (SV3, SV4) directly to the central outlet switching valve (ZAV). In this way the valve can be omitted.

Aspect 12: the brake system according to any one of the preceding aspects, wherein no valve is present between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV 4).

Aspect 13: the brake system according to any one of the preceding aspects, wherein in particular only the outlet switching valve (ZAV) switchably connects the brake circuit (BK1, BK2) to the reservoir (VB).

Aspect 14: the brake system according to any one of the preceding aspects, wherein each wheel brake (RB1, RB2, RB3, RB4) has in particular only an associated switching valve (SV1, SV2, SV3, SV 4).

Aspect 15: the brake system according to any one of aspects 1 to 12 or 14, wherein there is a second outlet switching valve (ZAV2), which second outlet switching valve (ZAV2) is connected directly to the output of the pressure supply Device (DV) or to an associated check valve (RV3) and is switchably connected to a reservoir (VB), in particular wherein in particular only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuit (BK1, BK2) to the reservoir (VB). The second outlet switching valve (ZAV2) represents a possibility to further increase safety.

Aspect 16: the brake system according to any one of aspects 1 to 10 or 13 to 15, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2), the bypass switching valve (BP1) and the another bypass switching valve (BP2) are connected in series, wherein the outlet switching valve (ZAV) is connected to a pipe portion between the two bypass switching valves (BP1, BP 2).

Aspect 17: the brake system according to any one of the preceding aspects, wherein there is additionally an isolation switching valve (TV) which is directly connected to the output of the pressure supply (DV) or to an associated check valve (RV3) and directly to at least one of the switching valves (SV1, SV 2).

Aspect 18: the brake system according to any one of the preceding aspects, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ). The system described herein can meet at least two levels of requirements according to SAE J3016 standard even with a single master cylinder that can have a fail-safe design.

Aspect 19: the brake system according to any one of the preceding aspects, wherein the brake system further has a stroke simulator (WS).

Aspect 20: the brake system according to aspect 19, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the twin master cylinder (DHZ) via an optional switchable stroke simulator isolation valve (14).

Aspect 21: the brake system according to any one of the preceding aspects, wherein the single master cylinder (SHZ) or the twin master cylinder (DHZ) has a force-travel sensor (KWS), or wherein the single master cylinder (SHZ) or the twin master cylinder (DHZ) does not have a force-travel sensor (KWS).

Aspect 22: the brake system according to any one of the preceding aspects, wherein the brake system is designed as a brake-by-wire system.

Aspect 23: the brake system according to any one of the preceding aspects, wherein the hydraulic brake pedal system has an exhaust opening that is connected to the reservoir (VB) via a parallel circuit of a throttle valve (Dr1) and a check valve (RV1) that closes toward the reservoir (VB). The throttle valve (Dr1) and the check valve (RV1) serve as redundancy with respect to the main seal (D2).

Aspect 24: the brake system according to any one of the preceding aspects, wherein the brake system further has an open and closed loop control unit (ECU) that performs open and/or closed loop control of the brake system.

Aspect 25: a braking system for a vehicle, the braking system comprising the following components:

-at least two hydraulic brake circuits (BK1, BK2), each hydraulic brake circuit (BK1, BK2) having at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB 4);

-at least one pressure supply Device (DV) connected to a brake circuit (BK1, BK2) via hydraulic lines;

-switching valves (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4) for each hydraulically acting wheel brake (SV1, SV2, SV3, SV4), which each switchably connect one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK 2);

-at least one hydraulic connection switchable between the two brake circuits (BK1 and BK2) by means of at least one bypass switching valve (BP 1);

-at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and a storage (VB) by means of at least one outlet switching valve (ZAV);

-and a hydraulic brake pedal system, the hydraulic output of which is switchably coupled to at least one brake circuit (BK1, BK2) by means of a feed switch valve (FV);

wherein the at least one pressure supply Device (DV) comprises a rotary pump.

Aspect 26: the brake system according to aspect 25, wherein the rotary pump is designed as a gear pump or a multiple piston pump, in particular as a three piston pump.

Aspect 27: the brake system according to aspect 26, wherein the pressure-supply Device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that closes toward the pressure-supply Device (DV).

Aspect 28: the brake system according to aspect 26, wherein the multiple piston pump is directly connected to at least one of the brake circuits (BK1, BK2), wherein directly connected means that there is no valve or no pressure influencing device between the multiple piston pump and the at least one brake circuit (BK1, BK2), and optionally one or more check valves may be integrated in the multiple piston pump.

Aspect 29: the brake system according to one of the aspects 25 to 28, wherein the pressure supply Device (DV) has a motor, wherein the motor is a brushless dc motor, which in particular has redundant windings and/or a connection to a 2x3 phase control.

Aspect 30: the brake system according to any one of aspects 25 to 29, wherein the pressure supply Device (DV) is part of a Hydraulic Control Unit (HCU) and the Hydraulic Control Unit (HCU) has only exactly one pressure supply.

Aspect 31: the brake system of any of aspects 25 to 30, wherein a pressure reduction in the at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) is performed by opening the outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV 4).

Aspect 32: the brake system according to any one of aspects 25 to 31, wherein the switch valve (SV1, SV2, SV3, SV4) is a switch valve that is open when de-energized, and the bypass switch valve (BP1) is a bypass switch valve that is open when de-energized, and the outlet switch valve (ZAV) is an outlet switch valve that is closed when de-energized, and the feed switch valve (FV) is a feed switch valve that is open when de-energized.

Aspect 33: the brake system according to any one of aspects 25 to 32, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected such that residual pressure in the wheel brakes (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) in the de-energized state.

Aspect 34: the brake system according to any one of aspects 25 to 33, wherein the two hydraulic brake circuits (BK1, BK2) have exactly one, two or more pressure sensors (DG).

Aspect 35: the brake system according to any one of aspects 25 to 34, wherein ABS and/or ESP control may be performed by means of at least one switching valve (SV1, SV2, SV3, SV4) and the outlet switching valve (ZAV).

Aspect 36: the brake system according to any one of aspects 25 to 35, wherein no valve is present between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK 2).

Aspect 37: the brake system of any of aspects 25-36, wherein no valves are present between the bypass switch valve (BP1) and two, preferably all four, of the switch valves (SV1, SV2, SV3, SV 4).

Aspect 38: the brake system according to any one of aspects 25 to 37, wherein in particular only the outlet switching valve (ZAV) switchably connects the brake circuit (BK1, BK2) to the reservoir (VB).

Aspect 39: the brake system of any of aspects 25 to 38, wherein each wheel brake (RB1, RB2, RB3, RB4) has in particular only the associated switching valve (SV1, SV2, SV3, SV 4).

Aspect 40: the brake system according to any one of aspects 25 to 37 or 39, wherein there is a second outlet switching valve (ZAV2), which second outlet switching valve (ZAV2) is directly connected to the output of the pressure supply Device (DV) or to an associated check valve (RV3) and is switchably connected to the reservoir (VB), in particular wherein in particular only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuit (BK1, BK2) to the reservoir (VB)).

Aspect 41: the brake system according to any one of aspects 25 to 35 or 38 to 40, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2), the bypass switching valve (BP1) and the another bypass switching valve (BP2) are connected in series, wherein the outlet switching valve (ZAV) is connected to a pipe portion between the two bypass switching valves (BP1, BP 2).

Aspect 42: the brake system according to any one of aspects 25 to 41, wherein there is additionally an isolation switching valve (TV) which is directly connected to the output of the pressure supply (DV) or to an associated check valve (RV3) and directly to at least one of the switching valves (SV1, SV 2).

Aspect 43: the brake system according to any one of aspects 25 to 42, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ).

Aspect 44: the brake system according to any one of aspects 25 to 43, wherein the brake system further has a stroke simulator (WS).

Aspect 45: a braking system according to aspect 44, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the twin master cylinder (DHZ) via an optional switchable stroke simulator isolation valve (15).

Aspect 46: braking system according to any of the previous claims, wherein said single master cylinder (SHZ) or said twin master cylinder (DHZ) has a force-travel sensor (KWS), or wherein said single master cylinder (SHZ)) or said twin master cylinder (DHZ) does not have a force-travel sensor (KWS).

Aspect 47: the brake system according to any one of aspects 25 to 46, wherein the brake system is designed as a brake-by-wire system.

Aspect 48: the brake system according to any one of aspects 25 to 47, wherein the hydraulic brake pedal system has an exhaust opening that is connected to the reservoir (VB) via a parallel circuit made up of a throttle valve (Dr1) and a check valve (RV1) that closes toward the reservoir (VB).

Aspect 49: the brake system according to any one of aspects 25 to 48, wherein the brake system further has an open-loop and closed-loop control unit (ECU) that performs open-loop and/or closed-loop control of the brake system.

Drawings

Fig. 1a shows a first possible embodiment of the braking system according to the invention, in which a minimized valve arrangement in the HCU has a bypass valve (BP1) and a central outlet valve (ZAV).

Fig. 1b shows a second possible embodiment of the brake system according to the invention, in which there are two bypass valves (BP1 and BP2), two (central) outlet valves (ZAV1, ZAV2) and an isolation valve (TV) in an extension valve arrangement in the HCU.

FIG. 2 shows a diagnostic valve (V)_D) The structure of (1).

Fig. 3a shows an embodiment according to the invention in which the connection between a single master cylinder and the reservoir (VB) is realized with two throttle valves (Dr1, Dr4) and a check valve (RV1) and a redundant auxiliary seal (D1 r).

FIG. 3b shows the use of a diagnostic valve (V) according to the invention_D) And redundant primary seals (D2r) enable connection between a single master cylinder and the reservoir (VB).

Fig. 3c shows an embodiment according to the invention in which the connection between the individual master cylinders and the reservoir (VB) is realized with a reservoir shut-off valve (17), a throttle valve (Dr4) and in each case one redundant main seal (D2r) and auxiliary seal (D1 r).

Fig. 3d shows an exemplary pedal force versus stroke characteristic for a single master cylinder with another return spring (RF2) and stroke simulator (WS).

Fig. 4a shows an embodiment according to the invention with a single master cylinder unit (SHZ) and with a double-circuit double-acting piston pump with four check valves (RV3, RV4, RV5, RV 6).

Fig. 4b shows an embodiment according to the invention with a single master cylinder unit (SHZ) and with a double-circuit double-acting piston pump with three check valves (RV4, RV5, RV6) and with a solenoid valve (PD 1).

Fig. 4c shows an embodiment with a single master cylinder unit (SHZ) and with a double-circuit double-acting piston pump with four solenoid valves (PD1, PD2, PD3, PD 4).

Fig. 5a shows an embodiment according to the invention with a conventional tandem master cylinder unit (THZ) and with a dual-circuit, double-acting piston pump with four check valves (RV3, RV4, RV5, RV 6).

Fig. 5b shows an embodiment according to the invention with a tandem master cylinder unit (THZ) with a plunger and with a dual-circuit double-acting piston pump with four check valves (RV3, RV4, RV5, RV 6).

Detailed Description

Fig. 1a shows elements of a hydraulic brake system comprising: a single master cylinder unit (SHZ) having a brake pedal (1), a single master cylinder and a reservoir (VB); a pressure supply Device (DV); an Electronic Control Unit (ECU); and wheel brakes (RB1, RB2, RB3, RB4) for each wheel (not shown), which have in each case one wheel cylinder (RZ1, RZ2, RZ3, RZ 4). Pressure supply Devices (DV) and pressure supply units are used synonymously herein. Two wheel cylinders (RZ1, RZ2) are connected in each case via switching valves (SV1, SV2) to a first brake circuit (BK1), and the other two wheel cylinders (RZ3, RZ4) are connected in each case via switching valve connections (SV3, SV4) to a second brake circuit (BK 2). Instead of one switching valve per wheel cylinder, two or more switching valves per wheel cylinder may be used. The pressure supply unit (DV) comprises a pump and a brushless dc motor, optionally with redundant windings and/or connected to an Electronic Control Unit (ECU) via 2x3 phase windings. The pump may be a plunger pump (not shown) with a spindle drive or a rotary pump, wherein the rotary pump may in turn be designed as a multi-piston pump (e.g. a three-piston pump) or as a gear pump. In the case of a gear pump which can be rotated in both directions, the pressure feed unit (DV) can be connected to the first brake circuit (BK1) via a check valve (RV3) which is closed towards the pressure feed unit (DV). In the case of a multi-piston pump which is capable of delivering volumes in one direction only, the pressure supply unit (DV) can be connected directly to the first brake circuit (BK1) (without RV 3). One or more check valves may be integrated in the multiple piston pump. In the case of a plunger pump, a solenoid valve (not shown) is required instead of the check valve RV 3. In addition, a plunger pump or a rotary pump may be connected to the storage section (VB). The two brake circuits (BK1 and BK2) are connected via a switchable bypass valve (BP 1). The second brake circuit (BK2) is connected to a reservoir section (VB) via a switchable center outlet valve (ZAV), and is connected to a hydraulic pressure output section of a pressure chamber of a single master cylinder via a switchable feed switching valve (FV). As an alternative to a single master cylinder, for example as shown in fig. 5a or 5b, a twin master cylinder with corresponding connections can also be used for additional safety. The pressure in one of the two brake circuits (e.g. BK2) can be measured by means of a pressure sensor (e.g. DG) on said brake circuit (e.g. BK2) and transmitted to the ECU. Alternatively, other pressures in the brake circuit (e.g., BK1) may also be measured by means of other pressure sensors (e.g., DG2) and communicated to the ECU. The hydraulic arrangement with wheel cylinders (RZ1, RZ2, RZ3, RZ4), switching valves (SV1, SV2, SV3, SV4), two brake circuits (BK1, BK2), pressure sensors (DG1, DG2), bypass valves (BP1), central outlet valves (ZAV), pressure supply units (DV) and check valves (RV3), if present (RV3), can be combined in a so-called Hydraulic Control Unit (HCU). In a preferred embodiment, the Hydraulic Control Unit (HCU) has only exactly one pressure supply (DV).

In the single master cylinder unit (SHZ), it is also possible to connect the stroke simulator (WS) with or without the switchable stroke simulator isolation valve (14) to another hydraulic output of the single master cylinder (or to a hydraulic line between the feed switch valve (FV) and the single master cylinder). The stroke simulator can transmit a specific pedal stroke-force characteristic to the brake pedal (1) by means of a slave piston, wherein the slave piston can be displaced against the arrangement of a return spring, for example as a result of the actuation of the brake pedal (1) by the foot. The hydraulic connection of the stroke simulator (WS) to the single master cylinder can be realized, for example, by means of a parallel connection with a throttle valve (Dr2) and a check valve (RV2) or in some other way, as illustrated in fig. 1 a. As pressure increases across the throttle Dr2, pedal movement may decrease, and the throttle Dr2 may be bypassed via the check valve RV2 during evacuation of the stroke simulator (WS).

Under normal conditions, in particular when a source of electrical and functional pressure DV is present, a braking operation is carried out by the driver by means of a brake pedal actuation, wherein during the brake pedal actuation the feed switch valve (FV) is closed and remains closed as long as the brake pedal (1) remains depressed. The pedal system is thus hydraulically decoupled from the Hydraulic Control Unit (HCU). Instead, the coupling takes place in the form of "brake-by-wire" by means of a redundantly configured pedal travel sensor, ECU and pressure supply unit DV, which can deliver a brake fluid volume from a reservoir (VB) into the wheel cylinders (RZ1, RZ2, RZ3, RZ4) of the two brake circuits (BK1, BK2) and thus build up a brake pressure when the switching valves (SV1, SV2, SV3, SV4) are open, the bypass valve (BP1) is open and the central outlet valve (ZAV) is closed. Depending on the required braking force and other boundary conditions, the bypass valve (BP1) may also be closed during normal braking operation if braking is performed solely by means of the wheel cylinders (RZ1, RZ2) in the first brake circuit (BK 1). By means of pulse width modulation of at least one pressure sensor (DG) in one of the brake circuits (BK1, BK2) and/or of a switching valve (SV1, SV2, SV3, SV4) and/or of a bypass valve (BP1), the target pressure can be set by closed-loop control in a manner dependent on the pedal stroke. By means of the travel simulator (WS) and the return spring (RF) in the individual master cylinder, the driver is provided with a specific pedal travel force characteristic which is preferably always as constant as possible and independent of the brake pressure in the brake circuit (BK1, BK 2). In particular, the combination of the travel simulator (WS) and the return spring (RF) in the "brake-by-wire" system resists the collapse of the brake pedal and brings the pedal back into a defined starting position after foot actuation. In particular, in the case of electric or hybrid vehicles, the recovery (regeneration) of the braking energy in the electric traction motor can therefore be decoupled from the brake pedal (1). In particular, the pedal stroke-force characteristic is not affected even in abnormal situations, such as in the event of a brake circuit failure.

When the brake pedal force is released, the central outlet valve (ZAV) may open, particularly if a rotary pump is used. In addition, the switching valves (SV1, SV2, SV3, SV4) and/or the bypass valves (BP1, BP2) are either fully opened, or opened by means of Pulse Width Modulation (PWM) or a brief stop (e.g. after a period of time Δ t or pressure difference Δ p) or in some other way in a manner depending on the required pressure reduction gradient. As a result, the brake fluid volume can be returned into the reservoir (VB) and the brake pressure can be reduced. If the piston (3) of the single master cylinder returns into a defined starting position after the actuation of the brake pedal (1) by the foot has ended, the exchange of brake fluid between the pressure chamber of the single master cylinder and the reservoir (VB) can take place via a hydraulic connection, for example, through radial ventilation openings in the piston (3) and the single master cylinder. This hydraulic connection may be achieved by means of a parallel connection of a throttle valve (Dr1) and a check valve (RV1) as shown in fig. 1a or in some other way. The sealing of the pressure chambers in the individual master cylinders can be achieved by means of the primary seal (D2) and the secondary seal (D1) and further redundant seals (not illustrated), wherein in particular the primary seal (D2) can be attached in or on the piston (3) of the individual master cylinders.

Normally, the individual brake pressure for driving dynamic interventions, such as ABS or ESP, can be set for each wheel by closed-loop control. For example, the closed loop control function for the ABS is as follows: if at elevated pressure P_{Is raised}During which the closed-loop controller signals that the brake cylinder of the wheel (for example RZ1) meets a criterion such as an excessive brake pressure, the pressure increase P can be stopped by observing the wheel_{Is raised}Or (possibly after such observation time) may be reduced by pressure P_ReduceTo reduce the brake pressure. Since the feed switching valve (FV) is here kept closed, and according to an embodiment,the pump in the pressure supply unit (DV) cannot admit any volume from the brake circuit, and in one possible configuration, the opening of the central outlet valve (ZAV) constitutes a pressure reduction P_ReduceA unique choice. When the central outlet valve (ZAV) is open, the different pressure reduction gradients can then be set by closed loop control, preferably by PWM control of the associated switching valve (e.g., SV 1). If the pressure decreases P_ReduceUpon cessation of the closed loop control, the central outlet valve (ZAV) closes again. Can also be reduced in pressure P_ReduceTwo, three, or four wheel cylinders are controlled simultaneously and on a specific wheel basis. Pressure rise P_{Is raised}It is also possible to perform control in one wheel cylinder or in two, three, or four wheel cylinders simultaneously and on a wheel-specific basis as needed.

In the case of interventions by driver assistance systems which are customary in partially automated driving (level 2), such as in the case of adaptive cruise control systems or traffic congestion assistance systems, brake operation can be carried out even without pedal actuation by the driver by means of a pressure supply unit (DV), wherein the brake pedal (1) is hydraulically decoupled from such interventions by a subsequently closed feed switch valve (FV).

The "brake-by-wire" brake system according to the invention with a stroke simulator (WS), an electric pressure supply unit (DV) and an ABS/ESP function can be referred to as a so-called single-tank system, based on a so-called conventional three-tank system (brake system with an ABS/ESP function, a vacuum brake booster and an electric or mechanical vacuum pump) and a so-called conventional two-tank system (brake system with an ABS/ESP function and an electric brake booster unit). Due to the high integration of such a single tank system, the installation space, weight and costs of the entire structural unit can be reduced and, in addition, the installation and logistics can be optimized.

Valves FV, BP1, SV1, SV2, SV3, SV4 may be designed as solenoid valves that open when de-energized, while valve ZAV and stroke simulator isolation valve (14), if present, are preferably solenoid valves that close when de-energized. Furthermore, the switching valves (SV1, SV2, SV3, SV4) are preferably connected via their output sides to the respective wheel cylinders (RZ1, RZ2, RZ3, RZ4) such that each switching valve (SV1, SV2, SV3, SV4) opens automatically in the event of a fault, for example in the event of a failure of the electrical connection of each switching valve, due to the pressure in the respective wheel cylinder (RZ1, RZ2, RZ3, RZ 4). By means of such a valve configuration, it can be ensured in particular that, without a power supply, the brake pedal (1) can be hydraulically coupled to the wheel cylinders (RZ1, RZ2, RZ3, RZ4) via the open feed switching valve (FV) and the brake pressure can be increased. If there is a travel simulator isolation valve (14) which closes in the event of a power failure, the travel simulator (WS) can also be decoupled from the brake pedal (1), so that, for example, approximately 40% of the pedal travel can be saved.

All solenoid valves, in particular ZAV, can each be designed as redundant valves and/or with redundant coils and/or redundant controls, whereby the possibility of valve failure can be reduced. For example, in the case of a single failure with a probability of 1e-6 per year, redundancy with the same failure probability may reduce the annual failure probability to 1e-6x 1e-6 ═ 1 e-12.

In addition, if there is power and the pressure supply unit (DV) fails, the valves FV, BP1, SV1, SV2, SV3, SV4 may be opened, and the valve ZAV and the stroke simulator isolation valve (14) may be closed, if the stroke simulator isolation valve (14) is present, so that the brake pressure may be raised by brake pedal actuation. Alternatively, the bypass valve (BP1) may be closed and still a sufficient brake pressure may be raised in the second brake circuit (BK2) by actuation of the brake pedal (1) by foot. The failure of the electrical control of the pressure supply unit (DV) can be classified as highly unlikely, in particular in the preferred embodiment with (single) multiple piston or gear pumps and by means of redundant windings with 2x3 phase control. Since the power supply is also less likely to fail, the stroke simulator isolation valve (14) may be omitted.

According to the invention, the brake system can have various sensors, in particular pressure sensors (DG, DG2), redundant pedal travel sensors (Sp1 and Sp2) for determining the pedal travel, a force travel sensor (KWS) in the piston of the individual master cylinder for determining a force-pedal travel characteristic, a fill level sensor element (6) for determining the fill level of the brake fluid in the reservoir (VB), a yaw angle sensor (GWS) for ESP intervention, for example, or other sensors (e.g. temperature sensors) whose sensor values can be transmitted to an Electronic Control Unit (ECU). Alternatively or in addition to the force-travel sensor (KWS), a pressure sensor (not shown) may be integrated into the single master cylinder, which may detect the pressure in the pressure chamber and transmit it to the ECU. Furthermore, all solenoid valves, in particular valves SV1, SV2, SV3, SV4, BP1, ZAV, FV, 14, can also be switched by an Electronic Control Unit (ECU), preferably by redundant electronic control or by means of redundant coils. In a single-tank arrangement with ABS/ESP, an Electronic Control Unit (ECU) may be attached to a Hydraulic Control Unit (HCU) and preferably connected to the on-board electrical system of the vehicle by means of a plug connector (13), wherein the bus communication may be realized, for example, by FlexRay or a Controller Area Network (CAN) or in some other form.

The redundant pedal stroke sensors (Sp1 and Sp2) may be implemented in different ways. In fig. 1a, two sensor rods are displaced by the projection of a single master cylinder piston (3), these sensor rods acting on redundant pedal travel sensors (Sp1 and Sp 2). In order to prevent jamming of the rod, a stop element may be housed in a projection of the piston (3). Redundant pedal travel sensors (Sp1 and Sp2) may also be coupled to the two pistons and the spring between the two pistons. This has the advantage that the force-stroke measurement can therefore be implemented with additional advantages in the case of a fault analysis, for example with respect to the blocking piston (3), see also DE 102010050132.

Further fault situations, consequences of the fault and detection of the fault by diagnostics will be discussed below.

The loss of braking force caused by a seal leakage in one of the wheel cylinders (RZ1, RZ2, RZ3, RZ4) may be related to the pressure increase P_{Is raised}Is compared, is identified by the loss volume additionally taken up or the volume additionally delivered by the pressure supply Device (DV), which isThe predetermined pressure-volume characteristic may depend on various boundary conditions, such as valve position, temperature, ventilation of the brake system, clearance of the wheel brakes (RB1, RB2, RB3, RB4), etc. The wheel cylinder in which the braking force loss occurs can be located using the following diagnosis: at the occurrence of a pressure rise P_{Is raised}After that, all switching valves (SV1, SV2, SV3, SV4) are opened and if there is residual pressure in the brake circuit (BK1, BK2), the pressure supply unit (DV) is no longer energized. After the bypass valve (BP1) has been closed, the pressure measured in the second brake circuit (BK2) by the pressure sensor (DG) can be checked. If the pressure drops, the wheel cylinders RZ3 and/or RZ4 should leak. For example, by closing the switching valve SV3, it is then possible to identify a leak in the wheel cylinder RZ4 with a decreased pressure or a leak in the wheel cylinder RZ3 with a constant pressure. On the other hand, if the pressure remains constant after the bypass valve (BP1) has been closed, the wheel cylinders RZ3 and RZ4 may be identified as being sealed. In this case, the bypass valve (BP1) is opened and the switching valves SV1, SV3, and SV4 are closed. If the pressure decreases, the leak may be identified as being in the wheel cylinder RZ2, whereas in the case where the pressure is constant, the leak may be identified as being in the wheel cylinder RZ 1. After the wheel cylinder with a loss of braking force (for example RZ1) has been located, the relevant switching valve (for example SV1) can be closed before each braking operation until the unit is replaced during a maintenance work, so that deceleration can be maintained with a braking force reduced by means of two or three wheel cylinders (for example RZ2, RZ3, RZ4) but sufficient for secondary automatic driving. If a small leak is identified in the wheel cylinder as described above, the leak may be compensated by replenishment by means of a pressure supply unit (DV) as an alternative to closing the wheel cylinder.

After all switching valves SV1, SV2, SV3, SV4 have been closed, the tightness of the central outlet valve ZAV and the feed switching valve FV can be checked by alternately closing and opening the valves ZAV and FV, preferably in a stationary state with or without volume delivery by means of a pressure supply unit (DV). If possible leaks can be located in ZAV or FV, for example by pressure oscillations from the pressure supply unit (DV) and by interaction between the fill level sensor element (6) in the reservoir (VB) and the pedal movement, the following measures can be distinguished: if the central outlet valve (ZAV) is blocked by dirt particles, for example, and no longer seals, or if the central outlet valve (ZAV) cannot be closed again after an electrical control failure, the bypass valve (BP1) can be closed, wherein then a sufficient brake pressure can still be raised at least in the first brake circuit by means of the pressure supply unit (DV). On the other hand, in the event that the feed switch valve (FV) is blocked, for example, by dirt particles and no longer seals, the bypass valve (BP1), the switch valves SV3 and SV4 in the second brake circuit (BK2) and the central outlet valve (ZAV) can be closed, so that a break in the pedal characteristic in the individual master cylinders, which could in principle be caused by a leakage of the feed switch valve (FV), can be prevented and a sufficient brake pressure can still be raised in the first brake circuit (BK1) by means of the pressure supply unit (DV). In the event that a leak is not likely to be located in ZAV or the FV, the same procedure may be used as if a leak were present in the FV. Furthermore, if such leakage flows are small, the leakage can be compensated by means of volume delivery by means of a pressure supply unit (DV), as described above.

If the central outlet valve (ZAV) fails in that it cannot be opened any more, the brake pressure can be reduced by opening the feed switch valve (FV) by means of a single master cylinder and reservoir (VB). In the case of an alternatively used twin master cylinder, the other pressure chambers of which are connected to the hydraulic control unit via other feed switching valves (FV2), as in fig. 5a and 5b, both feed switching valves (FV, FV2) can be opened for pressure reduction P_Reduce。

If one of the switching valves (SV3, SV4) (e.g., SV3) in the second brake circuit fails, for example, because of dirt particles, in that it cannot be closed any more, the bypass valve (BP1) can be closed and a sufficient braking force, in particular for secondary automatic driving, can still be built up in the first brake circuit (BK1) by means of the pressure supply unit (DV). In the event of failure of one of the two brake circuits (BK1, BK2), it is particularly advantageous that the so-called diagonal distribution of the braking forces to the four wheels of the vehicle can produce a greater braking action than the distribution of the brake circuits (BK1, BK2) between the front axle and the rear axle of the vehicle (for example, if the front drive circuit fails, the braking action is about 50% in the case of a diagonal distribution, compared to about 30% in the case of a front/rear axle distribution). The diagonal subdivision of the braking force means that the front wheel brakes on one side of the vehicle and the rear wheel brakes on the other side of the vehicle are allocated to the brake circuits. The wheel brakes on the other diagonal are correspondingly assigned to the second brake circuit.

If one of the switching valves (SV1, SV2) (e.g., SV1) in the first brake circuit fails, for example, because of dirt particles, in the sense that it can no longer be closed, the bypass valve (BP1) can be closed and the feed switching valve (FV) can be opened, so that a sufficient brake pressure can still be built up in the second brake circuit (BK2) by the actuation of the brake pedal (1) by foot. If a stroke simulator isolation valve (14) is present, it can additionally be closed, whereby for example about 40% of the pedal stroke can be saved.

If the feed switching valve (FV) fails in the sense that it can no longer be closed, for example due to dirt particles, the second brake circuit can be decoupled by closing the switching valves SV3 and SV4, the central outlet valve (ZAV) and the bypass valve (BP 1). Since in this way an interruption of the pedal travel characteristic in a single master cylinder can be prevented, a sufficient brake pressure can still be increased further in the first brake circuit (BK1) by means of the pressure supply unit (DV). In the event of emergency braking, the braking force in the wheel brakes (RB1, RB2, RB3, RB4) can also be increased further by actuation of the brake pedal (1) by foot after opening the switching valves (SV3, SV4) in the second brake circuit (BK 2). If the leakage flow in the feed switching valve (FV) is small and a blockage of one of the wheel brakes (RB1, RB2, RB3, RB4) occurs during emergency braking, ABS control can be performed by means of the central outlet valve (ZAV) and the pressure supply unit (DV).

If a pressure sensor (e.g., DG) in one of the brake circuits (BK1, BK2) failsAnother pressure sensor (e.g., DG2) in one of the brake circuits (BK1, BK2) may be used, if present. If only one pressure sensor (DG) is present in the brake system, the pressure in the brake circuit (BK1, BK2) can also be set by closed-loop control by means of the current in the motor of the pressure supply unit (DV) according to predetermined current-pressure relationships (e.g. characteristic maps) stored in the ECU, wherein these current-pressure relationships can include relationships with various boundary conditions, such as a pressure rise P_{Is raised}Or a pressure decrease P_ReduceThe solenoid position, temperature, etc.

If the main seal (D2) in the pressure chamber of the master cylinder fails, that is to say if the main seal (D2) leaks, leakage of brake fluid in the master cylinder can occur, which can affect (in this case: increase) the pedal stroke in an uncontrolled manner, and excessive brake pressure can be generated by "brake-by-wire" and thus an undesirably strong braking operation. In the following, the master cylinder will be assumed to be a single master cylinder, wherein the use of tandem master cylinders is equally possible. To avoid a possible total failure of the master cylinders, for example in fig. 1a, the connection of a single master cylinder to the reservoir (VB) can be realized by means of a parallel connection of a check valve (RV1) and a throttle valve (Dr1), wherein the check valve (RV1) is closed towards the reservoir. In the event of leakage of the main seal (D2) and the leakage-preventing auxiliary seal (D1), the leakage flow is blocked by the check valve (RV1) and throttled by the throttle valve (Dr1) so that only insignificant, small piston or pedal movements are produced, which only slightly interrupts the "brake-by-wire" braking operation. The throttle valve (Dr1) may be designed, for example, such that the pedal movement caused by leakage is about 0.2 mm/s. In the case where the average braking time is about 3s to decelerate the vehicle at 100km/h by 1g, therefore, a pedal stroke interruption of 0.6mm may occur, which is small and negligible with respect to the entire pedal stroke. The check valve (RV1) may allow rapid filling and rapid venting of the brake system with brake fluid via an exhaust screw opened on the wheel cylinders (RZ1, RZ2, RZ3, RZ 4). The throttle valve (Dr1) also allows volume compensation in case of temperature changes.

A serious double failure, which is composed of a main seal (D2) leakage and an additional dormant single failure of the secondary seal (D1) leakage, can be avoided by means of additional redundant main and/or secondary seals (not shown) in the event that the leakage cannot be throttled any more by means of the throttle valve (Dr 1). According to the invention, as in fig. 1a, the tightness of the secondary seal (D1) can be monitored by periodic diagnostics, for example at each stop. In the case of no stroke simulator (WS) or a stroke simulator (WS) which is connected in a switchable manner by means of a stroke simulator isolation valve (14), the leakage can in this case be assigned exclusively to the auxiliary seal (D1). The procedure in one of these cases may be implemented, for example, as follows: if the residual pressure in the brake system enters the individual master cylinders via the open feed selector valve (FV) after the vehicle has been closed by means of corresponding valve switching, the tightness of the entire brake system can be checked within a time period of, for example, 10 seconds on the basis of the pressure change detected by the pressure sensor (DG), wherein an identified pressure drop can represent a leak. If such a leak is detected, the individual master cylinders can be charged with a constant pressure of, for example, 20bar for a certain period of time by means of the pressure supply unit (DV) after closing the switching valves (SV1, SV2, SV3, SV4) and the stroke simulator isolation valve (14), if present. The delivered quantity can be determined here, for example, by means of an angle change in the motor of the pressure supply unit (DV) which is detected by a rotor position sensor. If the delivered amount is greater than the known delivery rate of the throttle valve (Dr1) at, for example, 20bar, the secondary seal (D1) may be assessed as leaking. Thus, a double failure of the primary seal (D2) and the secondary seal (D1) to leak out only in the unlikely event of simultaneous failure of both seals (D1, D2) during a trip. In the case of a stroke simulator (WS) without a stroke simulator isolation valve (14), it may be the case in certain cases that, similarly to the diagnostics just described, the detected leakage cannot be assigned exclusively to the auxiliary seal (D1) of the individual master cylinder, since the leakage may also be caused by a leakage of the stroke simulator seal (D3) of the stroke simulator (WS), which leakage likewise may lead to a leakage flow flowing into the storage (VB) via a connection (not shown) due to throttling by the leaked stroke simulator seal (D3) and by means of a further throttle valve (Dr3) between the stroke simulator seal (D3) and a further redundant seal (D3r) of the stroke simulator (WS). In this case, if a leak occurs in D1 or D3, a different leakage flow through Dr1 and/or Dr3 may occur to some extent due to the different configuration of the hydraulic resistances of throttle Dr1 and Dr3, whereby the diagnostics just described can then localize the leak at D1 or D3. On the other hand, even if no leakage at D1 or D3 is located, a potential failure in D1 or D3 can be avoided by replacing both seals (D1, D3) at the same time, and the safety of the brake system can be ensured. The additional failure of the redundant primary seal (D3r) may be classified as a less likely double failure.

The reservoir (VB) may have two fluid chambers that are redundant with each other. The reservoir (VB) has a float (8) with a sensor target (7) in at least one fluid chamber, the float (8) attached to the reservoir (VB) together with a filling level sensor element (6) on the PCB (5) of the Electronic Control Unit (ECU) can measure the filling level of the brake fluid in the reservoir (VB) in an almost continuously variable manner. In this way, it is also possible to redundantly detect a small leak in the brake circuit, for example, a leak in D1 or one of the wheel cylinders RZ1 to RZ 4. The integration of the filling level sensor element (6) into an Electronic Control Unit (ECU) may reduce costs.

Fig. 1b shows a further embodiment of a brake system which, in contrast to fig. 1a, has a further bypass valve (BP2), an isolation valve (TV) and a further (central) outlet valve (ZAV 2). In this way, safety in the brake system, in particular in the case of double failures, can be increased.

Another bypass valve (BP2) may be incorporated into the second brake circuit (BK2) so that the second brake circuit (BK2) and the wheel cylinders RZ3 and RZ4 may be decoupled from the rest of the brake system in the event of a fault in the second brake circuit (BK 2). As shown in fig. 1b, for example, a second bypass valve (BP2) may be incorporated into the hydraulic line between the first bypass valve (BP1) and the pressure sensor (DG) in the second brake circuit (BK2), wherein the central outlet valve (ZAV) may then be connected to the second brake circuit (BK2) via the second bypass valve (BP 2). The combination of the two bypass valves (BP1, BP2) can be referred to as a safety gate (SIG) or can be expanded by an isolation valve (TV).

An isolation valve (TV) may be incorporated into the first brake circuit (BK1) such that the first brake circuit (BK1) and wheel cylinders RZ1 and RZ2 may be decoupled from the rest of the brake system in the event of a fault in the first brake circuit (BK1) (e.g., a double fault of RZ and SV). As shown in fig. 1b, for example, the isolation valve (TV) can be incorporated into the hydraulic line between the pressure supply unit (DV) or the check valve (RV3), if present (RV3), or the solenoid valve on the pressure supply unit (DV) and the switching valves (SV1, SV2) of the first brake circuit (BK 1). In addition, a redundant pressure sensor (DG2) (not shown) may be coupled to first brake circuit (BK 1).

Another central outlet valve (ZAV2) may be incorporated into the brake system such that pressure in the brake system may be reduced redundantly relative to the central outlet valve (ZAV). As illustrated in fig. 1b, the further central outlet valve may for example be connected to a hydraulic line between the isolation valve (TV) and the pressure supply unit (DV) or the check valve (RV3), if present, or a solenoid valve on the pressure supply unit (DV). For safety reasons, the central outlet valves ZAV and ZAV2 should be connected to separate parts of the storage section (VB). For example, as illustrated in fig. 1b, the central outlet valve ZAV2 may also be connected to the reservoir (VB) via another opening in the master cylinder and an annular vent opening in the piston (3).

The second bypass valve (BP2) and the isolation valve (TV) can be designed as solenoid valves that open when de-energized, while the other central outlet valve (ZAV2) can be designed as solenoid valves that close when de-energized. Furthermore, the second bypass valve (BP2) and the isolation valve (TV) can each be connected via their output side to the second brake circuit (BK2) and the first brake circuit (BK1), respectively, so that the second bypass valve (BP2) and the isolation valve (TV) can be opened in the event of a failure of the valve control (for example without energization) by means of residual pressure in the brake circuits (BK1, BK 2). Thus, as in the case of the brake system in fig. 1a, even without energization, a braking operation can be performed by actuation of the brake pedal (1) by foot.

If one of the two (central) outlet valves (ZAV, ZAV2) (for example ZAV) fails in such a way that it can no longer open, the pressure drop P_ReduceMay be performed by means of a further central outlet valve (ZAV 2). By this again not having to open the feed switch valve (FV) compared to the situation in fig. 1a, the "brake-by-wire" function can be maintained and in particular interruptions of the pedal travel characteristic and thus influences on the pedal movement can be avoided.

In one embodiment according to the invention, the further central outlet valve (ZAV2) also has the advantage that the pressure drop P is reduced during a dynamic driving intervention (for example ABS)_ReduceCan be set independently in each case by closed-loop control in the two wheel cylinders (RZ1, RZ2 and RZ3, RZ4, respectively) of each brake circuit (BK1, BK 2).

By means of the second bypass valve (BP2), safety can be increased in the event that the feed switch valve (FV) can no longer be closed (for example, due to dirt particles or a fault in the electrical connection). In this case, a single master cylinder can be decoupled from the brake system by closing the two bypass valves (BP1, BP2) and a sufficient brake pressure can still be built up in the first brake circuit (BK1) by means of the pressure supply unit (DV). In this case, for example, the pressure is reduced by P_ReduceMay be performed by means of a further (central) outlet valve ZAV 2. Furthermore, in the case of emergency braking, after opening the second bypass valve (BP2), the braking force can also be increased by foot actuation of the brake pedal (1) in the second brake circuit (BK 2). In this way, for example, a braking action of approximately 75% of the full normal braking action can be achieved. If the leakage due to the feed switching valve (FV) which can no longer be closed is small, a reduction for ABS intervention can still be performed, for example, by means of one of the switching valves (SV3, SV4) and the central outlet valve (ZAV)Pressure P_Reduce(and pressure increase P_{Is raised})。

In addition to the primary seal (D2) and the secondary seal (D1), a single master cylinder may have other redundant primary and/or secondary seals, in particular the redundant primary seal (D2r) illustrated in fig. 1 b.

The ventilation opening in the individual master cylinder between the primary seal (D2) and the secondary seal (D1) can be controlled via a so-called diagnostic valve (V)_D) Connected to the storage section (VB), a diagnostic valve (V)_D) Illustrated in fig. 2 and described further below. If a pressure drop P occurs in the brake circuit (BK1, BK2)_ReduceA malfunction that cannot be performed by means of the (central) outlet valves (ZAV and ZAV2, if ZAV2 is present), the pressure can be reduced by dissipating into the reservoir (VB) by opening the feed switching valve (FV) and the single master cylinder. Since the throttle (Dr1) and the check valve (RV1) are connected in parallel in the hydraulic connection of a single master cylinder to the reservoir, the pressure drop P in FIG. 1a is_ReduceCan be performed only by very small volume flows, whereas the pressure reduction P in FIG. 1b_ReduceIn this case, relatively large volume flows can flow back into the reservoir (VB), provided that these volume flows are smaller than V_DThe configuration of (a) predetermines a defined closing volume flow. By means of a suitable control of the relevant solenoid valves (for example SV1, SV2, SV3, SV4, BP1, BP2, FV) by means of Pulse Width Modulation (PWM), the pressure reduction P_ReduceCan be performed so that the diagnostic valve (V) is not exceeded_D) And thus diagnosing the valve (V)_D) Remain open during the pressure reduction. On the other hand, the one described in FIG. 1a for the use with the aid of a diagnostic valve (V)_D) The diagnosis of the monitoring of the tightness of the sealing of the master cylinder, i.e. of the secondary seal (D1), can be carried out in a similar manner, wherein V is higher than V_DIs deliberately fed into the master cylinder by means of the pressure supply unit (DV), since the valve (V) is diagnosed_D) When closed, the tightness can be determined by means of a pressure curve detected by means of a pressure sensor (DG). To increase safety in FIG. 1a with only one central outlet valve (ZAV), a single master cylinder and reservoirThe hydraulic connection between (VB) can also be established from the diagnostic valve (V) in FIG. 1b_D) The connection of (3) is replaced.

In order to protect the main seal (D2) in the master cylinder, which main seal (D2) is not protected by the throttling check valve combination (Dr1, RV1) compared to fig. 1a, a redundant main seal (D2r) may be used. Diagnostics of the main seal may be performed during a braking operation by means of a force-stroke sensor (KWS) and a pedal-stroke sensor (Sp1, Sp 2). Alternatively, the diagnosis of the main seal may be performed by means of a pressure sensor in a single master cylinder and a pedal stroke sensor (Sp1, Sp 2).

Figure 2 shows a possible embodiment of a backpressure valve that can be used, for example, as the diagnostic valve (V) in figure 1b_D). The backpressure valve may have two openings, wherein one of the two openings may have a valve seat and preferably has a larger opening cross section than the other opening. Furthermore, the back pressure valve can have a plunger with a sealing ball (18), wherein, in the absence of a fluid flow, the plunger can be supported in the valve housing by a spring (F) such that the sealing ball (18)) cannot close the valve seat, which is preferably large. Conversely, if the fluid flows through an opening with a valve seat via an opening without a valve seat, a back pressure, which presses the sealing ball (18) into the valve seat and thus closes the valve in this direction, is generated above the so-called closing volume flow, due to the predetermined geometry of the opening, the valve seat and the sealing ball (18). If the valve (V) is diagnosed_D) When the volume flow is higher than the closing volume flow, the closing is carried out below V_DIn the case of a further opening volume flow predetermined by the configuration of (a), the diagnostic valve can be opened again in the same flow direction. In the other flow direction, brake fluid may be delivered through the valve without a closing action.

Fig. 3a to 3c show various embodiments according to the invention of a so-called fail-safe single master cylinder unit (SHZ) for use in a brake system according to the invention, wherein the protective measures described below can likewise be used in a tandem master cylinder unit (THZ). Each individual master cylinder unit (SHZ) described in connection with fig. 3a to 3c can be used in a system according to fig. 1a to 1b, 4a to 4c and 5a to 5 b.

Fig. 3a shows an embodiment of a single master cylinder unit (SHZ) which, in comparison to the master cylinder unit in fig. 1a, has a further redundant auxiliary seal (D1r) in order to protect the sealing of the master cylinder with respect to the outside. The master cylinder also has a further opening between the auxiliary seal (D1) and the redundant auxiliary seal (D1r), which is connected to the reservoir (VB) via a throttle valve (Dr 4). The tightness of the auxiliary seal (D1) can also be diagnosed by means of this connection.

Fig. 3b shows an embodiment of a single master cylinder unit (SHZ) which corresponds to the connection of the master cylinder to the storage (VB) in fig. 1b with respect to the connection of the master cylinder to the storage (VB).

Fig. 3c shows an embodiment of a single master cylinder unit (SHZ) with a redundant primary seal (D2r) and an optional redundant secondary seal (D1 r). In addition to the ventilation opening between the main seal (D2) and the auxiliary seal (D1), the master cylinder may have a further opening between the main seal (D2) and the redundant main seal (D2r), wherein these two openings may be connected by means of a hydraulic line, which in turn is connected to the reservoir (VB) via a switchable reservoir shutoff valve (17). The reservoir shutoff valve (17) can be regarded as redundant of the pressure chamber seal, since the reservoir shutoff valve (17) can be closed in the event of a leakage of one of the main seals (D2, D2 r). The reservoir shut-off valve (17) in fig. 3c can be designed as a solenoid valve which opens when de-energized. In this way, the brake system can be filled and vented even in the de-energized state.

Similarly to the case of the throttle valve/check valve combination in fig. 1a and 3a, a diagnosis of the sealing of the master cylinder with respect to the outside, i.e. the sealing of the auxiliary seal (D1), can also be carried out by means of a residual pressure or pressure supply unit (DV) in the stationary state and with the reservoir shutoff valve (17) closed. In the case of a further redundant auxiliary seal (D1r) and a further opening of the master cylinder between the auxiliary seal (D1) and the redundant auxiliary seal (D1r), which is connected to the reservoir (VB) via the throttle valve (Dr4), the leakage flow through Dr4 can be taken into account in the diagnosis.

Other openings may be provided between other redundant main seals, which other openings may likewise be connected to the reservoir (VB) via the reservoir shutoff valve (17).

Fail-safe here generally means that a single failure of an element of the brake system is protected by redundancy, and that a failure or a redundant failure of an element of the brake system can be determined by diagnostics. A single failure (or single fault) is a failure (or fault) of only one element of the braking system. On the other hand, a double failure (or double failure) or multiple failures (or multiple failures) refers to a failure (or failure) of two or more elements of the braking system. Generally, it is acceptable if the probability of occurrence of double or multiple failures is small. However, double failures that may lead to complete failure of the brake system should be avoided in fail-safe systems. Double failures in a fail-safe system can be avoided if so-called sleep single failures are protected or identified by redundancy of additional diagnostics, wherein each single failure together with another single failure leads to a double failure.

A single master cylinder is fail-safe if the pressure chamber seal of the master cylinder is fail-safe. Under normal conditions, that is to say without a fault, the pressure chamber of the individual master cylinder is sealed, for example, by the main seal (D2) of the individual master cylinder. A single failure of the seal of a single master cylinder pressure chamber, for example, caused by a primary seal (D2) leaking, may result in a complete failure of the brake system. Thus, the desired fail safety requires at least one redundancy of the pressure chamber seal and at least one diagnosis of the pressure chamber seal or the redundancy of the pressure chamber seal. The fail-safe master cylinder can be used in three to four stages according to the SAE J3016 standard.

For example, at least one redundant need for pressure chamber sealing may be fulfilled,

-as in figures 1a and 3a, by means of a combination of a throttle valve (Dr1) and a check valve (RV1) in the connection of the master cylinder with the reservoir (VB), in which case the variation in pedal stroke is negligible,

or, as in figures 1b, 3b and 3c, by means of a second redundant main seal (D2r),

or, as in fig. 3c, the vent opening of the single master cylinder is connected to the storage (VB) via the storage shut-off valve (17) by closing the switchable storage shut-off valve (17).

Although (in addition to the at least one diagnosis still required) a redundancy is sufficient for the fail-safety of the master cylinder, the redundancy can be combined in a suitable manner to increase the safety. For example, other redundant primary seals (e.g., D2r) may be used independent of redundancy in the connection of the master cylinder to the reservoir (VB) (combination Dr1/RV1 or reservoir shutoff valve 17). In principle, a combination Dr1/RV1 and reservoir shutoff valve 17 is also conceivable.

At least one diagnosis of the pressure chamber seal or the redundancy of the pressure chamber seal can be realized as a diagnosis of the pressure chamber seal, for example:

-as shown in fig. 1b, 3b and 3c, wherein the tightness of the main seal (D2) is monitored during a braking operation by means of a force-stroke sensor (KWS) in the piston of the master cylinder or by means of a pressure sensor in the pressure chamber of the master cylinder, respectively measuring the pedal force (Fp) or the pressure in the pressure chamber, since during a foot-applied actuation the pedal force (Fp) or the pressure, respectively, is analyzed in a manner dependent on the movement of the piston (3), the movement of the piston (3) being detected by means of a pedal-stroke sensor (Sp1, Sp 2);

or as redundant diagnostics of the pressure chamber seal, for example:

as in fig. 1a and 3a, wherein the throttle valve-check valve combination (Dr3, RV1) can be diagnosed in the stationary state of the vehicle, preferably at a standstill, as described above, by the residual pressure in the brake system or by means of the pressure supply unit (DV), which can be determined, for example, by the delivery volume of the pressure supply unit (DV) and/or by a change in the filling level in the reservoir (VB) in comparison with the anticipated blocking by the check valve (RV1) and the throttling by the throttle valve (Dr1) as a result of the return to the reservoir (VB);

or as in fig. 3c, wherein the tightness of the storage section shut-off valve (17) which can be switched can be checked by means of the pressure supply unit (DV) and the corresponding valve positions (e.g. closing SV1, SV2, SV3, SV4, ZAV, 14 and opening BP1, FV), possibly taking into account the filling level sensor in the storage section (VB).

With regard to the diagnostics performed in a stationary state of the vehicle, preferably while parking, the safety can be improved by means of diagnostics performed a plurality of times during a braking operation and thus in particular during driving. Other redundant main seals (e.g., D2r) in the master cylinder can likewise be diagnosed by means of a force/travel distance sensor (KWS) and/or a pressure sensor in the pressure chamber of the master cylinder.

If the brake system is coupled to the travel simulator (WS) as is conventional in "brake-by-wire" systems, the travel simulator (WS) should also have a fail-safe design. If the pressure chamber seal of the stroke simulator (WS) is fail-safe, the stroke simulator (WS) is also fail-safe. In the normal case, that is to say without a fault, the pressure chamber seal of the stroke simulator (WS) is realized, for example, by means of a stroke simulator seal (D3) of the stroke simulator (WS). A single failure of the seal of the stroke simulator pressure chamber, for example caused by a leaking stroke simulator seal (D3), may also lead to a complete failure of the brake system. Thus, the desired fail safety requires at least one redundancy of the pressure chamber seal and at least one diagnosis of the redundancy of the pressure chamber seal or the pressure chamber seal.

For example, the need for at least one redundancy of pressure chamber seals may be achieved by:

-by means of a second redundant stroke simulator seal (D3 r);

or, as in fig. 1a, 1b, 3a, 3b and 3c, the leakage is throttled by means of a second redundant stroke simulator seal (D3r) and above by means of a throttle valve (Dr3) between the stroke simulator seal (D3) and the redundant stroke simulator seal (D3r), in which case the change in pedal stroke is slower.

At least one diagnosis of the pressure chamber seal or redundancy of the pressure chamber seal of the stroke simulator can be realized as a diagnosis of the pressure chamber seal, for example:

-as in fig. 1b, 3b and 3c, wherein the pedal force (Fp) or pressure, respectively, is measured by means of a force-stroke sensor (KWS) in the piston of the master cylinder or by means of a pressure sensor in the pressure chamber of the master cylinder, the tightness of the stroke simulator seal (D3) (and the main seal (D2)) being monitored during a braking operation, in that during a foot-applied actuation the pedal force (Fp) or pressure, respectively, is analyzed in a manner dependent on the movement of the piston (3), the movement of the piston (3) being detected by means of the pedal stroke sensor (Sp1, Sp 2);

or as in fig. 1a, 1b, 3a, 3b and 3c, wherein the tightness of the travel simulator seal (D3) is monitored in the stationary state of the vehicle, preferably at parking, by residual pressure in the brake system or by means of the pressure supply unit (DV) by a corresponding valve position, as a result of the return to the reservoir (VB), which can be determined, for example, by a comparison of the delivery volume of the pressure supply unit (DV) and/or by a change in the filling level in the reservoir (VB) with an expectable blocking by the check valve (RV1) and a throttling by the throttle valve (Dr1, Dr2), possibly taking into account the filling level sensor (VB) in the reservoir;

or as in fig. 3c, wherein the tightness of the stroke simulator seal (D3) can be checked by means of the pressure supply unit (DV) and the corresponding valve positions (e.g. closing SV1, SV2, SV3, SV4, ZAV, 17 and opening BP1, FV, 14), possibly taking into account the filling level sensor in the reservoir (VB).

To improve safety, diagnosis can be combined in a suitable manner.

Due to the hydraulic coupling of the pressure chamber of the master cylinder and the stroke simulator (WS), it is often not possible to locate a diagnosed leak in the coupled pressure chamber, since this may be caused, for example, by both a master seal (D2) leak of the master cylinder and a stroke simulator seal (D3) leak. This is sufficient for failsafe, since the seal diagnosed in the coupled pressure chambers means the seal of the two seals (D2, D3). If a stroke simulator isolation valve (14) is present, any leaks in the stroke simulator (WS) or the master cylinder can be located.

Normally, the safety requirements on the sealing of a single master cylinder with respect to the outside are performed, for example, by means of the auxiliary seal (D1), which may not be as stringent as the safety requirements on the sealing of the master cylinder pressure chamber, since on the one hand the auxiliary seal (D1) is not affected by high pressures and, on the other hand, the consequences of a malfunction are less severe. Safety is ensured if at least one redundancy of the elements and/or a failure of an element can be diagnosed, compared to the stricter requirements for fail-safe.

A single failure of a single master cylinder with respect to the external seal, for example a leak of the secondary seal (D1) which may lead to a loss of brake fluid, may be protected, for example, by redundancy:

as in figures 3a and 3c, by means of a second redundant secondary seal (D1r),

or as in fig. 3a and 3c, by throttling by means of a further throttle valve (Dr4), via which a further opening in the single master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r) is connected to the reservoir (VB), in which case the leakage is slow, while in the stationary state of the vehicle the leakage can again be monitored, for example, by a change in the brake fluid level in the reservoir (VB).

Furthermore, during non-braking operation, which means operation in which no braking process takes place, and in particular stationary states of the vehicle (e.g. when parked), the tightness of the auxiliary seal (D1) can be determined or diagnosed, since,

-as in figures 1a and 3a and as already described above, the volume delivered by the pressure feed unit (DV) is compared with the normal and predictable throttling flow rate in a first step by means of the residual pressure in the brake circuit (BK1, BK2) and in a second step by means of the pressure feed unit (DV) and in the presence of a pressure set by closed-loop control transmitted via the master cylinder into the reservoir (VB),

or as in fig. 1b and 3b and as already described above, volume and height above the diagnostic valve (V)_D) Is transmitted by means of a pressure supply unit (DV) via a master cylinder into a storage section (VB) and the pressure curve detected by means of a pressure sensor (DG) is evaluated,

or as in fig. 3c, the volume and fluid flow are transferred by means of the pressure supply unit (DV) via the master cylinder into the reservoir (VB), wherein the reservoir shut-off valve (17) is closed and the delivery volume of the pressure supply unit (DV) is compared with the normal and predictable throttling flow through the throttle valve (Dr4) in the presence of a pressure set by closed-loop control.

Redundancy and diagnostics may be combined in a number of suitable ways in order to improve safety. In the diagnosis, the fill level sensor (6) in the reservoir (VB) can likewise or additionally be used for leak detection.

The safety requirement on the seal of the feed switching valve (FV) in the closed state, that is to say on the seal of the feed switching valve (FV), which is normally carried out, for example, by means of a seal in a valve seat, may likewise be less stringent than the safety requirement on the seal of the master cylinder pressure chamber, since the consequences of a malfunction are less severe. Safety is ensured if at least one redundancy of the elements and/or a failure of an element can be diagnosed, compared to the stricter requirements for fail-safety.

A single failure of the seal of the feed switch valve (FV), for example caused by dirt particles, can impair the "brake-by-wire" function and possibly destroy the force-travel characteristic of the brake pedal system, which is protected, for example, by redundancy:

by means of a further solenoid valve (not shown in the figures) connected in series,

or, as in fig. 1a, 1b, 3a, 3b, 3c and as already described, deactivating the second brake circuit (BK2) by closing the solenoid valves ZAV, SV3, SV4, BP1 or possibly ZAV, BP1, BP2, wherein sufficient braking force can still be obtained by means of the first brake circuit (BK1) (for example, still maintaining 50% braking action depending on the wheel distribution).

Furthermore, as in fig. 1a, 1b, 3a, 3b and 3c, the tightness of the closed feed switch valve (FV) can be determined by means of the pressure supply unit (DV) and by a change in the pedal stroke, preferably during non-braking operation. Redundancy and diagnostics may be combined in a number of suitable ways in order to improve safety.

However, in the case of a (central) outlet valve (ZAV, ZAV2) in a Hydraulic Control Unit (HCU) that can no longer be opened, the pressure reduction P via the master cylinder in FIGS. 1a and 3a_ReduceCan only be done in a throttling manner (via Dr 1). Pressure drop P in FIGS. 1b, 3b and 3c_ReduceIt is also possible to operate with less throttling via the master cylinder.

The hydraulic connection between the at least one hydraulic output of the master cylinder and the feed switching valve (FV) can be realized as in fig. 3b and 3c by means of a backpressure valve (19), the backpressure valve (19) being configured and connected such that: in the presence of an excessively high pedal force (greater than about 500N), the backpressure valve may act as a throttle in the direction of fluid from the master cylinder to the hydraulic control unit, for example by virtue of a perforated valve plate (20) in the backpressure valve (19) blocking the primary output due to the backpressure effect, but maintaining a secondary throttle output by the arrangement of throttle points in the valve plate (20).

Fig. 3d shows an exemplary pedal force/travel characteristic (21) of the brake pedal (1) of the single master cylinder unit (SHZ) in fig. 3c, wherein the pedal travel (Sp) is specified relative to the total pedal travel. The return force of the brake pedal (1) is generated by a return spring (RF1) in the master cylinder (range up to 10% in fig. 3 d) and a controllable spring (starting from 40% in the range of fig. 3 d) in the stroke simulator (WS). In order to prevent the brake pedal (1) from collapsing in the event of a poorly sealed pressure chamber of the master cylinder or of the travel simulator (WS), a further restoring spring (RF2) can be incorporated in the master cylinder, which increases the gradient of the pedal force-travel characteristic of the brake pedal (1), for example starting from approximately 10% of the pedal travel.

Preferred embodiments of the braking system according to the invention can be selected fromFIG. 3b shows that the diagnostic valve V in the connection of the master cylinder to the reservoir (VB) is omitted_DThat is, the master cylinder is directly connected to the reservoir (VB) via the vent opening between the primary seal (D2) and the secondary seal (D1). The single master cylinder in this embodiment is fail safe due to the redundant primary seal (D2r), the redundant stroke simulator seal (D3r), and the force-stroke sensor (KWS) as defined above. The leakage of the auxiliary seal (D1) can be diagnosed with the aid of the fill level sensor element (6) on the reservoir (VB) or PCB in the stationary state of the vehicle. In addition, the tightness of the auxiliary seal (D1) can be checked during maintenance work (for example, every two to three years) by filling the storage (VB) with, for example, 5bar of compressed air with the valves FV, ZAV and the valves ZAV2, AV1-AV4, if present, the valves ZAV2, AV1-AV4, and with the stroke simulator isolation valve closed.

Fig. 4a shows a further embodiment of the brake system according to the invention, wherein, in comparison with fig. 1a and 1b, the pressure supply Device (DV) has, instead of a rotary pump, a double-circuit, double-acting piston pump which can have a piston, two pressure chambers, one in each case in front of and behind the piston, and one central rod, wherein the piston can be moved in both directions via the central rod and a transmission having an electric drive. For example, the transmission may be implemented as a ball screw drive, and the electric drive may be implemented as a brushless dc motor or in some other form. The corresponding configuration of the pressure supply Device (DV) described in connection with fig. 4a to 4c and 5a to 5b can be used for or together with each of the systems according to the invention as in fig. 1a to 1b and 3a to 3 c.

The connection of the wheel cylinders (for example RZ1, RZ2) to the brake circuit (for example BK1) can be effected in each case by means of a switchable inlet valve (for example EV1, EV2) as is known from the prior art, wherein the wheel cylinders (for example RZ1, RZ2) can then be connected in each case to the storage (VB) by means of a switchable outlet valve (for example AV1, AV 2). The inlet or outlet valve may also be considered a switching valve. Alternatively, the connection of the wheel cylinders (e.g. RZ3, RZ4) to the brake circuits (e.g. BK2) can, as in fig. 1a and 1b, be effected in each case via only one switching valve (e.g. SV3, SV4), in which case at least one brake circuit can be switchably connected to the storage (VB) by means of the central outlet valve (ZAV) and possibly further valves. This connection can reduce the number of solenoid valves, which can save costs.

One of the two pressure chambers of the double-acting piston pump can be connected to the first brake circuit (BK1) via the hydraulic output of the pump and via a check valve (RV3) which is closed towards the pressure supply unit (DV) and via possibly further valves. Furthermore, this pressure chamber can be connected to the reservoir (VB) via a suction make-up input (vent opening or opening) of the pump and a further check valve (RV6) which is closed towards the reservoir (VB) and via possible further valves. The other pressure chamber can likewise be connected to the second brake circuit via the other hydraulic output of the pump and a check valve (RV4) which is closed towards the pressure supply unit (DV) and via possible further valves. Furthermore, the pressure chamber can likewise be connected to the reservoir (VB) via a further suction make-up input (vent opening or opening) of the pump and a further check valve (RV5) which is closed towards the reservoir (VB) and via possible further valves. A pump with two suction makeup inputs and two hydraulic outputs and a piston may be designed such that: in both directions of piston movement, that is to say during a forward stroke and during a return stroke, brake fluid can be delivered from the reservoir (VB) into at least one of the two brake circuits (BK1, BK2) and can thus increase the brake pressure, wherein a forward stroke refers by definition to the following direction of movement of the piston: in this direction of motion, brake fluid is forced (via RV3 in fig. 4 a) out of the pressure chamber that avoids the central rod of the piston. On the other hand, the return stroke refers to the following direction of movement of the piston: in this direction of motion, brake fluid is forced (via RV4 in fig. 4 a) out of another pressure chamber where the effective piston area of the piston may be smaller relative to the effective piston area of the piston during the forward stroke.

According to one embodiment, the two brake circuits (BK1, BK2) can be connected to one another in a switchable manner by means of a bypass valve (BP1) as in fig. 1a or by means of two bypass valves (BP1, BP2) connected in series as in fig. 1b and by means of further possible valves. In this way, during the forward stroke of the piston in the pressure feed unit (DV), the brake pressure can be selectively raised in the first brake circuit (BK1) or in both brake circuits (BK1, BK 2). Similarly, during the return stroke of the piston in the pressure supply unit (DV), the brake pressure can be selectively raised in the second brake circuit (BK2) or in both brake circuits (BK1, BK 2).

With regard to the single-acting piston pump, which is also usual in brake systems but is not illustrated and is only capable of delivering a volume into the brake system in one stroke direction (forward stroke), a brake system according to the invention with a double-acting piston pump and an exemplary connection as in fig. 4a can prove to be advantageous, since the time which would have to be taken in the case of a single-acting piston pump if the piston had to be fully or partially retracted and in the case of a closed hydraulic output of the pressure chamber before an additional required brake fluid volume could be delivered can be saved. During such idle return stroke, the brake system cannot be charged with pressure by the pressure supply unit (DV). In contrast, in the brake system according to the invention, with the double-acting piston pump in fig. 4a, the brake pressure can be continuously provided in the brake circuit (BK1, BK2) by alternating forward and return strokes. In this way, the overall length of the double-acting piston pump can be reduced in particular.

On the other hand, a brake system according to the invention with a double-acting piston pump and with an exemplary connection as in fig. 4a may prove advantageous, since different sizes of the effective piston area during the forward stroke and the return stroke of the piston can be used in the configuration of the transmission and the electric drive to achieve a so-called miniaturization. With regard to the two pressure ranges which are customary in brake systems, namely on the one hand a pressure in the normal pressure range of, for example, approximately 100bar to 120bar, which is the so-called lock pressure in the case of a high coefficient of friction in the wheel/ground system, and on the other hand a higher pressure range up to, for example, approximately 200bar, the effective piston area of the piston of the double-acting piston pump, the transmission, and the electric motor can preferably be designed such that the pressure in the normal pressure range is still adequately supported during the forward stroke, whereas the pressure in the higher pressure range can only be supported by the relatively small piston rear side. The use of a relatively large forward stroke of the rear piston part can prove advantageous, in particular if, during the filling of the wheel cylinder, it is first necessary to overcome the brake gap, in which the brake pressure rises relatively slowly, as quickly as possible. The use of a relatively small piston back side return stroke may prove advantageous, particularly if the pressure rises significantly after overcoming the brake clearance and less brake fluid volume must be delivered as the pressure increases significantly.

In a miniaturized design, at a pressure rise P_{Is raised}During this, after a return stroke in the higher pressure range, an idle pre-stroke may be required, whereby brake fluid may be transferred from a pressure chamber with a larger effective piston area into a reservoir (VB), for example in the case of a closed switching valve (e.g. SV3, SV4) and inlet valve (e.g. EV1, EV2), a closed feed switching valve (FV), a second bypass valve (BP2) which is preferably closed if present, an open first bypass valve (BP1) and an open central outlet valve (ZAV). This idle pre-stroke may last up to about 100ms, but only rarely needs to be used. Subsequently, the pressure is increased by P_{Is raised}It is possible to continue in the higher pressure range by a further return stroke.

As in the case of the rotary pumps in FIGS. 1a and 1b, the pressure drop P in the brake circuit (BK1, BK2)_ReduceThis can be achieved normally via a central outlet valve (ZAV) or other (central) outlet valve (ZAV2) or in the event of a malfunction via a feed switching valve (FV) and a single master cylinder. Pressure reduction P, such as ABS intervention, via an outlet valve (e.g. AV1, AV2) at each brake cylinder (e.g. RZ1, RZ2)_ReduceIn contrast, the pressure drop P via the switching valves (e.g., SV3, SV4) and the central outlet valve (ZAV)_ReduceIt can be considered advantageous in terms of the accuracy of the pressure difference between the individual wheel cylinders (RZ1, RZ2, RZ3, RZ4) and/or the brake circuits (BK1, BK2), wherein the switching valve and/or the bypass valve (BP1, BP2) can be controlled by means of Pulse Width Modulation (PWM). In this way the noise generated can also be reduced to a certain minimum. At full pressure drop P_ReduceIn this case, the piston of the double-acting piston pump can be returned into its initial position by means of the electric drive of the double-acting piston pump via a return stroke, wherein a brake fluid volume is delivered from the pressure chamber with the smaller piston effective area into the reservoir (VB) also via at least one of the bypass valves (BP1, BP2) and the central outlet valve (ZAV).

Due to the check valves (RV5, RV6) which are closed in the connection of the double-acting piston pump to the reservoir (VB), in particular (partial) evacuation and venting of the two pressure chambers of the double-acting piston pump can be carried out in this embodiment only via the hydraulic outputs of the pump, the respective check valves (RV3, RV4) and the respective brake circuits (BK1, BK 2).

Fig. 4b shows another embodiment, in which it is preferable to replace the check valve (RV3) at the pump output of the pressure chamber with a larger effective area with a switchable solenoid valve (PD1) as compared to fig. 4 a. As in fig. 4a, the brake circuits (BK1, BK2) can be connected by means of a bypass valve (BP1) or by means of two bypass valves (BP1, BP2) connected in series. Furthermore, a further switchable isolating valve (TV) can be used in the first brake circuit (BK 1).

As in fig. 4a, during the forward stroke of the piston, the switchable solenoid valve PD1 may be opened and the pressure may be raised in the brake circuit (BK1, BK 2). On the other hand, during the return stroke of the piston, the switchable solenoid valve PD1 may be closed so that at a pressure rise P_{Is raised}During this time, there is no need to deliver brake fluid volume from the brake circuits (BK1, BK2) back into the pressure chambers with the larger effective piston areas.

In contrast to the embodiment in fig. 4a, in the embodiment in fig. 4b, the switchable solenoid valve PD1 may be inOpen after the forward stroke for pressure reduction P_ReduceThereby, for example, a brake fluid volume can flow from the brake circuit (BK1, BK2) back into the pressure chamber of the double-acting piston pump with a larger piston effective area via the open switching valve (SV1, SV2, SV3, SV4), the open bypass valve (BP1, BP2) and the open isolating valve (TV), if present, in the first brake circuit (BK1) and with the central outlet valve (ZAV) closed and the feed switching valve (FV) closed. In this case, this pressure drop P is due to the fact that brake fluid is simultaneously delivered from the pressure chamber with the smaller effective piston area into the second brake circuit_ReduceMay not be complete.

In the hydraulic connection of the double-acting piston pump in fig. 4a, the other check valves (RV3, RV4, RV5, RV6) at the pump input and output can be replaced in each case by a switchable solenoid valve (PD1, PD2, PD3, PD 4). For example, fig. 4c shows another embodiment in which all check valves (RV3, RV4, RV5, RV6) are replaced by solenoid valves. As in fig. 4a, the brake circuits can be connected by means of a bypass valve (BP1) or by means of two bypass valves (BP1, BP2) connected in series. In the embodiment in fig. 4c, a single master cylinder, which may also have a force-travel sensor (KWS) in the piston for pedal force measurement purposes, may also be connected directly to the first brake circuit (BK1), for example via a feed switch valve (FV). In the embodiment according to fig. 4a, a redundant central outlet valve (ZAV2) can be used, the redundant central outlet valve (ZAV2) being connected, for example, to the first brake circuit (BK 1).

By means of different combinations of open and closed solenoid valves (PD1, PD2, PD3, PD4), different operating states of the double-acting piston pump can be set. As in fig. 4b, at pressure drop P_ReduceDuring this time, brake fluid can be returned from the brake circuit (BK1, BK2) to the double-acting piston pump, for example via PD 1. Additionally, brake fluid may be delivered from the respective pressure chamber into the reservoir (VB) by opening a pump input (e.g., PD3) and closing an associated pump output (e.g., PD 1).

FIG. 5a shows anotherIn contrast to fig. 4a, this embodiment has a series cylinder (THZ) instead of a single master cylinder (SHZ). The piston (3) of the brake pedal device can be coupled via a first pressure chamber and a first return spring (RF) to a so-called second floating piston (SK), which in turn can be moved in another pressure chamber against a second return spring (RF 3). As in fig. 4a, for example, the first pressure chamber between the piston (3) and the floating piston (SK) of the tandem master cylinder (THZ) may be connected via a hydraulic output and a first feed switching valve (FV) to a hydraulic line between a first bypass valve (BP1) and a central outlet valve (ZAV). The stroke simulator (WS) may be connected to the tandem master cylinder (THZ) via, for example, a further hydraulic output of the first pressure chamber and a stroke simulator isolation valve (14), if a stroke simulator isolation valve (14) is present. Furthermore, according to the invention, the second pressure chamber of the tandem master cylinder (THZ) can be connected to the second brake circuit (BK2) via a further hydraulic output and a second feed switching valve (FV2) and possibly further valves, wherein for the fallback level the second feed switching valve (FV2) can preferably be designed as a solenoid valve which is open at power failure. The two pressure chambers of the tandem master cylinder (THZ) may each have one ventilation opening or opening, which may each be sealed by at least one main seal (D2, D5) and auxiliary seal (D1, D4) and which may each be connected to the reservoir (VB) via a throttle valve and a check valve which is closed towards the reservoir (VB) connected in parallel, for example as in fig. 1 a. Alternatively, the hydraulic connection between the pressure chamber of the tandem master cylinder and the reservoir (VB) can also be via a diagnostic valve (V) as in fig. 1b and 3b_D) Either via the reservoir shutoff valve (17) as in fig. 3c or via the hydraulic line if redundant main seals (D2, D5) are present.

Under normal conditions, the First (FV) and second (FV2) feed switch valves may be closed during a braking operation, wherein the pressure feed unit (DV) may then raise the brake pressure (BK1, BK2) in the brake circuit by "brake-by-wire" and corresponding valve switching in the Hydraulic Control Unit (HCU).

The use of tandem master cylinders (THZ) may reduce the likelihood of complete master cylinder failure even without other redundant primary or secondary seals relative to a single master cylinder (SHZ).

Fig. 5b shows a further embodiment, which has a tandem master cylinder (THZ) with a plunger, in comparison with fig. 5 a. The piston (3) of the brake pedal device is displaceable in a first pressure chamber between the piston (3) and the floating piston (SK) and is coupled to a further plunger and a further piston which in turn is displaceable into a second pressure chamber against a return spring. The hydraulic connection and function of the tandem master cylinder (THZ) is as in fig. 5 a. The check valve RV3 is connected to the rear chamber of the floating piston (SK) via another hydraulic line and via another opening in the tandem master cylinder.

List of reference numerals

RB1-4 wheel brake

RZ1-4 wheel cylinder

SV1-4 switching valve

EV1-4 inlet valve

AV1-4 outlet valve

BK1, BK2 brake circuit

DG. DG2 pressure sensor

SHZ Single Master Cylinder Unit

THZ, DHZ tandem master cylinder units or synonymous twin master cylinders

KWS force-stroke sensor

GWS yaw angle sensor

Sp1, Sp2 pedal stroke sensor

Sp pedal stroke

Fp pedal force

BP1 and BP2 bypass valve

ZAV, ZAV2 (Central) Outlet valves

FV and FV2 feed switching valve

TV isolating valve

RV1-6 check valve

DV pressure supply unit

HCU hydraulic control unit

ECU electronic control unit

VB storage part

WS stroke simulator

Floating piston of SK series master cylinder

Auxiliary sealing element of D1 master cylinder

Primary seal for D2 master cylinder

Main seal of D3 stroke simulator

Auxiliary seal of D4 floating piston

D5 main seal of floating piston

Redundant auxiliary seal for D1r master cylinder

Redundant primary seal for D2r master cylinder

Redundant primary seal for D3r stroke simulator

Throttle valve in connection between Dr1, Dr4 master cylinder and reservoir

Throttle valve in connection between Dr2 master cylinder and stroke simulator

Throttle valve in Dr3 stroke simulator

Throttle valve in Dr5 backpressure valve 19

V_DDiagnostic valve

RF, RF1-3 return spring

Solenoid valve in connection of PD1-4 double-circuit double-acting piston pump

F spring

1 brake pedal

2 pedal plunger

3 Master cylinder piston

3a part of the piston of the master cylinder

4 Master cylinder housing

5 printed circuit board

6 fill level sensor element

7 sensor target

8 float in reservoir

9 electronic component for a force-characteristic stroke simulator

Redundant electrical connection for 10-feed switching valve

11 double-acting piston with spindle drive

12 redundant connection for motors with 2x3 phase windings

13 electric plug connector for connecting vehicle-mounted electric system

14 stroke simulator isolation valve

15 stop ball

16 sensor rod

17 storage part stop valve

18 ball valve

19 back pressure valve

20 valve plate

21 force-travel characteristic of brake pedal