Hydraulic motor vehicle brake system and method for operating the same

Abstract

Hydraulic motor vehicle braking system (100), comprising: - a first functional unit (110) with at least one first valve arrangement (170, 170') which is designed to selectively connect or disconnect at least one first wheel brake (HL, HR) assigned to a first axle to a prevailing hydraulic pressure; at least one second valve arrangement (174, 174') which is designed to selectively connect or disconnect at least one second wheel brake (VL, VR) associated with a second axle to a prevailing hydraulic pressure; at least one first electric brake pressure generator (132), by means of which a brake pressure can be generated at each of the at least one first and at least one second wheel brake (VL, VR, HL, HR); and a first controller (180) configured to control the at least one first electric brake pressure generator (132) for brake pressure control; - a second functional unit (120) with at least one second electric brake pressure generator (188), by means of which a brake pressure can be generated at at least the at least one second wheel brake (VL, VR); and a second controller (180') which is designed to control the at least one second electric brake pressure generator (188) for brake pressure control at at least the at least one second wheel brake (VL, VR) in the event of a malfunction of the first functional unit (110); - wherein the brake system (100) comprises a switching device (U3) which is designed to selectively couple the first controller (180) or the second controller (180') to the at least one first valve arrangement (170, 170'), depending on the functionality of the first functional unit (110).

Description

Technical area

[0001] The present disclosure generally relates to the field of motor vehicle braking systems. Specifically, a hydraulic motor vehicle braking system and a method for operating the same are described. background

[0002] Conventional hydraulic automotive braking systems based on the brake-by-wire (BBW) principle include an electric brake pressure generator that generates brake pressure at the vehicle's wheel brakes during normal braking. Vehicle deceleration requested by the driver via a brake pedal is detected by sensors and converted into a control signal for the electric brake pressure generator.

[0003] In order to be able to build up braking pressure at the wheel brakes even if the electric brake pressure generator fails, hydraulic braking systems based on the BBW principle usually also include a master cylinder, via which hydraulic fluid can also be supplied to the wheel brakes. In normal braking mode, the brake pedal is decoupled from the master cylinder or the master cylinder is decoupled from the wheel brakes. In this case, braking pressure at the wheel brakes is built up exclusively by means of the electric brake pressure generator. In emergency braking mode, however, for example if the electric brake pressure generator fails, the decoupling is canceled. In this case, the driver himself generates braking pressure at the wheel brakes by means of the brake pedal acting on the master cylinder.

[0004] Emergency braking is also known as push-through (PT) operation due to the absence of a decoupling of the brake pedal and master cylinder, or the master cylinder and wheel brakes. The ability to apply brake pressure to the wheel brakes via the master cylinder in PT operation creates a redundancy that is essential for safety reasons in many cases.

[0005] Motor vehicle braking systems for autonomous or semi-autonomous driving must also be designed with redundancy. However, in such cases, it cannot be assumed that the driver is also in the vehicle (e.g., in remote controlled parking (RCP) mode) or that the driver can immediately press a brake pedal for PT mode (e.g., while looking away from the road). In other words, the driver is no longer a redundant element for generating brake pressure.

[0006] For this reason, a braking system for autonomous or semi-autonomous driving is required to include, in addition to a functional unit that provides an electrically controllable main braking function, a further functional unit that redundantly implements an electrically controllable auxiliary braking function. The brake pedal and the master brake cylinder downstream of it can then be retained or omitted depending on safety requirements.

[0007] For example, DE 10 2012 210 809 A1 discloses a hydraulic motor vehicle brake system which comprises a first functional unit and a second functional unit, as in Fig. 1. The first functional unit comprises at least one first valve arrangement which is designed to selectively connect or disconnect at least one wheel brake assigned to a first axle to a prevailing hydraulic pressure, at least one second valve arrangement which is designed to selectively connect or disconnect at least one second wheel brake assigned to a second axle to a prevailing hydraulic pressure, at least one first electrical brake pressure generator, by means of which a brake pressure can be generated at each of the at least one first and the at least one second wheel brake, and a first controller which is designed to actuate the at least one first electrical brake pressure generator for brake pressure control.The second functional unit comprises at least one second electric brake pressure generator, by means of which a brake pressure can be generated at at least the at least one second wheel brake, and a second controller which is designed to control the at least one second electric brake pressure generator for brake pressure control at at least the at least one second wheel brake in the event of a functional failure of the first functional unit. Brief outline

[0008] The present disclosure is based on the object of specifying a hydraulic motor vehicle brake system which comprises two electrical brake pressure generators in a redundant manner and which meets high safety requirements.

[0009] To achieve this objective, a hydraulic motor vehicle brake system is provided, comprising a first functional unit, a second functional unit, and a switching device. The switching device is configured to selectively couple the first control or the second control to the at least one first valve arrangement, depending on the functionality of the first functional unit.

[0010] The at least one first valve arrangement and the at least one second valve arrangement can each comprise one or more valves. If only one valve is provided per valve arrangement, the valve arrangements can be controlled in multiplex mode. The first valve arrangement and the second valve arrangement can each comprise an ABS isolation valve to selectively connect or disconnect the respective wheel brake from a prevailing hydraulic pressure.

[0011] The switching device can be controlled by the first functional unit or the second functional unit or another component of the braking system to actuate the switching device. The switching device can enable switching of a control path such that a control signal can be supplied to the at least one first valve device from only one of the two functional units at a time.

[0012] The hydraulic pressure prevailing in the braking system can be generated in different ways. It is conceivable that the hydraulic pressure is generated by the first electric brake pressure generator, by the second electric brake pressure generator, or by the driver using a brake pedal and a master cylinder.

[0013] The functional failure of the first functional unit can be a total or partial failure of the first functional unit. For example, the first electrical brake pressure generator or the first control unit or another component of the first functional unit can fail. It is also conceivable that both the first electrical brake pressure generator and the first control unit fail simultaneously. The functional failure of the first functional unit can be detected by the first functional unit itself and signaled to the second functional unit. Additionally or alternatively, the second functional unit can also be designed to detect a functional failure of the first functional unit.

[0014] The second functional unit can be configured to redundantly perform one, several, or all of the brake pressure control functions that the first functional unit is capable of performing. Examples of vehicle-stabilizing brake pressure control functions that can be performed by the first and / or second functional unit include one or more of the following functions: anti-lock braking system, traction control, vehicle dynamics control, and automatic distance control. The second functional unit can also be configured to control the second electric brake pressure generator in the event of a fault in the first functional unit, particularly as part of a brake pressure-controlled normal braking operation, also known as service braking.

[0015] The wheel brakes can comprise front-wheel brakes and rear-wheel brakes. The wheel brakes at which the second electric brake pressure generator is each capable of generating a brake pressure can be a true subset or a spurious subset of the wheel brakes at which the first electric brake pressure generator is each capable of generating a brake pressure. In the case of a spurious subset, the second electric brake pressure generator is each capable of generating a brake pressure at all wheel brakes at which the first electric brake pressure generator is also capable of generating a brake pressure. According to an exemplary true subset, the subset of wheel brakes comprises exclusively the front-wheel brakes of the motor vehicle. In this example, the wheel brakes of the rear wheels are therefore not included in the subset of wheel brakes.

[0016] The first functional unit may comprise a brake cylinder that can be coupled to a brake pedal. Furthermore, the first functional unit may be provided with a hydraulic switching device to selectively couple the first brake pressure generator or the master cylinder to at least one of the wheel brakes.

[0017] The two functional units can be logically and / or physically separated from each other. Physically separated functional units can be housed in different housings or housing parts, at least to the extent of some of their components. The different housings or housing parts can be attached directly to each other, i.e., at least almost seamlessly, and thus be considered two sub-housings of a larger overall housing.

[0018] The switching device can be configured to couple the second controller to the at least one first valve arrangement in the event of a malfunction of the first functional unit. Additionally or alternatively, the second controller can be configured to control the at least one first valve arrangement in response to an associated wheel signal. The wheel signal can indicate a wheel speed.

[0019] According to one variant, the second control system is designed to actuate the at least one first valve arrangement as part of an ABS control system in order to prevent locking of an associated wheel. The ABS control system can include wheel slip control, in particular with respect to a target slip. The target slip can be zero or different from zero.

[0020] The second controller can be configured to move the at least one first valve arrangement for hydraulic pressure limitation on the associated first wheel brake into a closed position. In this case, the corresponding first wheel brake is therefore isolated from the prevailing hydraulic pressure. The prevailing hydraulic pressure to be limited can be generated by a driver using a brake pedal in a master cylinder. Alternatively, the prevailing hydraulic pressure to be limited can be generated by the second controller controlling the first electric brake pressure generator.

[0021] According to one variant, no brake pressure can be generated at the at least one first wheel brake by means of the at least one second electric brake pressure generator. For example, the braking system can be designed such that brake pressure can be generated only at the at least one second wheel brake assigned to the second axle by means of the at least one second electric brake pressure generator.

[0022] In one implementation, the switching device is embodied as a transistor-based circuit. The switching device can be integrated into the first functional unit. For example, the first functional unit can comprise a control unit into which the switching device is integrated. In general, the first controller and the second controller can be implemented as separate control units.

[0023] The braking system may comprise at least one electric parking brake actuator configured to generate a braking force on a vehicle wheel. In this case, the second controller may further be configured to selectively or jointly control the following: the at least one second electric brake pressure generator and the at least one parking brake actuator.

[0024] The at least one electric parking brake actuator can be assigned to at least one vehicle wheel of the first axle. However, no electric parking brake actuator can be assigned to the second axle. In this case, the braking system can be configured to generate a brake pressure at the at least one second wheel brake by means of the at least one second electric brake pressure generator. However, no brake pressure can be generated at the at least one first wheel brake by means of the at least one second electric brake pressure generator.

[0025] The second controller can be configured to control the at least one parking brake actuator to cause a vehicle deceleration in the event of a functional failure of the first functional unit. In this case, the vehicle deceleration can be due solely to the closing of the at least one parking brake actuator (e.g., if the first and second electric brake pressure generators are not or cannot be controlled). Alternatively or additionally, the second controller can be configured to control the at least one parking brake actuator to increase or decrease a prevailing vehicle deceleration in the event of a functional failure of the first functional unit. For example, by closing the at least one parking brake actuator, a vehicle deceleration can be increased that is generated in normal braking mode by the second electric brake pressure generator or in PT mode by the driver acting on the master cylinder.The second controller may also be configured to transfer the at least one parking brake actuator from a closed state to an open state in order to reduce a prevailing vehicle deceleration.

[0026] The second controller can be configured to control the at least one parking brake actuator to increase the vehicle deceleration resulting from the activation of the second electric brake pressure generator. In this case, the second controller can jointly control the at least one second electric brake pressure generator and the at least one parking brake actuator in order to achieve high vehicle deceleration, for example, during normal braking operation. Such a procedure is useful, for example, when the second electric brake pressure generator and the at least one parking brake actuator act on different vehicle axles.

[0027] The second controller can be configured to control the at least one parking brake actuator to increase the vehicle deceleration resulting from the brake pressure generated by a driver in a master cylinder using a brake pedal. For example, in PT mode, brake force boosting can occur using the at least one parking brake actuator. In this way, high vehicle deceleration can still be ensured even if the first and second electric brake pressure generators fail.

[0028] The second controller can be configured to control the at least one parking brake actuator when a driver actuates a brake pedal to perform normal braking. However, the second controller can also control the at least one parking brake actuator independently of brake pedal actuation, for example, in conjunction with a vehicle-stabilizing brake force control (e.g., to compensate for oversteering or understeering of the vehicle).

[0029] In general, the second controller can be designed to control the at least one parking brake actuator for vehicle-stabilizing brake force control, particularly in the event of a functional failure of the first functional unit (and a possible simultaneous functional failure of the second electric brake pressure generator). In this way, high availability of the brake pressure control functions exemplified above is ensured. The second controller can be designed to control the at least one parking brake actuator together with the second electric brake pressure generator for vehicle-stabilizing brake force control. Such joint control is useful, for example, when the at least one parking brake actuator and the at least one second electric brake pressure generator act on different vehicle wheels or different vehicle axles and brake pressure control is required on several wheels simultaneously.

[0030] The first controller can also be configured to control the at least one parking brake actuator. In other words, a specific parking brake actuator can be controlled by both the first controller and the second controller. The control of the at least one parking brake actuator by the first controller can occur in conjunction with regular parking brake operation.

[0031] The first controller and the second controller can be implemented using redundant microprocessors. In particular, the first controller and the second controller can be implemented in separate control units, each with its own associated microprocessor.

[0032] According to one variant, the wheel brakes at which the first electric brake pressure generator is capable of generating braking pressure include the front wheel brakes and the rear wheel brakes. According to this variant, the subset of wheel brakes at which the second electric brake pressure generator is capable of generating braking pressure can include exclusively the front wheel brakes (and not the rear wheel brakes). Additionally or alternatively, at least two electric parking brake actuators are provided, each capable of generating braking force exclusively on the front wheels or exclusively on the rear wheels.

[0033] The generation of the braking force by the at least one electric parking brake actuator can be based on a mechanical or hydraulic principle. According to one variant, the at least one electric parking brake actuator is an electromechanical parking brake actuator.

[0034] To achieve this objective, a method for operating a hydraulic motor vehicle brake system is also provided, comprising a first functional unit, a second functional unit, and a switching device. The method comprises the step of selectively coupling the first control or the second control to the at least one first valve arrangement by the switching device, depending on the functionality of the first functional unit.

[0035] The method may comprise one or more further steps as described above and below.

[0036] Furthermore, a computer program product is specified which comprises program code for carrying out the method presented here when the program code is executed on a motor vehicle control unit.

[0037] Also specified is a motor vehicle control unit or control unit system (comprising a plurality of control units), wherein the control unit or control unit system has at least one processor and at least one memory, and wherein the memory comprises program code which, when executed by the processor, causes the steps of the method specified here to be carried out. Character list

[0038] Further aspects, details, and advantages of the present disclosure will become apparent from the following description of exemplary embodiments with reference to the figures. They show: Fig. 1 an embodiment of a hydraulic motor vehicle brake system; Fig. 2 an illustration of control aspects in connection with the braking system according to Fig. 1; and Fig. 3 a schematic representation of EPB-assisted braking. Detailed description

[0039] In Fig. Figure 1 shows the hydraulic circuit diagram of a first embodiment of a hydraulic motor vehicle brake system 100 according to the BBW principle. The brake system 100 is designed to be suitable for autonomous or semi-autonomous driving.

[0040] As in Fig. 1, the braking system 100 comprises a first functional unit 110, which provides an electrically controllable main braking function, and a second functional unit 120, which redundantly implements an electrically controllable auxiliary braking function. While the first functional unit 110 is designed to build up braking pressure at two front wheel brakes VL, VR and two rear wheel brakes HL, HR of a two-axle motor vehicle, the second functional unit 120 is designed to build up braking pressure only at the two wheel brakes VL, VR of the front wheels. In alternative exemplary embodiments, the second functional unit 120 could be designed to build up braking pressure only at the two wheel brakes HL, HR of the rear wheels, at all four wheel brakes VL, VR, HL, HR, or at two diagonally opposite wheel brakes VL / HR or VR / HL.

[0041] The first functional unit 110 is designed to perform wheel brake pressure control on one or more of the front, rear, rear, and rear wheel brakes, decoupled from a driver's braking command. The second functional unit 120 can perform at least some wheel brake pressure control functions of the first functional unit 110 redundantly on the front and rear wheel brakes.

[0042] The two functional units 110, 120 can be housed as separate modules in separate housing blocks. Depending on requirements, the first functional unit 110 can be installed either alone or in combination with the second functional unit 120.

[0043] How Fig. 1, the brake system 100 comprises two electric parking brake actuators EPB1, EBP2. In the exemplary embodiment, a first parking brake actuator EPB1 is assigned to the left rear wheel, and a second parking brake actuator EPB2 is assigned to the right rear wheel. In other exemplary embodiments, the parking brake actuators EPB1, EBP2 are assigned to the front wheels. A parking brake actuator can also be provided on each of the four wheels. The parking brake actuators EPB1, EPB2 can be integrated with the wheel brakes HL, HR in a single structural unit.

[0044] Each of the parking brake actuators EPB1, EBP2 comprises an electric motor and a transmission connected downstream of the electric motor. The transmission converts the rotational movement of the electric motor into a translational movement of a brake piston of one of the wheel brakes HL, HR. This allows the brake piston to be brought into contact with an associated brake disc to generate braking force.

[0045] Referring to Fig. 1, the brake system 100 operates by means of a hydraulic fluid, which is partially stored in a pressureless reservoir 122. Brake pressures at the front, rear, rear wheel brakes can be generated independently of one another by pressurizing the hydraulic fluid using the first functional unit 110 and the second functional unit 120.

[0046] The first functional unit 110 comprises a first electric brake pressure generator 132 for generating brake pressure autonomously, semi-autonomously, or upon request by the driver at a brake pedal 130 in BBW mode. In the exemplary embodiment, this brake pressure generator 132 comprises a double-acting cylinder-piston arrangement 134 based on the plunger principle with two cylinder chambers 136, 136' and a piston 138 movable therein. The piston 138 of the brake pressure generator 132 is driven by an electric motor 140 via a gear 142. In the exemplary embodiment, the gear 142 is designed to convert a rotational movement of the electric motor 140 into a translational movement of the piston 138. In another exemplary embodiment, the brake pressure generator 132 could also be designed as a single-acting cylinder-piston arrangement with only one cylinder chamber.

[0047] The two cylinder chambers 136, 136' can be coupled to the reservoir 122 as well as to two brake circuits I and II, with each brake circuit I and II in turn supplying two wheel brakes (front, rear, left, right) and front, rear, respectively. A different allocation of the four wheel brakes (front, rear, left, right) to the two brake circuits I and II is also possible (e.g., a diagonal distribution).

[0048] In the present embodiment, two valves 144, 146, which are actuated by electromagnets and connected in parallel, are assigned to the electric brake pressure generator 132. According to the principle of double action, the valve 144 serves to fluidically couple one of the chambers 136, 136' to the two brake circuits I and II, while the other of the chambers 136, 136' draws hydraulic fluid from the reservoir 122. The optional valve 146 can be actuated in connection with venting the hydraulic system or other operations. In the unactuated, i.e. electrically non-actuated, state, the valves 144, 146 assume the Fig. 1. This means that valve 144 assumes its flow position and valve 146 assumes its blocking position, so that during a forward stroke (in Fig. 1 to the left) the piston 138 displaces hydraulic fluid from the front chamber 136 into the two brake circuits I. and II. In order to Fig. 1 to the right) of the piston 138 to displace hydraulic fluid from the rear chamber 136' into the two brake circuits I. and II., only the valve 144 is activated, i.e. moved into its blocking position.

[0049] To generate brake pressure in PT mode, the first functional unit 110 further comprises a master cylinder 148, which is actuated by the driver via the pedal 130. The master cylinder 148, in turn, comprises two chambers 150, 150', wherein the first chamber 150 is coupled to the first brake circuit I and the second chamber 150' is coupled to the second brake circuit II.

[0050] By means of the master cylinder 148, the two brake circuits I and II (in a redundant manner to the electric brake pressure generator 132) can be supplied with pressurized hydraulic fluid. For this purpose, two solenoid-operated valves 152, 154 are provided, which, in the unactuated, i.e., electrically non-controlled, state, Fig. 1. In these basic positions, the valves 152, 154 couple the master cylinder 148 to the front, rear, left, and right wheel brakes. Thus, even in the event of a power supply failure (and a concomitant failure of the electric brake pressure generator 132), the driver can still build up hydraulic pressure at the front, rear, left, and right wheel brakes by means of the brake pedal 130 acting on the master cylinder 148 (PT operation).

[0051] In BBW operation, however, the valves 152, 154 are switched in such a way that the master cylinder 148 is fluidically decoupled from the two brake circuits I and II, while the electric brake pressure generator 132 is coupled to the brake circuits I and II. When the master cylinder 148 is decoupled from the brake circuits I and II, the hydraulic fluid displaced from the master cylinder 148 is not pumped into the brake circuits I and II when the brake pedal 130 is actuated, but via a 2 / 2-way valve 156 actuated by an electromagnet and a throttle device 158 into a simulator 160. The valve 156, in its electrically non-controlled basic position in BBW operation, assumes the Fig. 1, in which the master cylinder 148 is decoupled from the simulator 160 so that hydraulic fluid can be pumped into the brake circuits I and II.

[0052] The simulator 160 is designed to provide the driver with the familiar pedal feedback behavior when the master cylinder 148 is hydraulically decoupled from brake circuits I and II. To receive hydraulic fluid from the master cylinder 148, the simulator 160 includes a cylinder 162 in which a piston 164 can be displaced against a spring force.

[0053] Another 2 / 2-way valve 166, actuated by an electromagnet, between the master cylinder 148 and the reservoir 122, in its electrically non-controlled basic position according to Figure 1, allows hydraulic fluid to flow from the reservoir 122 into the master cylinder 148 during PT operation. In its electrically controlled position, however, the valve 166 decouples the master cylinder 148 from the reservoir 122.

[0054] In other embodiments, the functional decoupling of brake pedal 130 and wheel brakes VL, VR, HL, HR can also be achieved by connecting a cylinder upstream of master cylinder 148, on which the brake pedal 130 can act. This cylinder is coupled to simulator 160 via valve 156 and throttle device 158 in BBW mode, and to master cylinder 148 in PT mode.

[0055] The hydraulic coupling of the wheel brakes VL and VR is determined by 2 / 2-way valves 170, 172, 174, 176 or 170', 172', 174', 176', which are actuated by electromagnets and which, in the unactuated, i.e. electrically not controlled, state, Fig. 1. This means that valves 170, 174 and 170', 174' respectively assume their flow position, and valves 172, 176 and 172', 176' respectively assume their blocking position. Since the two brake circuits I and II are symmetrical, a description of the components assigned to the second brake circuit II or the wheel brakes HL and HR is omitted here and below.

[0056] As in Fig. As shown in Figure 1, the second functional unit 120 is arranged in the fluid path between the valves 174, 176 and the wheel brake VL (and for reasons of symmetry, the same applies to the wheel brake VR). The second functional unit 120 assumes a through-flow position when the first functional unit 110 is fully functional and / or in PT operation. This means that hydraulic fluid escaping from the first functional unit 110 can reach the wheel brakes VL, VR unhindered. To carry out normal braking, therefore, the Fig. 1, a direct hydraulic connection is established between the electric brake pressure generator 132 (or, depending on the position of the valves 152, 154, the master cylinder 148) on the one hand and, on the other hand, the wheel brakes HL or VL of the first brake circuit I. (and the same applies to the wheel brakes HR or VR of the second brake circuit II.).

[0057] The two valves 170 and 172 form a valve arrangement assigned to the wheel brake HL, while the two valves 174 and 176 form a valve arrangement assigned to the wheel brake VL. From the perspective of the electric brake pressure generator 132, the second functional unit 120 is thus provided downstream of the valve arrangement 174, 176 and connected between this valve arrangement 174, 176 and the associated wheel brake VL.

[0058] As will be explained below, the two valve assemblies 170, 172 and 174, 176 assigned to the wheel brakes HL and VL, as well as the brake pressure generator 132, are each designed to be controlled for wheel brake pressure control processes at the respective wheel brake HL or VL. A control unit 180 (also referred to as Electronic Control Unit, ECU) provided for controlling the valve assemblies 170, 172 and 174, 176 and the brake pressure generator 132 within the framework of the wheel brake pressure control processes is also shown schematically in Fig. 1. The control unit 180 is part of the first functional unit 180 and implements, for example, the vehicle-stabilizing wheel brake pressure control functions of an anti-lock braking system (ABS), a vehicle dynamics control system (Electronic Stability Control, ESC), a traction control system (ASR), or an adaptive cruise control system (ACC). Of course, instead of a single control unit 180, a plurality of such control units can also be provided, each responsible for different wheel brake pressure control functions (possibly in a complementary or redundant manner).

[0059] The second functional unit 120 also includes a control unit 180', which is provided separately from the control unit 180 for redundancy reasons and also implements one or more (or all) of the above-mentioned vehicle-stabilizing brake pressure control functions. In addition or alternatively to providing separate control units 180, 180', two redundant electrical power supplies and / or separate electrical power supplies for the two functional units 110, 120 could also be provided. These power supplies can be configured as two accumulators.

[0060] The purpose of anti-lock braking control (ABS) is to prevent the wheels from locking during braking. To achieve this, the brake pressure in the front, front, rear, and rear wheel brakes must be individually modulated. This is achieved by setting alternating pressure build-up, pressure maintenance, and pressure reduction phases in a temporal sequence, which are achieved by appropriately controlling the valve assemblies 170, 172 or 174, 176 assigned to the front and rear wheel brakes, respectively, and, if applicable, the brake pressure generator 132.

[0061] During a pressure buildup phase, valves 170, 172, and 174, 176 each assume their home position, so that the brake pressure in the front wheel brakes (HL) and front wheel brakes (FL) is increased (as in a brake-assisted braking operation) by means of the brake pressure generator 132. For a pressure-maintaining phase, only valve 170 or 174 is activated, i.e., moved to its locked position. Since valve 172 or 176 is not activated during this phase, it remains in its locked position. This hydraulically decouples the front wheel brakes (HL) and front wheel brakes (FL), so that the brake pressure present in the front wheel brakes (HL) and front wheel brakes is maintained constant. During a pressure reduction phase, both valve 170 or 174 and valve 172 or 176 are activated, i.e. valve 170 or 174 is moved to its blocking position and valve 172 or 176 is moved to its flow position. Thus, hydraulic fluid can flow from the wheel brake HL or VL towards the reservoir 122 in order to create a pressure drop in the wheel brake HL orTo reduce the brake pressure applied to the VL.

[0062] Other brake pressure control processes during normal braking operation are automated and typically independent of the driver's actuation of the brake pedal 130. Such automated wheel brake pressure controls occur, for example, in conjunction with an acceleration skid control (ASR), which prevents individual wheels from spinning during a start-off maneuver by selectively braking, an electronic stability control (ESC), which adapts vehicle behavior at the limit to the driver's input and the road conditions by selectively braking individual wheels, or an adaptive cruise control (ACC), which, among other things, maintains a distance between the vehicle and a vehicle ahead by automatically braking.

[0063] When carrying out an automatic wheel brake pressure control, a brake pressure can be built up at at least one of the wheel brakes HL or VL by controlling the brake pressure generator 132 by the control unit 180. In this case, the valves 170, 172 and 174, 176 assigned to the wheel brakes HL or VL initially take up their Fig. 1. Fine adjustment or modulation of the brake pressure can be performed by appropriately controlling the brake pressure generator 132 and the valves 170, 172 and 174, 176 assigned to the wheel brakes HL and VL, respectively, as explained above in connection with the ABS control.

[0064] Wheel brake pressure control by control unit 180 generally occurs as a function of one or more measured variables describing the vehicle's behavior (e.g., wheel speed, yaw rate, lateral acceleration, etc.) and / or one or more measured variables describing the driver's request (e.g., actuation of pedal 130, steering wheel angle, etc.). A driver's desired deceleration can be determined, for example, by means of a travel sensor 182 coupled to the brake pedal 130 or an input element of the master brake cylinder 148. Alternatively or additionally, the brake pressure generated by the driver in the master brake cylinder 148 can be used as the measured variable describing the driver's request; this pressure is then detected by at least one sensor. Fig. 1, each of the brake circuits I. and II. is assigned its own pressure sensor 184, 184'.

[0065] As explained above, from the perspective of the brake pressure generator 132, the second functional unit 120 is provided downstream of the valve arrangement 174, 176 and is connected between this valve arrangement 174, 176 and the associated wheel brake VL. Specifically, a hydraulic fluid inlet of the second functional unit 120 is coupled between an outlet of the valve 174 and an inlet of the valve 176 (as viewed in the flow direction from the pressure generator 132 to the reservoir 122).

[0066] As in Fig. 1, the second functional unit 120 comprises a further electric brake pressure generator 188. The further brake pressure generator 188 can be controlled by the control unit 180' and, in the exemplary embodiment, comprises an electric motor 190 and, for each brake circuit I or II (here: for each wheel brake VL or VR), a pump 192, 192' designed, for example, as a gear or radial piston pump. In the exemplary embodiment, each pump 192, 192' is blocking against its delivery direction, as shown by the (optional) check valves at the output and inlet of the pumps 192, 192'. The pumps 192, 192' are each configured to suck hydraulic fluid from the reservoir 122 via the first functional unit 110. Since the speed of the electric motor 192 is adjustable, the flow rate of the pumps 192, 192' can also be adjusted by means of appropriate control of the electric motor 192.In another embodiment, the two pumps 192, 192' could also be replaced by a single pump operating according to the plunger principle (for example with a single- or double-acting cylinder-piston arrangement).

[0067] The second functional unit 120 is also designed symmetrically with respect to brake circuits I and II. Therefore, only the components of the second functional unit 120 assigned to the first brake circuit I (here: the wheel brake VL) will be explained in more detail below. These components include a pressure sensor 196, which enables the pressure generator 188 (and thus the pump 192) to be controlled to a target pressure value. The pressure evaluation and the control of the pressure generator 188 are carried out, as explained above, by the control unit 180'. An optional pressure sensor (not shown) provided on the input side of the second functional unit 120 could be provided to detect a driver braking (e.g., via the master cylinder 148) into the active second functional unit 120. In this way, for example, an ACC control currently being performed by the second functional unit 120 could be aborted in favor of emergency braking of the vehicle to a standstill.

[0068] If a functional failure of the first functional unit 110 is detected (e.g., due to a failure of the pressure generator 132 or a leak in the area of ​​the first functional unit 110), the second functional unit 120 can take over brake pressure generation and, in particular, brake pressure control at the front and rear wheel brakes in a redundant manner to the first functional unit 110. For example, if the first functional unit 110 fails, the second functional unit 120 can autonomously perform one or more of the following (or other) brake pressure control functions: brake booster, ABS, ESC, ASR, and ACC.

[0069] The redundancy created by the second functional unit 120 therefore enables the use of the Fig. The motor vehicle brake system 100 shown in Figure 1 is also suitable for semi-autonomous or autonomous driving applications. Particularly in the latter application, the master cylinder 148 and its accompanying components (such as the brake pedal 130 and the simulator 160) could be completely omitted.

[0070] The two functional units 110, 120 share a hydraulic system (namely that of the first functional unit 110 with the reservoir 122). Thus, the second functional unit 120 is also operated entirely with hydraulic fluid from the reservoir 122 and pumps the hydraulic fluid back into this reservoir 122. When the second functional unit 120 is in use, the pump 192 therefore draws fluid directly from the reservoir 122 via the corresponding inlet-side connection to the first functional unit 110 (and the correspondingly open valve 176).

[0071] A bypass valve 302, designed in the exemplary embodiment as a 2 / 2-way valve actuated by an electromagnet, is connected in parallel to the pump 192. This valve 302, in the unactuated, i.e. electrically non-controlled, state, takes the Fig. 1. "Basic position" here means that valve 302 assumes its flow position. In this way, hydraulic fluid can be pumped from the first functional unit 110 to the wheel brake VL and flow back to the first functional unit 110 (and to the reservoir 122). Valve 302 is controlled by control unit 180'.

[0072] In the electrically controlled state, valve 302 assumes a blocking position such that hydraulic fluid delivered by pump 192 reaches the wheel brake VL and cannot escape to the first functional unit 110. Such escape (in the through position of valve 302) may, however, be desired within the scope of pressure control by the second functional unit 120 when brake pressure at the wheel brake VL needs to be reduced (e.g., within the scope of ABS control). Since valve 302 only blocks on one side in its blocking position in the exemplary embodiment, the brake pressure at the wheel brake VL can still be increased by means of the first functional unit 110 (e.g., when actuating master cylinder 148 in PT mode).

[0073] Furthermore, the second functional unit 120 includes an optional reservoir 402, which provides additional hydraulic fluid volume for suction by the pump 192. The reason for this storage of additional hydraulic volume is the fact that the suction path of the pump 192 through the first functional unit 110 may not be able to provide hydraulic fluid volume sufficiently quickly, especially at low temperatures. Depending on the design of the functional units 110, 120, the provision of additional hydraulic fluid volume may also be generally desired (possibly temperature-independent) to support a rapid pressure buildup at the wheel brake VL.

[0074] In the present embodiment, accumulator 402 is designed as a pressure accumulator, specifically as a spring-loaded piston accumulator. The pressure accumulator 402 could also be a diaphragm accumulator or a piston sealed with a rolling bellows. The pressure accumulator 402 is arranged so that fluid can flow between the inlet of pump 192 and the hydraulic interface to the first functional unit 110 on the one hand, and the valve 302 on the other. The flow-through arrangement allows for easy venting and changing of the hydraulic fluid during regular servicing.

[0075] In other embodiments, the accumulator 402 can be a fluid accumulator designed as a piston accumulator that does not require a return spring. This piston accumulator is provided in a fluid path between the pump 192 and the valve 302 on the one hand, and the first functional unit 110 and the second valve 502 on the other. The piston accumulator can be provided with a lip seal that can seal the piston against atmospheric pressure. As already mentioned at the beginning, however, a return spring or similar element is missing to urge the piston back into its storage position after the piston accumulator has been partially or completely emptied. The storage position corresponds to the position in which the piston accumulator is essentially filled to its maximum with hydraulic fluid.

[0076] When hydraulic fluid is sucked from the piston accumulator by the pump 192, its piston then moves from its storage position to a withdrawal position. In order to then force the piston back from this withdrawal position to its storage position, it is provided that hydraulic fluid flowing back from the pressurized wheel brake VL, VR towards the first functional unit 110 can force the piston into its storage position. For this purpose, the valve 502 is closed and the valve 302 is opened so that the returning hydraulic fluid can reach the piston accumulator. In this process, its piston is displaced against atmospheric pressure until a line communicating with the cylinder of the piston accumulator to the first functional unit 110 is released.A spring-loaded check valve can be provided in this line, allowing hydraulic fluid to flow back to the first functional unit 110 but blocking it in the opposite direction. The opening pressure for opening the check valve is selected to be comparatively low and amounts to less than 1 bar (e.g., 0.5 bar).

[0077] Parallel to the line between the piston accumulator and the first functional unit 110 in which the check valve is accommodated, a second check valve can be provided in a further line between the first functional unit 110 and the piston accumulator, which second check valve is arranged opposite the first check valve. This second check valve allows hydraulic fluid to be sucked in by means of the pump 192 from the first functional unit 110 through the piston accumulator (and has a blocking effect in the opposite direction). The line with the second check valve is attached to the cylinder of the piston accumulator in an axially offset manner with respect to the line with the first check valve such that hydraulic fluid can be sucked in from the first functional unit 110 through the cylinder in any position of the piston.

[0078] Furthermore, the second functional unit 120 comprises an optional further bypass valve 502, which is arranged parallel to the bypass valve 302 and is switched together with it. The valve 502, which in the exemplary embodiment is designed as an electromagnetically actuated 2 / 2-way valve, takes up the Fig. 1. As with valve 302, the basic position means that valve 502 assumes its flow position. Valve 502 can be controlled by control unit 180.

[0079] Thus, hydraulic pressure at the wheel brake VL can still be reduced via the open valve 502 even if the bypass valve 302 is incorrectly closed or if the pressure accumulator 402 through which the flow is blocked experiences a fault. In addition, the two valves 302 and 502 connected in parallel reduce the flow resistance from the first functional unit 110 to the wheel brake VL, so that if a rapid pressure build-up at the wheel brake VL is required, the so-called "time to lock" of this wheel brake VL is also reduced. It goes without saying that this is the same for the wheel brake VR. In general, all statements made in connection with the exemplary embodiments regarding the wheel brake VL also apply to the wheel brake VR due to the symmetrical design of the braking system 100.

[0080] According to the embodiment of Fig. 1, only the two front wheel brakes VL, VR are connected to the second functional unit 120. In other exemplary embodiments, all four wheel brakes VL, VR, HL, HR are connected to the second functional unit 120. The second functional unit 120 is then capable of building up brake pressure (and in particular, controlling brake pressure) at all of these wheel brakes VL, VR, HL, HR. For this purpose, a hydraulic fluid inlet of the second functional unit 120, for example for the left rear wheel HL, can be coupled between an outlet of the valve 170 and an inlet of the valve 172 (as viewed in the flow direction from the pressure generator 132 to the reservoir 122).

[0081] While in Fig. 1 primarily illustrates the hydraulic layout of the brake system 100, will now be described with reference to Fig. 2, the electronic layout of the brake system 100 and, in particular, the electrical control of some of the components installed in the brake system 100 are explained in more detail. The same reference numerals denote the same or corresponding components. It should be noted that the Fig. 2 can also be used in braking systems that differ from the Fig. 1 shown brake system 100 deviate.

[0082] In Fig. Figure 2 again shows the division of various components of the brake system 100 into a first functional unit 110 and a second functional unit 120. The hydraulic components of the first functional unit 100, such as its valves and the brake pressure generator 132, are combined to form a first hydraulic system HS1. Similarly, the corresponding components of the second functional unit 120, such as its valves and the brake pressure generator 188, are combined to form a second hydraulic system HS2. Particular emphasis is placed on the two valves 170, 170' of the hydraulic system HS1 and the pressure sensor 196 of the hydraulic system HS2, which will be discussed in more detail below.

[0083] The relevant software functions for each of the control units 180, 180' are highlighted. The microprocessor of the control unit 180 is designed to implement the software functions of a basic brake 180A, a stability control 180B, and an actuator control 180C. Similarly, the microprocessor of the control unit 180' is designed to implement the software functions of a basic brake 180'A, a stability control 180'B, and an actuator control 180'C. The basic brake functions 180A, 180'A are designed to control the hydraulic system HS1 or HS2 in connection with normal braking. The stability control functions 180B, 180'B allow, among other things, control of the respectively assigned brake pressure generator 132 or 188 in connection with a vehicle-stabilizing brake pressure control (as already described with reference to Fig. 1). Finally, the actuator control functions 180C, 180'C allow electrical control of the two parking brake actuators EPB1 and EPB2, respectively. These parking brake actuators EPB1, EPB2 are Fig. 2 each shown with the corresponding hydraulic wheel brake HL or HR installed to form a single wheel brake unit.

[0084] In Fig. 2 further illustrates several sensors of the brake system 100. In addition to the pedal travel sensor 182 and the pressure sensor 196, which have already been described with reference to Fig. 1, the braking system 100 further comprises four wheel sensors 202, 204, 206, 208. These wheel sensors 202, 204, 206, 208 are each assigned to one of the four vehicle wheels and allow the corresponding wheel speed or wheel velocity to be determined. An acceleration sensor 210 detects the longitudinal acceleration ax of the vehicle, and a brake light switch 212 generates a brake light signal in a known manner when the brake pedal 130 is actuated.

[0085] The braking system 100 also includes several switching devices U1, U2, U3. The two switching devices U1, U3 are part of the first functional unit 110 and can also be integrated into the control unit 180. The switching device U2 is part of the second functional unit 120 and can also be integrated into the control unit 180'.

[0086] In the following, various aspects related to the control of the parking brake actuators EPB1, EPB2 by the control unit 180' are explained. As already mentioned above, the second control unit 180' is capable of selectively or jointly controlling the brake pressure generator 188 (using the basic brake function 180A' or the stability control function 180B) and one or both of the parking brake actuators EPB1, EPB2 (using the actuator control function 180C). In general, one or both of the parking brake actuators EPB1, EPB2 are controlled by the control unit 180' at a fallback level, i.e., in the event of a functional failure of the first functional unit 110 (for example, in the event of a failure of the control unit 180). The activation of one or both of the parking brake actuators EPB1, EPB2 can, among other things, be used to cause, increase or decrease a vehicle deceleration or to increase or decrease a wheel speed for each wheel.This is characterized by the fact that when one or both of the parking brake actuators EPB1, EPB2 are activated by the control unit 180', the vehicle is in motion (for example, at a speed of more than 10 km / h). In addition, in some implementations, the control unit 180' can also activate the two parking brake actuators EPB1, EPB2 when the vehicle is stationary. This enables a conventional parking brake operation to park the vehicle even in the event of a malfunction of the first functional unit 110.

[0087] In the following, various scenarios are described as to how, in the event of a functional failure of the first functional unit 110, one or both of the parking brake actuators EPB1, EPB2 are controlled by the control unit 180' together with or independently of the brake pressure generator 188.

[0088] The first control scenario concerns ABS control on one or both wheels of the front axle and on one or both wheels of the rear axle. To implement ABS control in the fallback level on a front wheel, the stability control function 180'B controls the brake pressure generator 188 (and / or other components of the hydraulic system HS2). In this way, the respective wheel slip can be controlled at the wheel brake VL of the left front wheel and / or the wheel brake VR of the right front wheel. This slip control by the stability control function 180'B is based on the front wheel speeds as provided by the two wheel sensors 202, 204.

[0089] Since the brake pressure generator 188 is in accordance with the Fig. 1 is unable to build up braking pressure at the rear wheel brakes HL, HR, slip control at the two rear wheels is carried out by controlling one or both of the parking brake actuators EPB1, EPB2 by the control unit 180'. Slip control is performed by the stability control function 180'B based on the rear wheel speeds received from the wheel sensors 206, 208. Based on an evaluation of the rear wheel speeds, the stability control function 180'B then generates control signals for the actuator control 180'C, which in turn can control the parking brake actuators EPB1, EPB2 individually or jointly. It should be noted that such slip control at the rear wheels remains possible even if the hydraulic system HS2 fails.

[0090] A second control scenario for vehicle-stabilizing brake force control is oversteer control in conjunction with an ESC control intervention. When the vehicle begins to oversteer, the front wheel facing the direction of the vehicle's deflection is actively braked. This braking can be taken over by the second functional unit 120 if the first functional unit 110 fails. For this purpose, the stability control function 180'B of the control unit 180' controls the hydraulic system HS2 and in particular the brake pressure generator 188 (see Figure 1) in a suitable manner in order to build up brake pressure at the affected front wheel brake VL, VR. The sensor signals evaluated by the stability control function 180'B in this context relate, for example, to a vehicle yaw rate, a vehicle lateral acceleration, and / or the steering angle.If electric parking brake actuators are also installed on the front wheels, the stability control function 180'B can also control these via the actuator control 180'C in order to achieve oversteer control by braking the corresponding front wheel.

[0091] A third control scenario for vehicle-stabilizing brake force control in the event of a functional failure of the first functional unit 110 is understeer control. When the vehicle begins to understeer, the inside rear wheel is typically actively braked, among other measures. Since the second functional unit 120 cannot build up brake pressure on the rear axle using the brake pressure generator 188 (see Figure 1), the parking brake actuator EPB1, EPB2 of the inside rear wheel is activated for understeer control by the stability control function 180'B and the actuator control 180'C. As already explained above in connection with the oversteer control, the stability control function 180'B processes sensor signals relating to the yaw rate, the lateral acceleration, and / or the steering angle of the vehicle for this purpose.

[0092] A fourth control scenario in the event of a functional failure of the first functional unit 110 involves joint brake boosting by the brake pressure generator 188 and by the parking brake actuators EPB1, EPB2 in the event that a driver is directly responsible for the brake pressure buildup at the wheel brakes in PT mode or otherwise (for example, in a different configuration of the brake system 100). This also includes the case in which a driver enters an ongoing braking action initiated by the second functional unit 120.

[0093] To assist the driver, according to the fourth control scenario, the brake pressure at the front wheels is amplified proportionally to the driver's input using the brake pressure generator 188. In this context, the front wheels can also be conditionally controlled for slip, in particular by appropriately controlling the brake pressure generator 188 such that the amplified brake pressure is always below the slip limit (i.e., by reducing a gain factor). However, such conditional slip control is only possible as long as the unamplified driver pressure is still below the locking limit.

[0094] Similarly, the parking brake actuators EPB1 and EPB2 can also be used to boost the brake force on the rear axle in response to the driver's request. For this purpose, a braking force component proportional to the brake pressure requested by the driver is generated by the controlled closing of the parking brake actuators EPB1 and EPB2 by the basic brake function 180'A and the actuator control 180'C.

[0095] Fig. Figure 3 illustrates in a schematic diagram how the amplification of the hydraulic pressure generated by the driver can be carried out by means of the parking brake actuators EPB1, EPB2 in the event of a malfunction of the first functional unit 110. The activation of the parking brake actuators EPB1, EPB2 is carried out by the basic brake function 180'A upon detection of a vehicle deceleration requested by the driver at the brake pedal 130 (e.g., in PT mode or in another operating state). For this purpose, the signal from the pedal travel sensor 182 or the brake light switch 212 can be evaluated.

[0096] In the Fig. In the example shown in Figure 3, the signal from the brake light switch 212 is used. The target value of the electromechanical assistance is determined based on the measured vehicle longitudinal deceleration ax_mess. For this purpose, the basic brake function 180'A evaluates the corresponding signal from the acceleration sensor 210. Based on an iterative algorithm, the required deceleration component ax_soll_EPB(n) attributable to the parking brake actuators EPB1, EPB2 is determined at time n. Specifically, the following algorithm can be used in this context, for example: ax_hydr(n−1)=[ax_mess(n−1)−ax_EPB(n−1)] ax_soll_EPB(n)=ax_hydr(n−1)*EPB_Gain, where ax_hydr(n-1) is a hydraulic deceleration component determined for time n-1, e.g., based on a pressure signal from sensor 196, ax_mess(n-1) is a vehicle deceleration prevailing at time n-1, and EPB_Gain is a gain factor. This iterative algorithm is described in Fig. 3. It can be clearly seen that the measured total deceleration ax_mess is composed of a hydraulic deceleration component and a deceleration component resulting from the actuation of the parking brake actuators EPB1, EPB2.

[0097] To account for any downhill torque that may be present, which could distort the measurement of the acceleration sensor 210, it is possible to compensate for a gradient component present in the output signal of the acceleration sensor 210. This gradient component can be compensated, for example, using a measured inclination angle.

[0098] The Fig. The activation of the parking brake actuators EPB1, EPB2, as illustrated in Figure 3, can be carried out according to a slip control system. In this context, for example, the amplification factor EPB_Gain can be reduced depending on the situation in such a way that the locking limit of an affected wheel is not exceeded. However, such a procedure is only successful as long as the unamplified driver pressure on the rear wheel brakes HL, HR is below the locking limit. However, if the unamplified driver pressure reaches or exceeds the locking limit, another slip control measure must be taken. Specifically, in the present exemplary embodiment, according to the Fig. 1 and Fig. 2 In this case, to increase stability, the rear axle isolation valves 170, 170' are controlled by the second functional unit 120 to limit the rear axle brake pressure generated by the driver for slip control. Due to the functional failure of the first functional unit 110, the valves 170, 170' can generally no longer be closed by the control unit 180.

[0099] In order to enable the control unit 180' to close the valves 170, 170' in the event of a fault in the control unit 180, the switching device U3 is provided (cf. Fig. 2). The switching device U3 is designed as a transistor-based switching device and, depending on the functionality of the first functional unit 110, selectively couples the control unit 180 of the first functional unit 110 or the control unit 180' of the second functional unit to the two valves 170, 170' in order to enable these valves 170, 170' to be controlled by the corresponding control unit 180 or 180'. For this purpose, separate control lines can be provided between the control unit 180' and the switching device U3. The switching of the switching device U3 between the control unit 180 and the control unit 180' can be initiated by the control unit 180' or another component (e.g., the control unit 180) that is capable of detecting a malfunction of the first functional unit 110.

[0100] In the event of a malfunction of the first functional unit 110, one or both of the valves 170, 170' is controlled by the stability control function 180'B and depending on the speed of the associated rear wheel detected by the corresponding sensor 206, 208. In this context, the stability control function 180'B can use a conventional ABS control algorithm to prevent the corresponding rear wheel from locking.

[0101] In the exemplary embodiment described above, the control unit 180' closes one or both of the valves 170, 170' to limit the brake pressure generated by the driver. Of course, the same method could also be used to limit an erroneous brake pressure generated by the brake pressure generator 132, for example, in the event of a malfunction.

[0102] In addition to the switching device U3, two further switching devices U1, U2 are installed in the brake system 102. These further switching devices U1, U2 allow the coupling of the brake pedal travel sensor 182, depending on the functionality of the first functional unit 110, either to the control unit 180 of the first functional unit 110 or to the control unit 180' of the second functional unit 120.

[0103] The switching functions explained below with reference to the switching device U1 and the (optional) switching device U2 are not limited to the brake pedal travel sensor 182. Rather, these switching functions could also be provided additionally or alternatively for one or more of the other sensors, such as the wheel sensors 202, 204, 206, 208, the acceleration sensor 210, or the brake light switch 212. The switching function proposed here has the advantage that one sensor can be provided for the two functional units 110, 120. The sensor as such therefore does not need to be implemented redundantly.

[0104] The switching device U1 therefore allows the pedal travel sensor 182 (and / or another sensor) to be coupled to the second control unit 180' in the event of a malfunction of the first functional unit 110. The output signal S_Ped_extern of the sensor 182 is then fed via a separate line from the switching device U1 to the control unit 180' of the second functional unit 120. More precisely, the signal from the switching device U2 is transmitted to the functional unit 120. This switching device U2 (or another component of the second functional unit 120) is designed to couple an output of the switching device U1 (and thus the corresponding sensor signal) to the second control unit 180' depending on the functionality of the first functional unit 110. In other words, the switching device U1 is controlled, in particular switched, by the second functional unit 120.

[0105] The switching device U2 is therefore designed to couple the signal from the pedal travel sensor 182 to the actual processing electronics (e.g., a microprocessor) of the control unit 180' depending on the first functional unit 110. The switching device U2 can be integrated into an electronic module of the second control unit 180'. Similarly, the switching device U1 can be integrated into an electronic module of the control unit 180.

[0106] The switching device U1 or another switching device is further configured to selectively couple the sensor 182 (and / or another sensor) to a first power supply or a second power supply provided in addition to the first power supply. The first power supply is assigned to the first functional unit 110, and the second power supply is assigned to the second functional unit 120. The corresponding switching of the power supply can in turn be performed by the switching device U2. For this purpose, two power supply lines extend from the switching device U2 to the switching device U1.

[0107] Due to the provision of switching device U1 and switching device U2, even in the event of a power failure of the first functional unit 110 or a failure of the control unit 180, the signal from pedal travel sensor 182 (and / or another sensor) is available for the fallback level in the second functional unit 120. If the switching device U1 itself no longer functions properly, for example, due to water ingress or mechanical destruction of an electronic module, the pedal travel signal must be dispensed with. However, the second functional unit 120 can alternatively use another sensor, for example, pressure sensor 196, to detect the corresponding driver braking request.In the event of another partial failure of the first functional unit 110, for example of the hydraulic system HS1, while the control unit 180 continues to function, the transmission of the sensor signal from the first functional unit 110 to the second functional unit 120 can also take place via a vehicle bus, for example the one shown in . Fig. 2 marked CAN bus.

[0108] In general, the redundancy created by the second functional unit 120 offers a safety-related improvement, which makes the braking system 100 presented here suitable, for example, for autonomous or semi-autonomous driving applications (e.g., in an RCP mode). In particular, if the first functional unit 110 fails and the driver fails to intervene on the (optional) brake pedal 130, the vehicle can still be brought to a standstill safely using the second functional unit 120 (and, if applicable, the parking brake actuators EPB1, EPB2), i.e., including any necessary vehicle-stabilizing brake pressure control.

[0109] In the event of a failure of a separate power supply for the first functional unit 110 (in particular for the electric pressure generator 132), a malfunction of the first functional unit 110 can also be detected. If, in this state, the need for brake pressure control at one of the front and rear wheel brakes is detected (e.g., the need for ESC intervention), this is then carried out by the second functional unit 120, for which a separate power supply is provided (and possibly using the parking brake actuators EPB1, EPB2).

[0110] In another example, the failure of the first functional unit 110 (e.g., a mechanical failure of the transmission 142 of the pressure generator 132) can result in the vehicle being braked immediately and automatically to a standstill. If ABS control is required during this braking, this is taken over by the second functional unit 120 (and, if applicable, the parking brake actuators EPB1, EPB2).

Claims

[1] Hydraulic motor vehicle braking system (100), comprising: - a first functional unit (110) with at least one first valve arrangement (170, 170') which is designed to selectively connect or disconnect at least one first wheel brake (HL, HR) assigned to a first axle to a prevailing hydraulic pressure; at least one second valve arrangement (174, 174') which is designed to selectively connect or disconnect at least one second wheel brake (VL, VR) associated with a second axle to a prevailing hydraulic pressure; at least one first electric brake pressure generator (132), by means of which a brake pressure can be generated at each of the at least one first and at least one second wheel brake (VL, VR, HL, HR); and a first controller (180) configured to control the at least one first electric brake pressure generator (132) for brake pressure control; - a second functional unit (120) with at least one second electric brake pressure generator (188), by means of which a brake pressure can be generated at at least the at least one second wheel brake (VL, VR); and a second controller (180') which is designed to control the at least one second electric brake pressure generator (188) for brake pressure control at at least the at least one second wheel brake (VL, VR) in the event of a malfunction of the first functional unit (110); - wherein the brake system (100) comprises a switching device (U3) which is designed to selectively couple the first controller (180) or the second controller (180') to the at least one first valve arrangement (170, 170'), depending on the functionality of the first functional unit (110). [2] Brake system (100) according to claim 1, wherein the switching device (U3) is designed to couple the second control (180') to the at least one first valve arrangement (170, 170') in the event of a functional failure of the first functional unit (110). [3] Brake system (100) according to one of the preceding claims, wherein the second control (180') is designed to control the at least one first valve arrangement (170, 170') in dependence on an associated wheel signal. [4] Brake system (100) according to one of the preceding claims, wherein the second control (180') is designed to control the at least one first valve arrangement (170, 170') as part of an ABS control in order to prevent locking of an associated wheel. [5] Brake system (100) according to one of the preceding claims, wherein the second control (180') is designed to bring the at least one first valve arrangement (170, 170') for hydraulic pressure limitation on the associated first wheel brake into a closed position. [6] Brake system (100) according to claim 5, wherein the hydraulic pressure to be limited can be generated by a driver by means of a brake pedal (130) in a master cylinder (148). [7] Brake system (100) according to claim 5, wherein the hydraulic pressure to be limited can be generated by means of a control of the first electric brake pressure generator (132) by the second controller (180'). [8] Brake system (100) according to one of the preceding claims, wherein no brake pressure can be generated at the at least one first wheel brake (HR, HL) by means of the at least one second electric brake pressure generator (188). [9] Brake system (100) according to one of the preceding claims, wherein the switching device (U3) is designed as a transistor-based circuit. [10] Brake system (100) according to one of the preceding claims, wherein the switching device (U3) is integrated into the first functional unit (100). [11] Brake system (100) according to one of the preceding claims, wherein the first control and the second control are implemented as separate control devices (180, 180'). [12] Brake system (100) according to one of the preceding claims, wherein the braking system (100) comprises at least one electric parking brake actuator (EPB) designed to generate a braking force on a vehicle wheel; and the second controller (180') is further configured to selectively or jointly control the following: - the at least one second electric brake pressure generator (188); and - at least one parking brake actuator (EPB). [13] Brake system (100) according to claim 12, wherein the at least one electric parking brake actuator (EPB) is assigned to at least one vehicle wheel of the first axle and no electric parking brake actuator is assigned to the second axle; and the brake system (100) is designed to generate a brake pressure at the at least one second wheel brake (VL, VR) by means of the at least one second electric brake pressure generator (188), wherein no brake pressure can be generated at the at least one first wheel brake (HR, HL) by means of the at least one second electric brake pressure generator (188). [14] Brake system according to claim 12 or 13, wherein the second controller (180') is designed to control the at least one parking brake actuator (EPB) for a vehicle-stabilizing brake force control. [15] Brake system according to claim 12 or 13, wherein the second controller (180') is designed to control the at least one parking brake actuator (EPB) for amplifying a braking force resulting from a hydraulic pressure generated by a driver by means of a brake pedal (130) in a master cylinder (148). [16] A method for operating a hydraulic motor vehicle brake system (100) comprising: - a first functional unit (110) with at least one first valve arrangement (170, 170') which is designed to selectively connect or disconnect at least one first wheel brake (HL, HR) assigned to a first axle to a prevailing hydraulic pressure; at least one second valve arrangement (174, 174') which is designed to selectively connect or disconnect at least one second wheel brake (VL, VR) associated with a second axle to a prevailing hydraulic pressure; at least one first electric brake pressure generator (132), by means of which a brake pressure can be generated at each of the at least one first and at least one second wheel brake (VL, VR, HL, HR); and a first controller (180) configured to control the at least one first electric brake pressure generator (132) for brake pressure control; and - a second functional unit (120) with at least one second electric brake pressure generator (188), by means of which a brake pressure can be generated at at least the at least one second wheel brake (VL, VR); a second controller (180') which is designed to control the at least one second electrical brake pressure generator (188) for brake pressure control on at least the at least one second wheel brake (VL, VR) in the event of a functional failure of the first functional unit (110); - wherein the braking system (100) comprises a switching device (U3), the procedure comprising the step: selectively coupling the first controller (180) or the second controller (180') to the at least one first valve arrangement (170, 170') by the switching device (U3) depending on a functionality of the first functional unit (110). [17] Computer program product with program code for carrying out the method according to claim 16, when it runs on at least one processor. [18] Control device or system comprising a plurality of control devices (180; 180'), comprising at least one processor and at least one memory in which the computer program product according to claim 17 is stored.

Images