Piston-cylinder unit, piston-cylinder unit in the form of a travel simulator and a hydraulic device, such as a brake or clutch device

Abstract

Piston-cylinder unit (2, 42, 72), - which has a piston (1, 41, 71) which defines at least one working chamber (3, 43, 86, 87), - wherein a first seal (9, 49, 79) for sealing at least one first working chamber (3, 43, 86, 87) is arranged sealingly either between the piston (1, 41, 71) and the cylinder (23, 42, 72) or between a tappet (88) connected to the piston (71) and the cylinder (23, 42, 72), - and that a second seal (9a, 49a, 80, 83) is arranged between the first seal (9, 49, 79) and the first working chamber (3, 43, 86, 87), - and the piston-cylinder unit (2, 42, 72) has a first channel (10, 46, 78, 81, 81a) which is arranged in the wall of the cylinder (23, 42, 72) and opens between the first seal (9) and the second seal (9a), in particular in the interior of the cylinder, and - that the first channel (10) and / or a hydraulic line (11, 51, 76) connected thereto has a throttle device (12) and / or a valve device, and is connected to a storage container (7) or opens into it, - and that at least one further channel (5, 46) is provided in the cylinder, which opens into the interior of the cylinder and leads to a substantially pressure-free space, in particular a storage container (7), and which can be closed by means of the piston (1, 41, 71), in particular by means of movement of the piston (1, 41, 71), or a valve device (75a, 75b), - wherein the first seal (9, 49, 79) is arranged on one side of the further channel (5, 46), - and that an electronic control unit (ECU) with a diagnostic or monitoring function is provided to diagnose or monitor a possible defect or failure of a seal, - and that in order to diagnose a defective seal, a leakage current flowing through the first channel (10) is diagnosed or monitored, characterized in that a leakage current occurring at a defective seal (9a, 49a, 83) is limited, in particular by means of a throttle (12, 52, 82, 85) or a valve (130) which is arranged in the channel (10) or a hydraulic line (129) connected thereto, wherein in the case of a valve (130) this is closed after the leakage current has been detected.

Description

[0001] The invention relates to a hydraulic device and a piston-cylinder unit sealing system for such devices, in particular for brake and clutch devices for automated driving, as well as their components. State of the art

[0002] Hydraulic devices and piston-cylinder units of the type mentioned above are known.

[0003] For example, DE 11 2015 00 39 89 already describes a braking system in which the use of a second seal is provided for higher demands, significantly reducing the probability of failure, but not eliminating it. The second seal protects the ball screw drive (KGT) and the motor of the braking device against the ingress of brake fluid.

[0004] From DE 10 2013 216 477 A1 a hydraulic device of this type is known in which a diagnosis is carried out with regard to leak tightness.

[0005] DE 100 36 287 A1 proposes a method and device for controlling wheel brakes. To improve availability and meet legal requirements for an electric braking system, in the event of a fault, a control of the valves is provided, derived from a second power circuit independent of the first, which allows the brake pressure in at least one wheel brake to be adjusted even in the event of a fault.

[0006] EP 3 421 312 A1 discloses an air supply system configured for use in an electronic brake control system, comprising a relay valve configured to communicate with a brake chamber, an air supply source, and an outlet port. The position of the relay valve is switchable between a connecting position, in which the relay valve connects the air supply source to the brake chamber, and an outlet position, in which the relay valve connects the brake chamber to the outlet port. The air supply system further comprises a switching section configured to connect a main brake circuit to the brake chamber when the main brake circuit is in operation and to connect the relay valve to the brake chamber when the main brake circuit is not in operation. The air supply system also comprises a controller that controls the position of the relay valve.

[0007] However, in connection with the introduction of automated driving, the requirements for safety in the event of component failure are increasing significantly, especially from level 3 onwards. It is no longer sufficient to design the “Fail Safe” (FS) system; for example, if the ABS fails, the normal brake without control function acts as a fallback level.

[0008] Starting with Level 3 of automated driving (HAF, Highly Automated Driving), the "Fail Operational" (FO) condition is required. In this case, if an ABS component fails, at least an ABS emergency function must still be present to ensure the vehicle's longitudinal and lateral stability during braking. With ABS, the valve coils are electrically tested for open and short circuits. Major challenges in meeting this requirement lie in the actuators, e.g., leaks due to dirt in valve seats and seals, especially in the case of dormant failures.

[0009] The transition from automated driving (HAD) to piloted driving (PF) is particularly critical, as additional components are involved that are not used in automated driving (HAD), such as the pedal interface with the master brake cylinder. The usual characteristics of pedal actuation should not change, as this would irritate the driver and make emergency braking less than optimal. For example, it must be ensured that all seals are functioning. Object of the invention

[0010] The object of the invention is to provide a hydraulic device and a piston-cylinder unit sealing system for such devices, in particular for brake and clutch devices and the like, in particular for automated driving, which still ensures sufficient function of the device in the event of a functional failure of the device or a safety-relevant assembly or component, such as a seal. Inventive solution

[0011] This object is achieved according to the invention with the features of patent claim 1 or 2, to which reference is made here. The designations of the figures given in the claims serve merely to facilitate understanding of the invention and its embodiments and are not restrictive in any way.

[0012] The solution according to the invention advantageously ensures that a hydraulic system, such as a braking system, remains functional in the event of functional impairments or failure of an assembly or component to the extent required for increased requirements, such as automated driving, as described above.

[0013] In other words, in the broadest sense of the invention, all basic functions of the systems are maintained in whole or in part to a limited extent, whereby a so-called first fault is detected by means of redundancy through diagnosis or monitoring, so that the second fault cannot have an impact or lead to system failure. Such basic functions in braking systems can include, for example, brake boosting, pedal characteristics, particularly when switching from automated to piloted driving, maintaining longitudinal and lateral stability (ESP with "fail operational" sensors), full functionality with ABS on all road surfaces, detection of leaks in wheel brake circuits with appropriate remedial measures, e.g., against brake circuit failure.

[0014] In the broadest sense, redundant assemblies or components, such as seals, valves, pressure supplies, storage tanks, control and regulation units, are used, whereby diagnostic devices or monitoring devices can be provided to easily diagnose or monitor functional impairments or failures and, if necessary, to initiate necessary measures to detect individual errors in redundant components.

[0015] The further claims contain expedient or advantageous embodiments and refinements of the invention, as well as applications in various hydraulic systems, such as brake and clutch devices and the like, in which timely detection of functional defects in the seals is important in order to prevent system failures as far as possible.

[0016] The solution according to the invention and its advantageous embodiments or configurations can, in principle, be used for all cylinders / pistons in hydraulic systems with increased safety. Furthermore, the redundancy can be extended to the entire system, e.g., ECU, valves, travel simulator (WS) (without simulator valve), ABS (without exhaust valve) with multiplex (MUX), additional intake valves and throttle, pressure supply, electrical power supply with drive and motor.

[0017] When applying the redundancy according to the invention to seals, the use of a second (redundant) seal together with a throttled return line to a pressure-free space, in particular a storage tank or to the outside is provided. The throttle has the effect that if the second seal fails, the leakage flow is so low that it can still be tolerated by the system, in other words, that, for example, in a braking system, there is no system failure or sufficient braking effect or braking and lateral stability is still present. In this case, for example, compensation for the volume loss through the pressure supply or only slight unintentional pedal movement may be acceptable if the loss of pedal travel over the braking time is acceptable. Both can be detected by sensors during operation through monitoring and in the diagnosis. The leakage flow can also be limited by a suitable valve.

[0018] The inventive solutions with redundancy require a fail-safe diagnosis or monitoring of initial errors in order, among other things, to warn that a possible secondary error may have critical consequences.

[0019] When using a single component without redundancy, diagnostics in the passive area must ensure that no failure is possible in the active area, e.g., during brake application. This can be achieved by using the residual pressure in the system during braking followed by a vehicle stop, with the valve switching "closed - open - closed," to diagnose leaks. This avoids a separate pre-drive check (PDC), which increases the load cycles, particularly on the seals.

[0020] For example, these measures can be used in braking systems for the tandem master cylinder (TMC), the piston of a pressure supply, and also the piston of a travel simulator and, if necessary, other seals. This allows the "travel simulator with TMC" system to meet fail-operational (FO) requirements.

[0021] For example, a travel simulator with a shut-off valve is common in braking systems. If this fails, the travel simulator no longer functions, causing the brake pedal to become hard and the brake booster to be deactivated. In a system with redundant pressure supply, the probability of failure is very low, so a poorer pedal characteristic can be accepted in the fallback level. Thus, the failure-critical valve can be dispensed with.

[0022] Advantageously, a travel simulator system without a valve can also be provided according to the invention, wherein a return spring of the piston-cylinder unit (master cylinder) takes over the first surface part of the travel simulator characteristic curve, in particular by axially displacing a sniffer hole provided on the piston-cylinder unit (master cylinder) by the corresponding amount (distance between sniffer hole and piston in the retracted position).

[0023] The ABS or braking effect can be impaired if dirt particles prevent the valve from closing. If this occurs at the end of a deceleration, it may be very difficult for the diagnostic system to detect it during subsequent braking. This can be detected by measuring the induced voltage when the valve closes, as the dirt particles prevent any or only a small armature movement. Another improvement is the multiplexing method (MUX), which allows for no exhaust valve or only one exhaust valve.

[0024] Furthermore, it is important that at least one wheel per axle is always controlled during ABS operation to ensure longitudinal and lateral stability. This is possible with an additional redundant switching valve in series, preferably in a diagonal arrangement in multiplex (MUX). This valve can also be used to close the connection to the wheel cylinder if, for example, it becomes leaky. This can be diagnosed by the volume intake or volume demand of the pressure supply. In this case, the corresponding switching valve or inlet valve is closed in known systems.

[0025] Full redundancy also includes, despite the dual-circuit pressure supply via a double-acting piston, which is driven, for example, by two three-phase motors, a separate drive with motor and double-acting piston with additional isolating valves between the brake circuit and the pressure supply.

[0026] Redundancy also includes a redundant power supply, ideally from two different energy storage systems. At AD Level 5 (according to the VDA definition), a power supply may be provided from two or three on-board power systems, as in aircraft technology.

[0027] Advantageously, the electronic control and regulation unit (ECU), in particular diagnostic circuits, can also be designed redundantly or self-checking according to the invention. In this case, the power supply can be provided redundantly from the redundant electrical memories U1, U2 and, in some cases, also from U3, comparable to the so-called "2 out of 3" selection in aircraft technology. This power supply supplies the computers (CP1 to CP3). The output signals from the computers CP1 and CP2 affect the control of, for example, the motor and valves, with the corresponding output stages. Here, it is possible to control the motors and valves with double or triple redundancy. However, this requires a lot of effort. Smart redundancy is possible here by only implementing redundant control for selected valves. It is common practice with ESP to permanently monitor the control.It is also advantageous to configure redundant control with only the computers CP1, CP2, and CP3. For example, it is known to control a BLCD motor with two three-phase inputs instead of three, assuming that the motor bearings and drive are fail-safe.

[0028] In a fully redundant braking system, preferably for fully autonomous driving (AD) (Level 5 of automated driving), it is also conceivable to design the braking system without a tandem master cylinder (THZ) (not shown). In this case, the TZ can be replaced by a "Brake and Go" signal generated by the AD in the central ECU.

[0029] For the entire computing functions for processing the input signals, one or more powerful computer CPUs, e.g. microcontrollers, are used, which control the actuators, e.g. motors and valves, via the corresponding integrated or separate control with output stages.

[0030] The computers CP1, CP2, and CP3 can be configured redundantly, e.g., doubly redundant as CP1 and CP2 or triple redundant as CP1, CP2, and CP3. Due to the complexity involved, the computer CP2 can be used for reduced functions and the computer CP3 for emergency functions of the braking system. The same applies to the actuators and valves.

[0031] For the motor, this means that the redundant control for the two-winding combination is three-phase redundant, and for the valves, that only one or two valves on an axis are controlled redundantly. Or, even just the control is redundant and acts on one valve, since the failure rate of a valve's coil is extremely low.

[0032] This allows all input signals from the sensors and the brake and go signals to be applied to all computers CP1, CP2, and CP3. The output signals for controlling the power amplifiers are also provided separately from each CP.

[0033] With the trend toward architectures with domains and central computers, it makes sense to design the control system separately in an ECU as a slave. The slave ECU then contains the entire control system with power amplifiers and, if necessary, I / O for sensors or brake and go switch signals. Signal transmission to the master ECU then takes place via redundant bus systems, possibly according to the computer structure described above for full functionality to emergency function with different structures and different protocols.

[0034] Due to the low complexity of the slave ECU, costs can be saved by simply routing the circuit board to one or just a few layers. Due to the high complexity of the functions, neural networks in the software are particularly suitable.

[0035] Another cost-saving option is to omit the plunger on the auxiliary piston. Conventional master brake cylinders offer the option of coupling the primary piston to the secondary piston in the event of a primary circuit failure. In this case, the primary piston meets the secondary piston and generates brake pressure in the secondary circuit. Without this feature, a total brake failure would result. This applies to conventional systems without redundancies. The following system solution proposes a redundant solution. Here, the failure of the primary circuit has no effect, as a separating valve closes the primary circuit in this case. Furthermore, if the primary circuit and the pressure supply of system 1 (booster) fail, the secondary circuit is supplied by a separate pressure supply from the second system (ESP). For a total failure, three faults would have to occur: both pressure supplies and the primary circuit, which would result in a failure rate of approximately 10-14 / year. For comparison, the failure rate of a brake circuit is in the order of 10 -5 / Year.

[0036] Further advantageous or expedient embodiments or refinements of the invention and their features are shown in the drawing and described in more detail below.

[0037] They show: Fig. 1: a piston arrangement with two pressure chambers and a redundant seal with throttle to a reservoir; Fig. 2: a piston arrangement with mechanical actuation and a pressure chamber with a redundant seal with throttle to the reservoir; Fig. 3: a double-acting piston with two pressure chambers and a redundant seal with throttle for each piston; Fig. 4: a tandem master cylinder (THZ) with primary and secondary pistons with travel simulator and pressure supply and redundant seal for the travel simulator with throttle and drain to the outside or reservoir as well as diagnostic valve from the sniffer hole of the piston to the reservoir; Fig. 5: similar Fig. 4 for a tandem master cylinder arrangement with tappet on an auxiliary piston and a redundant seal with throttle to the reservoir on the tappet; Fig. 5a: similar to Fig. 5 but without tappet on the auxiliary piston; Fig. 6: similar Fig. 5 with a flow check valve instead of the diagnostic valve; Fig. 7: a tandem master cylinder arrangement with three pistons with one redundant seal per piston with throttle to the reservoir and travel simulator with redundant seal and throttle to the outlet to the outside; Fig. 8: a pressure curve and control signals for a typical diagnostic cycle; Fig. 9a: a braking system with ECU (extension of the partial braking system according to Fig. 5) and redundant valves and an additional storage tank; Fig. 9b: Embodiment of a throttle according to the invention; Fig. 9c: a braking system largely like Fig. 9a, with redundant pressure supply (DV1, DV2); and Fig. 9d: schematically shows the basic concept of a redundant control unit (ECU) as is expediently used according to the invention, for example, in braking systems according to. Fig. 9a or 9c can be used.

[0038] Fig. Figure 1 shows different hydraulic applications in the upper and lower halves. The upper part shows an application in a braking system, while the lower part shows an application in a hydraulic actuator.

[0039] The application in a braking system (upper part of the Fig. 1) shows the redundancy in a piston 1, e.g. the secondary rotary piston (SK piston) of a tandem master cylinder 2 (THZ). If the working chamber or the primary chamber 3 is pressurised, e.g. by a pressure supply (not shown) via the hydraulic line 14 and channel 13 in the tandem master cylinder 2 (THZ), then the piston 1 in the tandem master cylinder 2 (THZ) moves to the left. If the bore 17 of the piston 1 has been moved past the seal 8 of the tandem master cylinder 2 (THZ), then brake fluid is moved from the secondary chamber 4 of the tandem master cylinder 2 (THZ) through the channel 15 and through the hydraulic line 16, e.g. into the wheel brake cylinders (not shown).

[0040] A seal 9 is provided for the hydraulic separation of the primary chamber 3 of the tandem master brake cylinder 2 (THZ) from channel 5, which is connected to the reservoir 7 (VB) via a hydraulic line 6. In accordance with the redundancy principle according to the invention, the seal 9 is supplemented by a redundant seal 9a and a channel 10. The channel 10 is connected to the reservoir 7 (VB) via a hydraulic line 11, a hydraulic line 6, and a throttle 12. The redundant seal 9a thus hydraulically separates the working chamber 3 of the tandem master brake cylinder 2 (THZ) from channel 10 and thus also from the reservoir 7 (VB).

[0041] When the redundant seal 9a is intact, the channel 10 is hydraulically separated from the working chamber 3 of the tandem master cylinder 2 (THZ). As a result, no brake fluid flows from the working chamber 3 of the tandem master cylinder 2 (THZ) to the channel 10, even when the working chamber 3 of the tandem master cylinder 2 (THZ) is pressurized. By connecting the channel 10 to the reservoir 7 (VB) via a hydraulic line 11, a hydraulic line 6, and the throttle 12, the pressure in the channel 10 is equal to the pressure in the reservoir 7 (VB) if height differences between the reservoir 7 (VB) and the channel 10 are neglected. Channel 5 is also connected to the reservoir 7 (VB) via a hydraulic line 6, so that the pressure in channel 5 is also equal to the pressure in the reservoir 7 (VB), although here too height differences between the reservoir 7 (VB) and channel 5 are neglected.If the redundant seal 9a is intact, the seal 9 is therefore not loaded, even if the working chamber 3 of the tandem master brake cylinder 2 (THZ) is under pressure.

[0042] Furthermore, if the redundant seal 9a is intact, any dirt particles in the working chamber 3 of the tandem master cylinder 2 (THZ) are retained by the redundant seal 9a, preventing them from penetrating channel 10 and damaging the seal 9. Therefore, if the redundant seal 9a is intact, the seal 9 does not fail.

[0043] If the redundant seal 9a becomes leaky, e.g. due to wear or dirt particles, brake fluid can flow from chamber 3 of the tandem master brake cylinder 2 (THZ) through channel 10 and hydraulic line 1, hydraulic line 6 and throttle 12 to the reservoir 7 (VB). In this state, the seal 9 takes over the hydraulic separation of the working chamber 3 of the tandem master brake cylinder 2 (THZ) from channel 5, which is connected to the reservoir 7 (VB) via a hydraulic line 6. The throttle 12 is dimensioned such that the flow through the leak in the redundant seal 9a can be compensated by a pressure supply (not shown) in the hydraulic line 14. Furthermore, the compensating flow of the pressure supply is an indicator of the leak in the redundant seal 9a.

[0044] A leak in the redundant seal 9a can thus be detected during operation without disrupting operation. Therefore, this redundancy leads to a hydraulic separation of the working chamber 3 of the tandem master brake cylinder 2 (THZ) from the reservoir 7 (VB), which can be described as a fail-operational condition.

[0045] The application with a hydraulic actuator (lower part of the Fig. 1) shows the redundancy of a piston 21, e.g., the actuator piston of a clutch (not shown). If the working chamber 24 is pressurized, e.g., by a pressure supply (not shown) via the hydraulic line 28 and channel 27 in the cylinder 23, the piston 21 moves to the left in the cylinder 23. During this leftward displacement of the piston 21, the piston tappet 22 can exert a force 26 on the clutch (not shown) that corresponds to the pressure in the working chamber 24.

[0046] A seal 9 is provided for the hydraulic separation of the working chamber 24 of the cylinder 23 from the interior 25 of the cylinder 23. For redundancy, the seal 9 is supplemented by a redundant seal 9a and a channel 10. The channel 10 is connected to the reservoir 7 (VB) via a hydraulic line 17, a hydraulic line 6, and a throttle 12. The redundant seal 9a thus hydraulically separates the working chamber 24 of the cylinder 23 (THZ) from the channel 10 and thus also from the reservoir 7 (VB) and the interior 25 of the cylinder 23.

[0047] When the redundant seal 9a is intact, the channel 10 is hydraulically separated from the working chamber 24 of the cylinder 23. As a result, no hydraulic fluid flows from the working chamber 24 of the cylinder 23 to the channel 10, even when the working chamber 24 of the cylinder 23 is under pressure. By connecting the channel 10 to the reservoir 7 (VB) via a hydraulic line 27 and the throttle 12, the pressure in the channel 10 is equal to the pressure in the reservoir 7 (VB) if height differences between the reservoir 7 (VB) and the channel 10 are neglected. If the pressure in the reservoir 7 (VB) is equal to atmospheric pressure, and if the interior 25 of the cylinder 23 is also equal to atmospheric pressure, then with the redundant seal 9a intact, the seal 9 is not loaded, even when the working chamber 24 of the cylinder 23 is under pressure.

[0048] Furthermore, if the redundant seal 9a is intact, any dirt particles in the working chamber 24 of the cylinder 23 are retained by the redundant seal 9a, so that they cannot penetrate into channel 10 and damage the seal 9. Therefore, if the redundant seal 9a is intact, the seal 9 does not fail.

[0049] If the redundant seal 9a becomes leaky, e.g. due to wear or dirt particles, hydraulic fluid can flow from the chamber 24 of the cylinder 23 through the channel 10 and the hydraulic line 27 and the throttle 12 to the reservoir 7 (VB). In this state, the seal 9 takes over the hydraulic separation of the working chamber 24 of the cylinder 23 from the interior 25 of the cylinder 23. The throttle 12 is dimensioned such that the flow through the leak in the redundant seal 9a can be compensated by the pressure supply (not shown) in the hydraulic line 28. Furthermore, the compensating flow of the pressure supply is an indicator of the leak in the redundant seal 9a.

[0050] A leak in the redundant seal 9a can thus be detected during operation without disrupting operation. Therefore, this redundancy leads to a hydraulic separation of the working chamber 24 from the interior 25 of the cylinder 23, which can be referred to as a fail-operational condition.

[0051] Fig. Figure 2 shows the redundancy in a piston 41, e.g., the primary piston of a tandem master cylinder 42 (THZ), which is operated by a tappet 41a. The tappet 41a is connected to a brake pedal (not shown). In the rest position of the primary piston 41 shown, the primary chamber 43 of the tandem master cylinder 42 (THZ) is connected to the reservoir 7 (VB) through the bore 45 of the primary piston 41, through the channel 46 in the tandem master cylinder 42 (THZ), and through the hydraulic line 47. By actuating the brake pedal (not shown), the driver can move the primary piston 41 to the left.If during this displacement the bore 45 of the primary piston 41 is pushed past the redundant seal 49a of the tandem master brake cylinder 42 (THZ), then brake fluid is displaced from the primary chamber 43 of the tandem master brake cylinder 42 (THZ) through the channel 53 and through the hydraulic line 54 into a wheel brake cylinder (not shown).

[0052] A seal 49 is provided for the hydraulic separation of the primary chamber 43 of the tandem master cylinder 42 (THZ) from channel 46, which is connected to the reservoir 7 (VB) via a hydraulic line 47. For redundancy, the seal 49 is supplemented by a redundant seal 49a and a channel 50. The channel 50 is connected to the reservoir 7 (VB) via a hydraulic line 51, a hydraulic line 47, and a throttle 52. The redundant seal 49a thus hydraulically separates the primary chamber 43 of the tandem master cylinder 42 (THZ) from channel 50 and thus also from the reservoir 7 (VB). The seal 48 hydraulically separates the channel 46 from the piston tappet chamber 44.

[0053] When the redundant seal 49a is intact, the channel 50 is hydraulically separated from the primary chamber 43 of the tandem master cylinder 42 (THZ). As a result, no volume flows from the primary chamber 43 of the tandem master cylinder 42 (THZ) to the channel 50, even when the primary chamber 43 of the tandem master cylinder 42 (THZ) is pressurized. By connecting the channel 50 to the reservoir 7 (VB) via a hydraulic line 51, a hydraulic line 47, and a throttle 52, the pressure in the channel 50 is equal to the pressure in the reservoir 7 (VB) if height differences between the reservoir 7 (VB) and the channel 50 are neglected. Channel 46 is also connected to the reservoir 7 (VB) via a hydraulic line 47, so that the pressure in channel 46 is also equal to the pressure in the reservoir 7 (VB), although here too height differences between the reservoir 7 (VB) and channel 46 are neglected.If the redundant seal 49a is intact, the seal 49 is therefore not loaded, even if the primary chamber 43 of the tandem master brake cylinder 42 (THZ) is under pressure.

[0054] Furthermore, if the redundant seal 49a is intact, any dirt particles in the primary chamber 43 of the tandem master cylinder 42 (THZ) are retained by the redundant seal 49a, preventing them from penetrating channel 50 and damaging the seal 49. Therefore, if the redundant seal 49a is intact, the seal 49 does not fail.

[0055] If the redundant seal 49a becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the primary chamber 43 of the tandem master brake cylinder 42 (THZ) through the channel 50 and the hydraulic line 51, the hydraulic line 47, and the throttle 52 to the reservoir 7 (VB). In this state, the seal 49 hydraulically separates the primary chamber 43 of the tandem master brake cylinder 42 (THZ) from the channel 46, which is connected to the reservoir 7 (VB) via a hydraulic line 47.

[0056] The throttle 52 is dimensioned so that the flow caused by the leak in the redundant seal 49a can be compensated by the driver pressing the brake pedal (not shown). The brake pedal does not fall through. Furthermore, the compensating flow is an indicator of the leak in the redundant seal 49a.

[0057] A leak in the redundant seal 49a can thus be detected during operation without the brake pedal failing due to this leak. Therefore, this redundancy leads to a hydraulic separation of the primary chamber 43 of the tandem master cylinder 42 (THZ) from the reservoir 7 (VB), which can be referred to as a fail-operational condition.

[0058] Fig. Figure 3 shows the redundancy of a stepped piston 71, e.g., a double-acting piston (DHK), in a cylinder 72 of a pressure supply. The function of this pressure supply is explained here using an example. Cylinder 72 has five channels, 73a, 73b, 73c, 73d, and 78. Channels 73a and 73b are connected to the reservoir 7 (VB) via hydraulic lines 74a and 74b, respectively, in which suction valves 75a and 75b are housed, and via hydraulic line 76. Channels 73c and 73d are connected to brake circuits BK1 and BK2, respectively, via hydraulic lines 74c and 74d, in which check valves 75a and 75b are housed. Two seals 79 and 80 are housed in the stepped piston 71. Between seals 79 and 80 is a channel 81 and 81a with throttle 82. Furthermore, two seals 83 and 84 are housed in cylinder 72. Between seals 83 and 84 is channel 78 with throttle 85.The channel 78 is connected to the reservoir 7 (VB) via the hydraulic line 76.

[0059] The double-stroke piston 71 (DHK) divides the cylinder 72 into two working chambers, chamber 86 and annular chamber 87. When the stepped piston 71 is in the Fig. 3 is moved to the left (forward stroke of the double-stroke piston 71, DHK), then the suction valve 75a closes and the check valve 75c opens, and brake fluid is pushed from the chamber 86 via the channel 73c and the hydraulic line 74c into the brake circuit BK1. The suction valve 75b opens and the check valve 75d closes, and brake fluid is sucked from the reservoir 7 (VB) into the annular chamber 87 via the channel 73b, the suction valve 75b, and the hydraulic line 76.

[0060] When the stepped piston 71 in the Fig. 3 is moved to the right (return stroke of the double-stroke piston 71, DHK), then the suction valve 75a opens and the check valve 75c closes, and brake fluid is sucked into the chamber 86 via the channel 73a and via the hydraulic line 74a with suction valve 75a and via the hydraulic line 76 from the reservoir 7 (VB). The suction valve 75b closes and the check valve 75d opens, and via the channel 73d, the suction valve 75d and the hydraulic line 74d, brake fluid is moved from the annular chamber 87 into the brake circuit BK2.

[0061] Two seals 79 and 80 are provided for the hydraulic separation of chamber 86 of cylinder 72 from the annular chamber 87. Between these two seals 79 and 80 are a channel 81 and a channel 81a containing a throttle 82. When seals 79 and 80 are intact, i.e., no brake fluid flows through channels 81, 81a and through the throttle 82 into the piston rod chamber 89, the pressure in channel 81 is equal to the pressure in the piston rod chamber 89.

[0062] If seal 79 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from chamber 86 of cylinder 72 through channel 81, channel 81a, and throttle 82 of the double-acting piston (DHK) into piston rod chamber 89 during the forward stroke of the double-acting piston 71 (DHK) (leakage flow). The throttle 82 is dimensioned so that the flow caused by the leak in seal 79 can be compensated by the pressure supply by correcting the forward stroke of the double-acting piston 71 (DHK). Furthermore, the compensating flow of the pressure supply is an indicator of the leak in seal 79.

[0063] A leak in the seal 79 can thus be detected during operation during the forward stroke of the double-acting piston 71 (DHK) without disrupting operation. Therefore, this redundancy leads to a hydraulic separation of the chamber from the annular chamber 87 of the cylinder 72, which can be described as a fail-operational condition during the forward stroke of the double-acting piston 71 (DHK).

[0064] If seal 80 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the annular chamber 87 of cylinder 72 through channel 81, channel 81a, and throttle 82 of double-acting piston 71 (DHK) during the return stroke of double-acting piston 71 (DHK). Throttle 82 is dimensioned so that the flow caused by the leak in seal 80 can be compensated by the pressure supply by correcting the return stroke of double-acting piston 71 (DHK). Furthermore, the compensating flow of the pressure supply is an indicator of the leak in seal 80.

[0065] A leak in the seal 80 can thus be detected during operation on the return stroke of the double-acting piston 71 (DHK) without disrupting operation. Therefore, this redundancy leads to a hydraulic separation of the chamber 86 of the cylinder 72 from the annular chamber 87, which can be described as a fail-operational condition during the return stroke of the double-acting piston 71 (DHK).

[0066] Seal 83 and seal 84 for piston rod 88 are provided for the hydraulic separation of the annular chamber 87 of cylinder 22 from the piston rod chamber 89. Between these seals 83 and seal 84, a channel 78 is provided, which contains a throttle 85. By connecting channel 78 to reservoir 7 (VB) via a hydraulic line 76 and a throttle 85, the pressure in channel 78, with an intact seal 83, is equal to the pressure in reservoir 7 (VB), if height differences between reservoir 7 (VB) and channel 78 are neglected.

[0067] If the pressure in the piston rod chamber 89 is equal to the pressure in the reservoir 7 (VB), then if the seal 83 is intact, the seal 84 is not loaded, even if the annular chamber 87 of the cylinder 72 is under pressure.

[0068] Furthermore, if the seal 83 is intact, any dirt particles in the annular chamber 87 of the cylinder 72 are retained by the seal 83, preventing them from penetrating into channel 78 and damaging the seal 84. Therefore, if the seal 83 is intact, the seal 84 will not fail.

[0069] If the seal 83 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the annular chamber 87 of the cylinder 72 through the channel 78 and the hydraulic line 76 and the throttle 85 to the reservoir 7 (VB). In this state, the seal 84 hydraulically separates the annular chamber 87 of the cylinder 72 from the piston rod chamber 89. The throttle 85 is dimensioned such that the flow caused by the leak in the seal 83 can be compensated by correcting the return stroke of the double-acting piston 71 (DHK). Furthermore, the compensating flow of the pressure supply is an indicator of the leak in the seal 83.

[0070] A leak in the seal 83 can thus be detected during operation on the return stroke of the double-acting piston 71 (DHK) without disrupting operation. Therefore, this redundancy leads to a hydraulic separation of the annular chamber 87 of the cylinder 72 from the piston rod chamber 89, which can be described as a fail-operational event during the return stroke of the double-acting piston 71 (DHK).

[0071] Fig. Figure 4 shows a braking system that utilizes redundancy with two seals. First, the braking system is briefly described.

[0072] The brake pedal 101 is actuated by the driver's foot when the brake is requested. When the brake pedal 101 is actuated, the pedal tappet 102 and the pedal piston 103 are displaced, in the Fig. 4 to the left. Via the pedal piston spring 104, the primary piston 105 of the tandem master cylinder 112 (THZ) is also displaced to the left. If, during this leftward movement of the primary piston 105, the bore 106 of the primary piston 105 has passed the seal 107, then, with the isolation valves 108 and 109 closed and the simulator valve 110 open, volume from the primary chamber 111 of the tandem master cylinder 112 (THZ) is displaced through the channel 113 of the primary chamber 111, through the hydraulic line 114 with throttle 115 and through the opened simulator valve 110 and through the hydraulic line 114a into the working chamber 139 of the travel simulator 116. The travel simulator piston 117 of the travel simulator 116 is thereby also displaced to the left in Fig. 4 against a spring assembly 118 of the travel simulator 116, whereby the pressure in the travel simulator 116 and thus also the pressure in the primary chamber 111 of the tandem master brake cylinder 112 (THZ) increases.

[0073] Due to the pressure in the primary chamber 111 of the tandem master cylinder 112 (THZ), the secondary piston 119 in the tandem master cylinder 112 (THZ) moves to the left in Fig. 4. When the bore 120 of the secondary piston 119 passes the seal 121 during the leftward movement of the secondary piston 119, the leftward movement of the secondary piston stops when the isolation valves 108 and 109 are closed, because the secondary chamber 122 of the tandem master cylinder 112 (THC) is then a closed chamber. Neglecting the spring forces of the primary piston spring 123 and the secondary piston spring 124, and neglecting the frictional forces of the seals 121, 125, and 127 on the secondary piston 119, the pressure in the secondary chamber 122 is equal to the pressure in the primary chamber 111.

[0074] As already described, upon a leftward movement of the primary piston 105, the seal 107 hydraulically separates the primary chamber 111 of the tandem master cylinder 112 (THZ) from the channel 128 of the tandem master cylinder 112 (THZ). This interrupts the connection between the primary chamber 111 of the tandem master cylinder 112 (THZ) via the bore 106 of the primary piston 5 and via the channel 128 of the tandem master cylinder 112 (THZ), via the hydraulic lines 129 and 129a, and via the open diagnostic valve 130 to the reservoir 131 (VB). By connecting channel 128 to reservoir 131 (VB) via hydraulic lines 129 and 129a, and via the open diagnostic valve 130, the pressure in channel 128 is equal to the pressure in reservoir 131 (VB) if height differences between reservoir 131 (VB) and channel 128 are neglected.

[0075] If the pressure in the exterior chamber 132 of the tandem master cylinder 112 (THZ) is equal to the pressure in the reservoir 131 (VB), then, if the seal 107 is intact, the seal 107a is not stressed, even if the primary chamber 111 of the tandem master cylinder 112 (THZ) is under pressure. Furthermore, if the seal 107 is intact, any dirt particles in the primary chamber 111 of the tandem master cylinder 112 (THZ) are retained by the seal 107, preventing them from penetrating channel 128 and damaging the seal 107a. If the seal 107 is intact, the seal 107a will therefore not fail.

[0076] If the seal 107 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the primary chamber 111 of the tandem master brake cylinder 112 (THZ) through the channel 128, through the hydraulic lines 129 and 129a, and through the open diagnostic valve 130 to the reservoir 131 (VB). This outflow of brake fluid can be stopped by closing the diagnostic valve 130. The outflow of brake fluid is an indicator of the leak in the seal 107 and can be determined using the travel sensors 133 and 133a, the force of the pedal piston spring 104, and the pressure-volume characteristic of the travel simulator 116.

[0077] A leak in seal 107 can thus be detected during operation without disrupting operation. Therefore, the combination of seal 107 with diagnostic valve 130 results in a hydraulic separation of the primary chamber 111 of the THZ 112 from the reservoir 131 (VB), which can be described as a fail-operational condition.

[0078] The combination of the seal 125 and the redundant seal 127 with the channel 126, and the hydraulic line 134 and the hydraulic line 129a to the reservoir 131 (VB) and with the throttle 135 leads to a hydraulic separation of the primary chamber 111 of the THZ 112 from the reservoir 131 (VB), which can be referred to as Fail Operational, as in Fig. 1 described.

[0079] The combination of the seal 121 and the seal 125 with the channel 136, and the hydraulic lines 137 and 137a and the check valve 138 and the hydraulic line 129a to the reservoir 131 (VB) leads to a hydraulic separation of the secondary chamber 122 of the THZ 112 from the reservoir 131 (VB), which can be referred to as Fail Operational, as already described in Fig. 4 for the combination of the seal 107 and the seal 107a with channel 128, and hydraulic lines 129 and 129a and diagnostic valve 130 to the reservoir 131 (VB).

[0080] The travel simulator piston 117 of the travel simulator 116 contains a seal 140 and a redundant seal 140a. Between the seal 140 and the redundant seal 140a are a channel 141 and a channel 141a with a throttle 142, with the channel 141 opening into the chamber 143 of the spring assembly 118. The redundant seal 140a hydraulically separates the working chamber 139 of the travel simulator 116 from the spring assembly chamber 118 of the travel simulator 116.

[0081] If the redundant seal 140a is intact, no brake fluid flows from the working chamber 139 of the travel simulator 116 through the channels 141, 141a and through the throttle 142 into the spring assembly chamber 143 of the travel simulator 116. If the redundant seal 140a is intact, the pressure in channel 141 is therefore equal to the pressure in the spring assembly chamber 143 of the travel simulator 116. If the redundant seal 140a is intact, the seal 140 is therefore not stressed, even when the working chamber 139 of the travel simulator 116 is under pressure. Furthermore, if the redundant seal 140a is intact, any dirt particles in the working chamber 139 of the travel simulator 116 are retained by the redundant seal 140a, so that they cannot penetrate into channel 141 and damage the seal 140. If the redundant seal 140a is intact, the seal 140 will not fail.

[0082] If the redundant seal 140a becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the working chamber 139 of the travel simulator 116 through channel 141, and through channel 141a with throttle 142 into the spring assembly chamber 143 of the travel simulator 116. The outflow of brake fluid is an indicator of the leakage of the redundant seal 140a and can be determined using the travel sensors 133 and 133a, the force of the pedal piston spring 104, and the pressure-volume characteristic of the travel simulator 116.

[0083] A leak in the redundant seal 140a can thus be detected during operation without the brake pedal 101 failing due to this leak (see also description at Fig. 2). Therefore, this redundancy leads to a hydraulic separation of the working chamber 139 of the travel simulator 116 from the spring assembly chamber 143 of the travel simulator 116, which can be referred to as Fail Operational.

[0084] All control and evaluation signals are processed in a control unit (not shown). In particular, the sensor evaluation, diagnosis, error evaluation, and error display are processed. Diagnosis of seal failures of the redundant seal 140a of the piston travel simulator 116, the seal 107 of the auxiliary piston chamber 111, the redundant seal 127 in the primary chamber 111 of the tandem master cylinder 112 (THZ), and the seal 121 in the secondary chamber 122 of the tandem master cylinder 112 (THZ), which lead to a leakage current, is performed by plausibility checks of the pedal travel sensor signals 133, 133a with the pedal piston spring 104, taking into account the pressure-volume characteristics of the travel simulator 116.Another way to detect a seal leak that results in a leakage flow is to correlate the pressure-volume characteristic of the brake system with the volume displacement of the pressure supply 146 and the signal of the brake pressure sensor (not shown) in the brake circuit 148. In the brake system of . Fig. 4, the leakage flow flows through each seal back into the reservoir 131 (VB), except for the redundant seal 140a in the piston travel simulator 116, and the seals of the double-acting piston, in the event that a double-acting piston is used in the pressure supply 146 after Fig. 3 is used (see Fig. 3, seals 79 and 80). If the leakage flow does not flow back into the reservoir 131 (VB), then a diagnosis of the tightness is possible by correlating the leakage loss with the signal of a redundant level sensor 151 in the reservoir 131 (VB), which is preferably linear.

[0085] During diagnosis, the seal 107a can also be tested for leaks when the brake pedal 101 is not depressed. To do this, the diagnostic valve 130, the simulator valve 110, the isolation valve 108, and the shut-off valve 138 are closed, and the isolation valve 109 and the feed valve 144 are opened. The motor 145 is energized with a specific current value, and brake fluid is thus shifted from the pressure supply 146 via the hydraulic line 147, via the feed valve 144, via the hydraulic line 147a, via the hydraulic line 148, via the isolation valve 109, via the hydraulic line 149, and via the channel 150 into the primary chamber 111 of the THZ 112, whereby the pressure in the primary chamber 111 rises to a specific value, e.g., 25 bar. The pressure in the hydraulic line 148 is measured by a pressure sensor (not shown).If the seal 107a is leaking, the pressure supply must supply brake fluid to keep the pressure in the hydraulic line 148 constant. A leak in the seal 107a can be detected by the need to supply brake fluid through the pressure supply 146 to keep the pressure in the hydraulic line 148 constant.

[0086] Fig. 5 shows a braking system which is similar to the braking system of Fig. 4. A significant difference is that the braking system of Fig. 5, the master brake cylinder 201 (HZ) is divided into three chambers. These are the primary chamber 111, the secondary chamber 122, and the auxiliary piston chamber 204. The secondary piston 119 is located between the primary chamber 111 and the secondary chamber 122. A partition wall 206 is located between the primary chamber 111 and the auxiliary piston chamber 204. First, the braking system will be briefly described.

[0087] The brake pedal 101 is actuated by the driver's foot when the brake is requested. When the brake pedal 101 is actuated, the pedal tappet 102 and the pedal piston 103 are displaced, in the Fig. 5 to the left. Via the pedal piston spring 104, the auxiliary piston 211 and the auxiliary piston tappet 212, which is guided through a bore 213 of the intermediate wall 206, are also displaced to the left. When, during this leftward movement of the auxiliary piston 211, the bore 214 of the auxiliary piston 211 has passed the seal 215, then, with the isolating valve 216 closed, volume from the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ) is displaced through the channel 217 of the auxiliary piston chamber 204, the hydraulic lines 218 and 114 with throttle 115 and the opened simulator valve 110 and the hydraulic line 114a into the working chamber 139 of the travel simulator 116. The travel simulator piston 117 is thereby also displaced to the left in Fig. 5 against a spring pack 118, whereby the pressure in the travel simulator 116 and thus also the pressure in the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ) increases.

[0088] According to the displacement of the pedal piston 103, which is detected by the displacement sensor 133, the motor 228 is energized to displace a defined volume from the pressure supply 229 via the hydraulic line 147, the opened feed valve 144, the hydraulic line 147a, the primary circuit 233 in the wheel brake cylinders of the primary circuit 233 (not shown) and via channel 150 of the master brake cylinder 201 (HZ) into the primary chamber 111 of the master brake cylinder 201 (HZ). This increases the pressure in the wheel brake cylinders, and thus also the pressure in the primary chamber 111 of the master brake cylinder 201 (HZ). Due to the pressure in the primary chamber 111 of the master brake cylinder 201 (HZ), the secondary piston 119 also moves to the left in Fig. 5, against the force of the secondary piston spring 124. This movement of the secondary piston 119 displaces brake fluid from the secondary chamber 122 of the master brake cylinder 201 (HZ) through the channel 236 and through the secondary circuit 237 into the wheel brake cylinder of the secondary circuit 237 (not shown). This increases the pressure in the wheel brake cylinders of the secondary circuit 237. Neglecting the spring forces of the secondary piston spring 124 and the frictional forces of the seals 127, 125, 121 on the secondary piston 119, the pressure in the secondary chamber 122 is equal to the pressure in the primary chamber 111.

[0089] Two seals 241 and 242 are located in the bore 213 of the intermediate wall 206 of the master brake cylinder 201 (HZ). Between the two seals 241 and 242 is a channel 243. This channel 243 is connected to the reservoir 131 (VB) via a hydraulic line 244, a throttle 245, and a hydraulic line 129a. These seals hydraulically separate the primary chamber 111 of the master brake cylinder 201 (HZ) from the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ).

[0090] If seal 241 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from primary chamber 111 of master cylinder 201 (HZ) through channel 243, hydraulic line 244 with throttle 245, and hydraulic line 129a into reservoir 247 (VB). Throttle 245 is dimensioned so that the flow caused by the leak in seal 241 can be compensated by pressure supply 229. Furthermore, the compensating flow of pressure supply 229 is an indicator of the leak in seal 241.

[0091] A leak in seal 241 can thus be detected during operation without disrupting operation. Therefore, this redundancy of seals 241 and 242 with throttle 245 results in a hydraulic separation of primary chamber 111 from auxiliary piston chamber 204 of master brake cylinder 201 (HZ), which can be referred to as a fail-operational condition.

[0092] If the seal 242 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ) through the channel 243, through the hydraulic line 244 with throttle 245, and through the hydraulic line 129a to the reservoir 247 (VB). The outflow of brake fluid is an indicator of the leak in the seal 242 and can be determined using the travel sensors 133 and 133a, the force of the pedal piston spring 104, and the pressure-volume characteristic of the travel simulator 116.

[0093] A leak in the seal 242 can thus be detected during operation without the brake pedal 101 falling through due to this leak (see also description at Fig. 2). Therefore, this redundancy of the seals 241 and 242 leads to a hydraulic separation of the auxiliary piston chamber 204 from the reservoir 247 (VB), which can be described as a fail operational condition.

[0094] If the isolation valve 216 becomes leaky, e.g. due to wear or dirt particles, and the brake pressure in the primary circuit 233 is lower than the pressure in the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ), brake fluid can flow from the auxiliary piston chamber 204 through the channel 248, through the hydraulic line 249, through the isolation valve 216 and through the hydraulic line 250 to the primary circuit 233. The brake pedal 101 then collapses. The outflow of brake fluid is an indicator of the leak in the isolation valve 216 and can be detected using the travel sensors 133 and 133a, the force of the pedal piston spring 104 and the pressure-volume characteristic of the travel simulator 116.If the brake pressure in primary circuit 233 is higher than the pressure in auxiliary piston chamber 204, then brake fluid can flow from primary circuit 233 through hydraulic line 250, through isolation valve 216, through hydraulic line 249, and through channel 248 into auxiliary piston chamber 204 of master brake cylinder 201 (HZ). Brake pedal 101 is then depressed. The outflow of brake fluid is an indicator of the leakage of isolation valve 216 and can be detected using travel sensors 133 and 133a, the force of pedal piston spring 104, and the pressure-volume characteristic of travel simulator 116. If a leakage of isolation valve 216 is detected, the optional redundant isolation valve 216a (shown in dashed lines) in hydraulic line 250 is closed. The redundant isolation valve 216a is optional because leakage of the isolation valve 216 is very rare.

[0095] A leak in the isolation valve 216 can thus be detected during operation without the brake pedal 101 failing due to this leak. Therefore, this redundancy of the isolation valves 216 and 216a leads to a hydraulic separation of the auxiliary piston chamber 204 from the primary circuit 233, which can be referred to as a fail-operational condition.

[0096] Similar to Fig. 4, the braking system of Fig. 5 all control and evaluation signals are processed in a control unit (not shown). Therefore, only the special features of the braking system of Fig. 5 compared to the braking system of Fig. 4. The diagnosis of seal failures of the seal 242 of the auxiliary piston tappet 212 and the isolating valve 216, which lead to a leakage current, is carried out via plausibility analyses of the pedal travel sensor signals 133, 133a with the pedal piston spring 104, taking into account the pressure-volume characteristics of the travel simulator 116. Another possibility for detecting leaks in the redundant seal 127 of the primary chamber 111 of the master brake cylinder 201 (HZ), the seal 121 of the secondary chamber 122 of the master brake cylinder 201 (HZ), the seal 241 of the auxiliary piston tappet 212, and the isolating valve 216, which lead to a leakage current, is to correlate the pressure-volume characteristics of the brake system with the volume shift of the pressure supply 229 and the signal of the brake pressure sensor 252 in the primary circuit 233.

[0097] During diagnosis, the isolation valve 216 can also be tested for leaks when the brake pedal 101 is not depressed. To do this, the isolation valve 16 is closed and the optional isolation valve 16a and the diagnostic valve 130 are opened. The motor 228 is energized with a specific current value, and brake fluid is thus shifted from the pressure supply 229 via the hydraulic line 147, via the isolation valve 144, via the hydraulic line 147a, into the primary circuit 233, and into the wheel brake cylinder (not shown) of the primary circuit 233, and via the channel 150 into the primary chamber 111 of the HZ 201, whereby the pressure in the primary circuit 233 rises to a specific value, e.g., 25 bar. The pressure in the primary circuit 233 is measured by a pressure sensor 252, which is connected to the primary circuit 233 via a hydraulic line 253.If the isolation valve 216 is leaking, the pressure supply 229 must supply brake fluid to keep the pressure in the primary circuit 233 constant. A leak in the isolation valve 216 can be detected by the need to supply brake fluid through the pressure supply 229 to keep the pressure in the primary circuit 233 constant.

[0098] Likewise, during diagnosis, the optional isolation valve 216a can be additionally tested for leaks when the brake pedal 101 is not depressed. To do this, the optional isolation valve 216a is closed, and the isolation valve 216 and the diagnostic valve 130 are opened. The motor 228 is energized with a specific current value, and brake fluid is thus shifted from the pressure supply 229 via the hydraulic line 147, via the isolation valve 144, via the hydraulic line 147a, into the primary circuit 233, and into the wheel brake cylinders (not shown) of the primary circuit 233, and via the channel 150 into the primary chamber 111 of the HZ 201, whereby the pressure in the primary circuit 233 rises to a specific value, e.g., 25 bar. The pressure in the primary circuit 233 is measured by a pressure sensor 252. If the optional isolation valve 216a is leaking, the pressure supply 229 must supply brake fluid to keep the pressure in the primary circuit 233 constant.A leak in the optional isolation valve 216a can be detected by the need to supply brake fluid through the pressure supply 229 in order to keep the pressure in the primary circuit 233 constant.

[0099] Fig. 5a shows a braking system which is similar to the braking system of Fig. 5. However, a significant difference is that the braking system of Fig. 5a, the auxiliary piston 211 does not have an auxiliary piston tappet 212. Likewise, the intermediate wall 206 does not have a bore 213. As a result, there can no longer be a mechanical connection between the auxiliary piston 211 and the secondary piston 119. Therefore, the two seals 241 and 242 and the channel 243 in the intermediate wall 206 are also omitted. Furthermore, the hydraulic line 244 and the throttle 245 are omitted. This also eliminates possible errors such as leaks in the seals 241 and 242 and blockage of the throttle 245. The intermediate wall 206 now separates the primary chamber 111 of the master brake cylinder 112 from Fig. 4 into a primary chamber 111 and the auxiliary piston chamber 204 of the master cylinder 201 into Fig. 5a.

[0100] For the description of the function of the braking system of Fig. 5a refers to the description of the braking system under Fig. 5.

[0101] An important difference between the braking system according to Fig. 5 and the braking system according to Fig. 5a concerns the error case "failure of the brake booster", e.g. due to the simultaneous failure of the seals 125 and 127 of the master brake cylinder 201. The pressure in the primary chamber 111 and in the primary circuit 233 then remains depressurized when the driver brakes and cannot be increased by the pressure supply 229, DV1. Since the auxiliary piston tappet 212 is missing, the driver cannot use the force exerted on the pedal 101 to move the secondary piston 119 via the auxiliary piston tappet 212, and the secondary circuit 237 would also remain depressurized. This error case can be remedied by a downstream ESP, 254 via the pressure supply DV2, 255. As soon as the error is detected by the braking system, the "active braking" function of the ESP is activated. ESP increases the pressure in the wheel brake cylinders of the primary circuit 233 and the secondary circuit 237 to a target value, which can be formed, for example, from the signal of the travel sensor 133 of the pedal piston 103.ESP, 254 receives the necessary volume of brake fluid in the primary circuit 233, e.g. through the leaky seals 127 and 125 (. Fig. 5a), the channel 136, the hydraulic lines 137 and 137a and the open check valve 138 ( Fig. 4) from the reservoir 131. Under the influence of the spring force of the secondary piston spring 124 and the pressure difference between the primary chamber 111 and the secondary chamber 122 of the master cylinder 201, the secondary piston 119 is moved back (into Fig. 5a to the right) to the starting position. In the starting position of the secondary piston 119, there is a direct connection between the secondary chamber 122 and the hydraulic line 137 via the bore of the secondary piston 120 and the channel 136 in the master brake cylinder 112 ( Fig. 4). This provides ESP with the necessary volume of brake fluid in the secondary circuit 237, e.g. through channels 236 and 136 ( Fig. 4), the secondary chamber 122, through the bore of the secondary piston 120, through the hydraulic lines 137 and 137a and the opened solenoid valve 138 ( Fig. 4) from the storage container 131.

[0102] Another important difference between the braking system according to Fig. 5 and the braking system according to Fig. 5a concerns the fault case “failure of the brake booster”, e.g. due to the failure of the seal in a wheel brake cylinder in brake circuit 233, e.g. wheel brake 516 in Fig. 9a. The pressure in the primary chamber 111 then remains depressurized when the driver brakes and cannot be increased by the pressure supply 229. Since the auxiliary piston tappet 212 is missing, the driver cannot move the secondary piston 119 by means of the auxiliary piston tappet 212 with his foot force on the pedal 101, and the secondary circuit 237 would also remain depressurized. This fault can be prevented by a normally open isolating valve 144a in the primary circuit 233. As soon as the fault is detected, the isolating valve 144a is closed. The pressure supply 229 can then move brake fluid into the primary chamber 111 through the opened feed valve 144, through the primary circuit 233 and the channel 150 in the master brake cylinder 201. As a result, the secondary piston 119 moves (in Fig. 5a to the left) whereby brake fluid is shifted from the secondary chamber 122 through the channel 236 into the secondary circuit 237. Due to the brake fluid shift into the secondary circuit 237, the pressure in the secondary circuit 237 increases and thus also the pressure in the wheel cylinders of the wheel brakes (not shown, e.g. in Fig. 9a 514 and 515) of secondary circuit 237. The pressure in primary circuit 233 is measured by pressure sensor 252 and set to the target value by pressure supply 255 of ESP 254, whereby the target pressure can be formed, for example, from the signal of travel sensor 133 of pedal piston 103. This fault can also be remedied by a downstream ESP (254). As soon as the fault is detected by the braking system, the "active braking" function of ESP 254 is activated. ESP 254 then increases the pressure in the wheel brake cylinders by means of pressure supply 255 to a target value that can be formed from the signal of pedal travel sensor 133 of pedal piston 103. However, ESP, 254 will not be able to increase the pressure in the wheel brake cylinders of brake circuit 233, and there is a risk that the reservoir 131 will be sucked dry by ESP, 254.

[0103] Another important difference between the braking system according to Fig. 5 and the braking system according to Fig. 5a concerns, for example, the combination of the error cases “Failure of the seal in a wheel brake cylinder in brake circuit 233, e.g. wheel brake 516 in Fig. 9a and failure of the brake system control unit after Fig. 5a (not shown) and failure of the ESP control unit (254). If the brake system control unit fails after Fig. 5a (not shown) fails, the isolation valve 216 opens, while the isolation valve 144a remains open. When the driver presses the brake pedal 101, the auxiliary piston 211 (in Fig. 5a to the left) and pushes brake fluid from the auxiliary piston chamber 204 through the channel 248 in the master cylinder 201, through the hydraulic line 249, through the opened separating valve 216 and through the hydraulic line 250 into the primary circuit 233. Due to the failure of the seal in a wheel brake cylinder in the primary circuit 233, e.g. wheel brake 516 in Fig. 9a, the primary circuit 233 remains pressureless. Furthermore, the failure of the control unit of the brake system after Fig. 5a (not shown), the isolation valve 144a cannot be closed, and the primary chamber 111 also remains depressurized. Since the auxiliary piston tappet 212 is missing, the driver cannot move the secondary piston 119 by means of the auxiliary piston tappet 212 with his foot force on the pedal 101, and the secondary circuit 237 would also remain depressurized. Due to the simultaneous failure of the ESP control unit (254), ESP (254) can reduce the pressure in the wheel brake cylinders of the wheel brakes (e.g. 514, 515, 516, 517 in Fig. 9a) would not increase either. This would mean that all wheel brake cylinders of the wheel brakes (e.g. 514, 515, 516, 517 in Fig. 9a) remain depressurized, and the vehicle would remain unbraked despite driver braking. This situation can be tolerated, since the probability of the combination of these failure cases "Failure of the seal in a wheel brake cylinder in brake circuit 233, e.g. wheel brake 516 in Fig. 9a and failure of the brake system control unit and failure of the ESP control unit” is extremely low.

[0104] Optionally, an additional isolating valve 114b can be provided in the secondary circuit 237, which can be advantageously used, for example, in ABS control if, for example, in the event of ESP failure, the pressure supply and pressure control are carried out via the pressure supply 229 when the valve 144 is open. For some functions, such as re-feeding, the function of the isolating valves 144a, 144b can also be taken over by the ESP valves, whereby the isolating valves 144a, 144b are not required in case of doubt. For this purpose, the communication interface between the ESP and the booster must be modified. If necessary, a redundant electrical control of the booster can also be activated, for example in the event of ESP failure.

[0105] Fig. 6 shows a braking system which is similar to the braking system of Fig. 5 shows differences between the braking systems of Fig. 6 and from Fig. 5 do not concern the functions. For the description of the function of the braking system of Fig. 6 will therefore refer to the description of the function of the braking system of Fig. 5. Significant changes in the braking system of Fig. 6 compared to the braking system of Fig. 5 concern the seals. These changes in the braking system of Fig. 6 are explained in the following text.

[0106] The seal 301 is supplemented by a redundant seal 301a. Between the seal 301 and the redundant seal 301a is a channel 302 in the master brake cylinder 201 (HZ). A hydraulic line 304 with a throttle 305 is connected to the channel 302 of the master brake cylinder 201 (HZ). The hydraulic line 304 is connected to the reservoir 131 (VB). Such a configuration of seal 301, redundant seal 301a, channel 302 and line 304 with throttle 305 and reservoir 131 (VB) has already been described in Fig. 2. Therefore, a further description is omitted here. The seal of the secondary chamber 122 to the reservoir 131 (VB) can be made according to the description of Fig. 2 can be described as Fail Operational.

[0107] The seal 328 is supplemented by a redundant seal 329. Between the seal 328 and the redundant seal 329 is a channel 330 in the master brake cylinder 201 (HZ). The channel 330 of the master brake cylinder 201 (HZ) is connected via the hydraulic line 331 to the throttle 332 and via the hydraulic line 322 to the reservoir 131 (VB). Such a configuration of seal 328, redundant seal 329, channel 330 and hydraulic line 331 with throttle 332 and reservoir 131 (VB) has already been described in Fig. 2. Therefore, a further description is omitted here. The seal of the auxiliary piston chamber 204 to the reservoir 131 (VB) can be designed according to the description of Fig. 2 can be described as Fail Operational.

[0108] In the rest position of the braking system shown, the secondary chamber 122 of the master brake cylinder 201 (HZ) is connected to the reservoir 131 (VB) via the bore 120 of the secondary piston 119, via the channel 136 of the master brake cylinder 201 (HZ), via the hydraulic line 311, via the flow check valve 312, via the hydraulic line 313, and via the hydraulic line 304. Through this connection, a downstream ESP device (not shown) can draw brake fluid from the reservoir 131 (VB) via the brake circuit 237 and the channel 236 of the master brake cylinder 201 (HZ). Conversely, a downstream ESP device (not shown) can supply brake fluid to the reservoir 131 (VB) via this connection, via the brake circuit 237 and the channel 236 of the master brake cylinder 201 (HZ).The delivery of brake fluid from the downstream ESP device (not shown) to the reservoir 131 (VB) is guaranteed when the flow check valve 312 is open. The flow check valve 312 is open when the volume flow through the flow check valve 312 in the blocking direction (i.e., toward the reservoir 131) remains below a defined value. This defined value is logically greater than the maximum delivery rate of the return pump of the ESP device (not shown) in brake circuit 237. However, the flow check valve 312 should close at volume flow values greater than the defined value so that in the event of major leaks in seal 301 and the redundant seal 301a (double fault), the connection is hydraulically separated, thus limiting the volume loss in brake circuit 237.

[0109] In the rest position of the brake system shown, the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ) is connected to the reservoir 131 (VB) via the bore 214 of the auxiliary piston 211, via the channel 255 of the master brake cylinder 201 (HZ), via the hydraulic line 320, via the flow check valve 321 and via the hydraulic line 322.

[0110] Through this connection, a downstream ESP device (not shown) can draw brake fluid from the reservoir 131 (VB) via the primary circuit 233, the hydraulic line 250, the open isolation valve 216, the hydraulic line 249, and the channel 248 of the master brake cylinder 201 (HZ). Conversely, a downstream ESP device (not shown) can discharge brake fluid to the reservoir 131 (VB) via this connection and the primary circuit 233, the hydraulic line 250, the open isolation valve 216, the hydraulic line 249, and the channel 248 of the master brake cylinder 201 (HZ). The discharge of brake fluid from the downstream ESP device (not shown) to the reservoir 131 (VB) is guaranteed when the flow check valve 321 is open. The flow check valve 321 is open when the volume flow through the flow check valve 321 is in the blocking direction (i.e.i.e., in the direction of the reservoir 131) remains below a defined value. This defined value is logically greater than the maximum flow rate of the return pump of the ESP device (not shown) in primary circuit 233. However, the flow check valve 321 should close at flow rates greater than the defined value so that in the event of major leaks in the seal 328, the connection is hydraulically separated, thus limiting the volume loss in the primary circuit 233.

[0111] Similar to Fig. 5, the braking system of Fig. 6 all control and evaluation signals are processed in a control unit (not shown). Therefore, only the special features of the braking system of Fig. 6 compared to the braking system of Fig. 5. The diagnosis in Fig. 6 The detection of seal failures of the redundant seal 329 in the auxiliary piston chamber 204, which lead to a leakage current, takes place via plausibility analyses of the signals from the pedal travel sensors 133, 133a with the pedal piston spring 104, taking into account the pressure-volume characteristics of the travel simulator 116. Another possibility for detecting a leak in the redundant seal 301a of the secondary chamber 122 of the master brake cylinder 201 (HZ), which leads to a leakage current, is to correlate the pressure-volume characteristics of the brake system with the volume shift of the pressure supply 229 and the signal of the brake pressure sensor 252 in the primary circuit 233.

[0112] During diagnosis, for example, the seal 107a and the flow check valve 321 can be checked for leaks when the brake pedal 101 is not depressed. To do this, the simulator valve 334 is closed and the isolation valve 216 is opened. The motor 228 is energized with a defined value, and thus brake fluid is moved from the pressure supply 229 via the hydraulic line 147, via the opened feed valve 144, via the hydraulic line 147a, via the primary circuit 233, via the hydraulic line 250, via the isolating valve 216, via the hydraulic line 249, via the channel 248 via the auxiliary piston chamber 204 of the master brake cylinder 201 (HZ), via the bore 214 of the auxiliary piston 211, via the channel 255 of the master brake cylinder 201 (HZ), via the hydraulic line 320 in the direction of the flow check valve 321.The defined value of the motor current is selected to be large enough that the volume flow towards the flow check valve 321 is greater than the defined value at which the flow check valve 321 closes. This closes the flow check valve 321. The pressure in the primary circuit 233 is measured by a pressure sensor 252 via a hydraulic line 253. If the seal 107a is leaking, the pressure supply 229 must supply brake fluid to keep the pressure in the primary circuit 233 constant. A leak in the seal 107a can be detected by the need to supply brake fluid through the pressure supply 229 to keep the pressure in the primary circuit 233 constant.

[0113] Likewise, if the flow check valve 321 is leaking, the pressure supply 229 must supply brake fluid to keep the pressure in the primary circuit 233 constant. A leak in the flow check valve 321 can be detected by the need to supply brake fluid through the pressure supply 229 to keep the pressure in the primary circuit 233 constant.

[0114] Fig. Figure 7 shows a master brake cylinder 401 (HZ) and a piston travel simulator 402 from published patent application DE 10 2013 216 477 A1. Located in master brake cylinder 401 (HZ) are the primary piston 403 as a stepped piston and the secondary piston 404. The primary piston forms an annular chamber 405 and a primary chamber 406 in master brake cylinder 401 (HZ). The annular chamber 405 of primary piston 403 is connected to the working chamber 408 of piston travel simulator 402 via a hydraulic line 407. The secondary piston 404 forms a secondary chamber 409 in master brake cylinder 401 (HZ). A description of the brake booster function is omitted here. This description is contained in published patent application DE 10 2013 216 477 A1.

[0115] When the brake pedal is not actuated (not shown), the primary chamber 406 of the master brake cylinder 401 (HZ) is hydraulically connected to the annular chamber 405 of the master brake cylinder 401 (HZ) via the bore 410.

[0116] When the driver depresses the brake pedal (not shown), the pedal tappet 411 is moved to the left. As the pedal tappet 411 is moved to the left, the primary piston 403 is also moved to the left. As the primary piston 403 is moved, the connection between the primary chamber 406 of the master brake cylinder 401 (HZ) via the bore 410 and the annular chamber 405 of the master brake cylinder 401 (HZ) is hydraulically separated by the seal 412, and brake fluid is moved from the annular chamber 405 of the master brake cylinder 401 (HZ) via the hydraulic line 407 into the working chamber 408 of the piston travel simulator 402. With the displacement of brake fluid into the working chamber 408 of the piston travel simulator 402, the piston 413 of the piston travel simulator 402 is displaced to the right against a spring 414, whereby the spring 414 is compressed.The force of spring 414 creates pressure in the working chamber 408 of the piston travel simulator, and thus also in the annular chamber 405 of the master brake cylinder 401 (HZ). This pressure in the annular chamber 405 of the master brake cylinder 401 (HZ) generates a counterforce on the brake pedal (not shown), which the driver feels when the brake pedal is depressed (not shown). Furthermore, the check valve 417 is closed in the connection between the annular chamber 405 of the master brake cylinder 401 (HZ) via channel 415, via hydraulic line 416, via check valve 417, via hydraulic line 418, and via hydraulic line 419 to the reservoir 131 (VB).

[0117] Normally, when the driver presses the brake pedal (not shown), the primary chamber 406 of the master brake cylinder 401 (HZ) is depressurized, which results in Fig. 7 is symbolized by a dashed hydraulic line 421 from the channel 422 in the master brake cylinder 401 (HZ) via the hydraulic lines 431 and 419 to the reservoir 131 (VB).

[0118] Normally, when the driver depresses the brake pedal (not shown), the secondary chamber 409 of the master brake cylinder 401 (HZ) is connected to the pressure supply (not shown) via channel 423, so that the pressure in the secondary chamber 409 of the master brake cylinder 401 (HZ) corresponds to the pressure of the pressure supply. As a result, the secondary piston 404 normally rests against the right-hand stop 404a in the master brake cylinder 401 (HZ) when the driver depresses the brake pedal (not shown). The pressure supply (not shown) can then draw brake fluid from the reservoir 131 (VB) via channel 423, via bore 424, via the secondary chamber 409, via channel 425, via the hydraulic line 426, via the check valve 427, and via the hydraulic line 428.

[0119] The primary chamber 406 of the master brake cylinder 401 (HZ) is hydraulically separated from the secondary chamber 409 of the master brake cylinder 401 (HZ) by the seals 429 and the redundant seal 429a. Between the seal 429 and the redundant seal 429a is a channel 430, which is connected to the reservoir 131 (VB) via the hydraulic line 431 with the throttle 432 and via the hydraulic line 419.

[0120] By connecting the channel 430 in the master brake cylinder 401 (HZ) with the reservoir 131 (VB) via the hydraulic line 431 with the throttle 432, via the hydraulic lines 431 and 419, the pressure in channel 430 is equal to the pressure in the reservoir 131 (VB) if height differences between the reservoir 131 (VB) and the channel 430 are neglected.

[0121] If the pressure in the primary chamber 406 of the master brake cylinder 401 (HZ) is equal to the pressure in the reservoir 131 (VB), then, with an intact redundant seal 429a, the seal 429 is not stressed because the pressure in channel 430 also corresponds to the pressure in the reservoir 131 (VB), even if the secondary chamber 409 of the master brake cylinder 401 (HZ) is under pressure. Furthermore, with an intact redundant seal 429a, any dirt particles in the secondary chamber 409 of the master brake cylinder 401 (HZ) are retained by the redundant seal 429a, preventing them from penetrating into channel 430 and damaging the seal 429. Therefore, with an intact redundant seal 429a, the seal 429 does not fail.

[0122] If the redundant seal 429a becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the secondary chamber 409 of the master brake cylinder 401 (HZ) through channel 430, through the hydraulic lines 431 with throttle 432, and through the hydraulic line 419 to the reservoir 131 (VB). This outflow of brake fluid can be compensated for by the pressure supply (not shown). The compensation of brake fluid by the pressure supply (not shown) is an indicator of the leak in the redundant seal 429a and can be determined using the motor rotation angle sensor (not shown) of the pressure supply (not shown).

[0123] A leak in the redundant seal 429a can thus be detected during operation without disrupting operation. Therefore, the combination of the redundant seal 429a, the seal 429, the channel 430, the hydraulic line 431 with throttle 432, and the hydraulic line 419 to the reservoir 131 (VB) results in a hydraulic separation of the secondary chamber 409 of the HZ 401 from the primary chamber 406 of the HZ 401, which can be referred to as a fail-operational condition.

[0124] When the brake pedal is depressed (not shown), the primary piston 403 moves to the left, and the bore 410 in the primary piston 403 slides past the redundant seal 412a. The redundant seal 412a hydraulically separates the annular chamber 405 of the master brake cylinder 401 (HZ) from the primary chamber 406 of the master brake cylinder 401 (HZ).

[0125] If the primary piston 403 is moved further to the left, the bore 410 in the primary piston 403 may also be moved past the seal 412. The primary chamber 406 of the master brake cylinder 401 (HZ) is then hydraulically separated from the annular chamber 405 of the master brake cylinder 401 (HZ) by the seal 412 and the redundant seal 412a. Between the seal 412 and the redundant seal 412a is a channel 433, which is connected to the reservoir 131 (VB) via the hydraulic line 419 with throttle 434. By connecting channel 433 to reservoir 131 (VB) via hydraulic line 419, the pressure in channel 433 is equal to the pressure in reservoir 131 (VB) if height differences between reservoir 131 (VB) and channel 433 are neglected.

[0126] If the pressure in the primary chamber 406 of the master brake cylinder 401 (HZ) is equal to the pressure in the reservoir 131 (VB), then, with an intact redundant seal 412a, the seal 412 is not stressed, even if the annular chamber 405 of the master brake cylinder 401 (HZ) is under pressure. Furthermore, with an intact redundant seal 412a, any dirt particles in the annular chamber 405 of the master brake cylinder 401 (HZ) are retained by the redundant seal 412a, preventing them from penetrating channel 433 and damaging the seal 412. Therefore, with an intact redundant seal 412a, the seal 412 does not fail.

[0127] If the redundant seal 412a becomes leaky, e.g. due to wear or dirt particles, brake fluid can flow from the annular chamber 405 of the master brake cylinder 401 (HZ) through channel 433, through the hydraulic lines 419 with the throttle 434 to the reservoir 131 (VB). This outflow of brake fluid can be compensated for by the driver by reducing the force on the brake pedal (not shown). The brake pedal does not collapse. The compensation of the braking force is an indicator of the leak in the redundant seal 412a and can be determined by means of the primary piston travel sensor (not shown) and the pressure sensor of the piston travel simulator (not shown) using the pressure-volume characteristic of the piston travel simulator 402.

[0128] A leak in the redundant seal 412a can thus be detected during operation without disrupting operation. Therefore, the combination of the redundant seal 412a, the seal 412, the channel 433, the hydraulic line 419, and the throttle 434 to the reservoir 131 (VB) results in a hydraulic separation of the annular chamber 405 of the HZ 401 from the primary chamber 406 of the HZ 401, which can be referred to as a fail-operational condition.

[0129] The hydraulic separation of the annular chamber 405 of the master brake cylinder 401 (HZ) from the protected space 435 of the pedal tappet 411 occurs via the redundant seal 436a and the seal 436. Between the redundant seal 436a and the seal 436 there is a channel 437 in the primary piston 403 with a throttle 438. The pressure in the protected space 435 of the pedal tappet 411 is equal to atmospheric pressure.

[0130] Normally, when the driver depresses the brake pedal (not shown), the pressure in the annular chamber 405 of the master brake cylinder 401 (HZ) is higher than the atmospheric pressure in the protected chamber 435 of the pedal tappet 411. The pressure in the channel 437 of the primary piston 403 is also equal to atmospheric pressure. As a result, the seal 436 is normally not stressed when the driver depresses the brake pedal (not shown) and the redundant seal 436a is intact, even when the annular chamber 405 of the master brake cylinder 401 (HZ) is under pressure. Furthermore, when the redundant seal 436a is intact, any dirt particles in the annular chamber 405 of the master brake cylinder 401 (HZ) are retained by the redundant seal 436a, preventing them from penetrating the channel 437 and damaging the seal 436. If the redundant seal 436a is intact, the seal 436 will not fail.

[0131] If the redundant seal 436a becomes leaky, e.g. due to wear or dirt particles, brake fluid can flow out of the annular chamber 405 of the master brake cylinder 401 through channel 437 with the throttle 438 into the protected space 435 of the pedal tappet 411. This outflow of brake fluid can be compensated for by the driver by reducing the force on the brake pedal (not shown). The brake pedal does not collapse. The compensation of the brake pedal force is an indicator of the leakage of the redundant seal 436a and can be determined by means of the primary piston travel sensor (not shown) and the pressure sensor of the piston travel simulator 402 (not shown) using the pressure-volume characteristic of the piston travel simulator 402.

[0132] A leak in the redundant seal 436a can thus be detected during operation without disrupting operation. Therefore, the combination of the redundant seal 436a, the seal 436, the channel 437, and the throttle 438 to the protected space 435 of the pedal tappet 411 results in a hydraulic separation of the annular chamber 405 of the HZ 401 from the protected space 435 of the pedal tappet 411, which can be referred to as a fail-operational situation.

[0133] The hydraulic separation of the working chamber 408 of the piston travel simulator 402 from the air-filled spring chamber 439 of the piston travel simulator 402 occurs via the redundant seal 440a and the seal 440. Between the redundant seal 440a and the seal 440 is a channel 441 in the piston travel simulator 402, which is connected to the throttle 443 via a hydraulic line 442, to the reservoir 131 (VB) via the hydraulic line 418, and to the reservoir 131 (VB) via the hydraulic line 419. The pressure in the channel 441 of the piston travel simulator is equal to the pressure in the reservoir 131 (VB) if height differences between the reservoir 131 (VB) and the channel 441 are neglected, with atmospheric pressure prevailing in the reservoir 131 (VB).

[0134] Normally, when the driver depresses the brake pedal (not shown), the pressure in the annular chamber 405 of the master brake cylinder 401 (HZ), and thus the pressure in the working chamber 408 of the piston travel simulator 402, is higher than the atmospheric pressure in the spring chamber 439 of the piston travel simulator 402. The pressure in the channel 441 of the piston travel simulator 402 also equals atmospheric pressure. As a result, the seal 440 is normally not stressed when the driver depresses the brake pedal (not shown) and the redundant seal 440a is intact, even when the working chamber 405 of the piston travel simulator 402 is pressurized. Furthermore, if the redundant seal 440a is intact, any dirt particles in the working chamber 408 of the piston travel simulator 402 are retained by the redundant seal 440a so that they cannot penetrate into channel 441 and damage the seal 440.If the redundant seal 440a is intact, the seal 440 will not fail.

[0135] If the redundant seal 440a becomes leaky, e.g. due to wear or dirt particles, brake fluid can flow out of the working chamber 408 of the piston travel simulator 402 through channel 441, through the hydraulic line 442 with throttle 443, through the hydraulic line 418 and through the hydraulic line 419 to the reservoir 131 (VB). This outflow of brake fluid can be compensated for by the driver by reducing the force on the brake pedal (not shown). The brake pedal (not shown) does not collapse. The compensation of the force on the brake pedal (not shown) is an indicator of the leak in the redundant seal 440a and can be determined by means of the primary piston travel sensor (not shown) and the pressure sensor of the piston travel simulator 402 (not shown) using the pressure-volume characteristic of the piston travel simulator 402.

[0136] A leak in the redundant seal 440a can thus be detected during operation without disrupting operation. Therefore, the combination of the redundant seal 440a, the seal 440, the channel 441, the hydraulic line 442 with the throttle 443, the hydraulic line 418, and the hydraulic line 419 to the reservoir 131 (VB) results in a hydraulic separation of the working chamber 408 of the piston travel simulator 402 from the spring chamber 439 of the piston travel simulator 402, which can be referred to as a fail-operational event.

[0137] The redundant seal 446a, the channel 447, and the hydraulic line 449 with the throttle 448 are provided for the mechanical fallback level, e.g., in the event of a failure of the entire vehicle electrical system. When the brake pedal is depressed (not shown), the primary piston 403 moves to the left, and the bore 410 in the primary piston 403 slides past the redundant seal 412a. The redundant seal 412a hydraulically separates the annular chamber 405 of the master brake cylinder 401 (HZ) from the primary chamber 406 of the master brake cylinder 401 (HZ).

[0138] If the primary piston 403 is moved further to the left, the bore 410 in the primary piston 403 may also be moved past the seal 412. The primary chamber 406 of the master brake cylinder 401 (HZ) is then hydraulically separated from the annular chamber 405 of the master brake cylinder 401 (HZ) by the seal 412 and the redundant seal 412a. In the mechanical fallback level, the annular chamber 405 is directly connected to the reservoir 131 (VB) via hydraulic lines and a solenoid valve (not shown), so that the pressure in the annular chamber 405 does not increase when the brake pedal (not shown) is actuated. In contrast, in the mechanical fallback level, the hydraulic line 421 is blocked by a solenoid valve (not shown), so that the pressure in the primary chamber 406 increases when the brake pedal (not shown) is actuated.

[0139] In the mechanical fallback level, the pressure supply (not shown) is not in operation, so that the pressure in channel 423, and thus the pressure in the secondary chamber 409 of the master brake cylinder 401 (HZ), is not influenced by the pressure supply (not shown). As the pressure in the primary chamber 406 increases, the secondary piston 404 moves to the left. If, during this displacement of the secondary piston 404, the bore 424 of the secondary piston 404 is displaced past the redundant seal 446a, the secondary chamber 409 is hydraulically separated from the channel 447, which is connected to the reservoir 131 (VB) via the hydraulic line 449 with throttle 448, via the hydraulic line 431, and via the hydraulic line 419. Due to this hydraulic separation, with further displacement of the secondary piston 404, the pressure in the secondary chamber, and thus also the pressure in the channel 444, can increase.

[0140] If seal 412 becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from primary chamber 406 of master brake cylinder 401 (HZ) through channel 433, through hydraulic line 419 with throttle 434 to reservoir 131 (VB). This outflow of brake fluid can be compensated for by the driver by increasing the displacement of the brake pedal (not shown). The brake pedal does not collapse. A leak in seal 412 does not disrupt operation in the mechanical fallback level. Therefore, the combination of the redundant seal 412a, the seal 412, the channel 433, the hydraulic line 419 with the throttle 434 to the reservoir 131 (VB) leads to a hydraulic separation of the primary chamber 404 of the HZ 401 from the reservoir 131 (VB), which can be referred to as Fail Operational in the mechanical fallback level.

[0141] If the redundant seal 446a becomes leaky, e.g., due to wear or dirt particles, brake fluid can flow from the secondary chamber 409 of the master brake cylinder 401 (HZ) through channel 447, through the hydraulic line 449 with the throttle 448, and through the hydraulic lines 431 and 419 to the reservoir 131 (VB). This outflow of brake fluid can be compensated for by the driver by increasing the displacement of the brake pedal (not shown). The brake pedal does not collapse. A leak in the redundant seal 446a does not disrupt operation in the mechanical fallback level.Therefore, the combination of the redundant seal 446a, the seal 446, the channel 447, the hydraulic line 449 with the throttle 448, the hydraulic line 431 and the hydraulic line 419 to the reservoir 131 (VB) leads to a hydraulic separation of the secondary chamber 409 of the HZ 401 from the reservoir 131 (VB), which can be referred to as Fail Operational in the mechanical fallback level.

[0142] Similar to Fig. 4, the braking system of Fig. 7 all control and evaluation signals are processed in a control unit (not shown). Therefore, only the special features of the braking system of Fig. 7 compared to the braking system of Fig. 4. The diagnosis of seal failures of the redundant seal 412a of the primary chamber 406, the redundant seal 436a of the annular chamber 405, and the redundant seal 440a of the working chamber 408 of the piston travel simulator 402, which lead to a leakage current, is carried out via plausibility analyses of the redundant sensor signals of the primary piston travel (not shown) with the signal of the pressure sensor (not shown) for the pressure in the working chamber 408 of the piston travel simulator 402, taking into account the pressure-volume characteristics of the piston travel simulator 402. Another possibility for detecting a leak in a seal that leads to a leakage current is to correlate the pressure-volume characteristics of the brake system with the volume displacement of the pressure supply (not shown) and the signal of the redundant brake pressure sensor (not shown) in the brake circuit 444. In the brake system of Fig. 7, the leakage flow flows through each seal back into the reservoir 131 (VB), except for the redundant seal 436a of the annular chamber 405 of the master brake cylinder 401 (HZ). If the leakage flow does not flow back into the reservoir 131 (VB), then a diagnosis of the leakage is possible by correlating the leakage loss with the signal of a redundant level sensor 151 in the reservoir 131 (VB), which is preferably linear.

[0143] Fig. Figure 8 describes how, during braking followed by a vehicle stop, the residual pressure in the system at the end of a braking operation is used to diagnose leaks with the corresponding valve switching "closed - open - closed." The starting point is the assumption that components tested for correct function during the diagnosis at the end of a braking operation will, under certain conditions, still function correctly during the subsequent braking operation. This avoids a separate pre-drive check (PDC), which would increase the load cycles, particularly on the seals.

[0144] The diagnosis is now based on the braking system of Fig. 5. In Fig. 8, the brake pressure P in primary circuit 233, measured by pressure sensor 252, is shown as a function of the actuation of brake pedal 101, exemplified as a solid or dashed curve over time t. Below this, the signal of isolation valve 216 (FV) is shown, with isolation valve 216 (FV) being closed when the signal is 1, and isolation valve 216 (FV) being open when the signal is 0. Below the signal of isolation valve 216 (FV), the signal of the driver's door is shown, with the driver's door being closed when the signal is 1, and the driver's door being open when the signal is 0. Below the driver's door signal, the signal of the wheel brake inlet valves EV (not shown) is indicated, with the wheel brake inlet valves EV being closed when the signal is 1 and the wheel brake inlet valves EV being open when the signal is 0.

[0145] At time t=0, the braking process is initiated until the vehicle stops. The isolation valve 216 (FV) is closed and the driver's door is closed. The inlet valves EV of the wheel brakes (not shown) are open. At time t=t1, the pressure P in the primary circuit 233 is kept constant, and from time t=t2, the brake pressure in the brake circuit is reduced because the vehicle has come to a stop or is almost reached, and the braking process is terminated. For diagnosis, the position of the piston of the pressure supply 229 is kept constant in the time range t=t3 to t=t7. If there is no leak in a seal, the pressure P in the primary circuit 233 remains constant in the time range D, from t=t3 to t=t6 (solid pressure line). If the pressure P in the primary circuit 233 decreases in the time range from t=t3 to t=t4 (dash-dotted pressure curve), then there is a leak in a seal, e.g. seal 241.If, in the event of a seal leak at time t=t4, the inlet valves EV of the wheel brakes (not shown) are closed until t=t5, and the pressure P in primary circuit 233 remains constant in the time range from t=t4 to t=t5, then there is a leak at one or more of the wheel brake seals (not shown) (dashed pressure line). Otherwise, there is a leak at the seals in the braking system, e.g., seal 241.If the isolating valve 216 (FV) is opened in the time range t=t6 to t=t7, then, with the brake pedal 101 not actuated, brake fluid flows from the wheel brakes (not shown) through the open inlet valves of the wheel brakes (not shown) through the primary circuit 233, through the hydraulic line 250, through the opened isolating valve 216 (FV), through the hydraulic line 249, through the channel 248, through the auxiliary piston chamber 204, through the auxiliary piston bore 214, through the channel 255, through the hydraulic line 129, through the opened diagnostic valve 218 and through the hydraulic line 129a back into the reservoir 131 (VB), whereby the brake pressure P in the primary circuit 233 is reduced. If the isolation valve 216 (FV) is closed again and the pressure P in primary circuit 233 remains constant, then the isolation valve 216 (FV) is sealed. Otherwise, if the pressure P in primary circuit 233 continues to drop, the isolation valve 16 (FV) is leaking.At time t=t8, the driver's door is opened and the diagnostic process is aborted. After the driver's door is closed at time t=t9, the diagnostic process can be repeated the next time the vehicle stops at time t=t10.

[0146] If it is discovered between t=t4 and t=t5 that the leak is attributable to the wheel brakes (not shown), the EV of one wheel brake at a time can be briefly opened. If the pressure P drops again, this wheel brake is identified as having the leak, and this wheel brake can then be excluded from braking during the next braking operation by keeping the EV of this wheel brake closed during the braking operation.

[0147] The opening / closing functions of the isolation valve 216 (FV) and its tightness are important for the "Fail Operational" safety category, as in the event of a fault, the brake booster function (BKV) may not be possible. Therefore, the described diagnostics are of great importance. This ensures that no volume flow occurs through the FV valve after the diagnostics. To ensure this, the following circuits of the isolation valve 216 (FV) are possible: • FV shutdown (open) after diagnosis: ◯ When the ignition is off ◯ With the ignition off and the driver’s door closed ◯ When ignition is off with timer after ignition on • FV switching on (close): ◯ When opening the vehicle door ◯ When ignition is on ◯ With pre-contact on the brake pedal, so that FV closes before volume is moved via the piston of the master brake cylinder (HZ)

[0148] Fig. 9a shows a complete braking system as an extension of the partial braking system of Fig. 5. The extensions mainly concern redundancy and are now described.

[0149] The pressure supply 500 (DV) is dual-circuit, e.g. according to the principle of the double-stroke piston DHK ( Fig. 3), and supplied via the annular chamber (87, Fig. 3), via the hydraulic line 501 the primary circuit 502 and via the chamber (86, Fig. 3), via the hydraulic line 503, the secondary circuit 504 is supplied with brake fluid. Furthermore, the annular chamber (87, Fig. 3) via the hydraulic line 505, with suction valve 506, connected to the chamber 507 (VB1) of the reservoir 508. The chamber (86, Fig. 3) is connected to chamber 511 (VB2) of reservoir 508 via hydraulic line 509 with suction valve 510. In this way, primary circuit 502 and secondary circuit 504 remain hydraulically separated. Thus, a leak in primary circuit 502 leads to failure of primary circuit 502 but not to failure of secondary circuit 504. Conversely, a leak in secondary circuit 504 leads to failure of secondary circuit 504 but not to failure of primary circuit 502.

[0150] The hydraulic lines 501, 505, or 503 and 509 may also contain solenoid valves (not shown) to enable pressure build-up and pressure reduction in the primary circuit 502 and the secondary circuit 504, respectively. If the chamber (86, Fig. 5) of the double-acting piston (87, Fig. 3), then the pressure build-up and pressure reduction in the secondary circuit 504 via the hydraulic line 503 fail. The pressure build-up and pressure reduction in the primary circuit 502 via the hydraulic line 503 are still possible. Similarly, if the annular chamber (87, Fig. 5) of the double-acting piston ( Fig. 3) fails, then the pressure build-up and pressure reduction in the primary circuit 502 via the hydraulic line 501 fails. The pressure build-up and pressure reduction in the secondary circuit 504 via the hydraulic line 503 are still possible. Thus, a single fault in the pressure supply 500 (DV) does not lead to a failure of the pressure supply 500 (DV).

[0151] Motor 512 contains two three-phase windings with two three-phase controls. If a three-phase winding fails, motor 512 can still operate. Furthermore, the motor contains a redundant, preferably intrinsically safe, armature angle sensor 513, so that if one armature angle sensor 513 fails, motor 512 can still operate.

[0152] The brake circuit distribution is in Fig. 9a shown diagonally. For example, in a car, wheel brake 514 is located on the front left wheel and wheel brake 515 is located on the rear right wheel. In this example, wheel brake 516 is located on the front right wheel and wheel brake 517 is located on the rear left wheel.

[0153] The valve arrangement for wheel brakes 514, 515, 516, and 517 is designed for so-called multiplex operation with ABS. For example, if the pressure at wheel brake 514 needs to be reduced during ABS operation, valves 519, 520, and 521 are closed and valve 518 is opened. The pressure reduction at wheel brake 514 then takes place via the piston movement (71, Fig. 3) the pressure supply 500 (DV). During the pressure reduction at the wheel brake 514, the pressure at the wheel brakes 515, 516, 517 remains constant (pressure hold). Alternatively, the pressure at the wheel brake 514 can also be reduced via the outlet valve 522 and via the hydraulic line 523 to chamber 511 (VB2) of the reservoir 508. This preferably occurs when, during the pressure buildup at one wheel brake, e.g., 515 or 516 or 517, the pressure is built up in multiplex mode, while the pressure at the wheel brake 514 must be reduced.

[0154] The wheel brake 516 is connected to the primary circuit 502 via the hydraulic line 524, via the valve 521, via the hydraulic line 525, via the redundant valve 521a, via the hydraulic line 526 and via the hydraulic line 501. For the ABS function, it is sufficient that the valve 521 closes when the ABS controller requests "pressure maintenance" at the wheel brake 516, e.g., in the case of ABS. If the valve 521 is leaking, the redundant valve 521a closes when the ABS controller requests "pressure maintenance" in the wheel brake 516. This ensures that the lateral stability of the vehicle at the wheel 516 is maintained even if the valve 521 is leaking. The leakage of the valve 521 and the redundant valve 521a can be checked during diagnosis, as already described using Fig. 5 for valves 216 and 216a. On the other hand, if the wheel brake 516 is leaking, loss of brake fluid can be reliably prevented by closing valve 521 and the redundant valve 521a.

[0155] A similar valve arrangement to that on wheel brake 516 is provided on wheel brake 515. Thus, the same advantages as on the wheel of wheel brake 516 apply to the wheel of wheel brake 515: ensuring that the lateral stability of the vehicle at wheel 516 is maintained in the event of a leak in valve 519, and ensuring that the loss of brake fluid is prevented in the event of a leak in wheel brake 515 by closing valve 519 and the redundant valve 519a.

[0156] The reservoir 508 is expanded to include a third chamber 527 (VB3). Leakage flows through the throttles 528 and 529, which can occur during braking or during diagnosis due to leaks in the seals of the master brake cylinder 201, increase the brake fluid level in the third chamber 527 (VB3) and reduce the brake fluid level in chambers 507 (VB1) and 511 (VB2) of the reservoir 508. These level changes in the third chamber 527 (VB3) and in chamber 507 (VB1) and in chamber 511 (VB2) of the reservoir 508 can be detected via the level sensor 530 in the third chamber 527 (VB3) and via the redundant level sensor 151 in chamber 507 (VB1) and chamber 511 (VB2) of the reservoir 508. This provides another opportunity to detect leaks in the seals of the master brake cylinder 201 (HZ).

[0157] Leakage flows through the throttle 142 of the travel simulator piston 117 and through the throttle in the pressure supply piston (see throttle 82 in Fig. 3) are not returned to the reservoir 508. If such leakages occur, the level of the brake fluid in chamber 507 (VB1) and in chamber 511 (VB2) of the reservoir 508 is lower after braking than before braking. This level change in chambers 507 (VB1) and 511 (VB2) of the reservoir 508 can be detected via the redundant level sensor 151. This provides a further possibility of detecting leaks in the seals of the travel simulator piston 117 and the double-stroke piston (71, Fig. 3) to be detected both after braking and after diagnosis.

[0158] The control unit 531 (ECU) displays the input and output signals of the sensors, e.g., the redundant level sensor 151, the motor 512, and the valves, e.g., solenoid valve 518, and any additional input and output signals X as a reserve. Furthermore, the control unit 531 (ECU) displays triple redundancy in the electrical accumulators 532 (U1), 533 (U2), and 534 (U3). The failure of an electrical accumulator, e.g., 532 (U1), is handled using the so-called "two out of three" rule, which is familiar from the aircraft industry. The voltages of the electrical accumulators 532 (U1), 533 (U2), and 534 (U3) are compared with each other. If two electrical storage devices show the same voltage, e.g. 533 (U2) and 533 (U3), while the electrical storage device 532 (U1) shows a different voltage, then the electrical storage device 532 (U1) is detected as faulty and excluded from the voltage supply.The power supply to control unit 531 (ECU) is then provided exclusively via the electrical memories 533 (U2) and 534 (U3). A more detailed description of the control unit functions can be found in the description of . Fig. 9d can be found.

[0159] Fig. 9b shows an embodiment of a throttle, e.g. throttle 528 in Fig. 9a. The throttle consists of a perforated plate 535 in the hydraulic line, e.g. 536, to the reservoir 508. The perforated plate 535 has at least two holes 537 and 537a, with each hole 537 and 537a forming a throttle through which the leakage flow in the hydraulic line 536 flows. If the hole 537 is blocked by dirt particles, the leakage flow through the hydraulic line 536 can still flow through at least one hole 537a. The throttle 538 is therefore redundant. To prevent dirt from reaching the perforated plate, a filter screen 538 is installed upstream of the perforated plate, in the direction of flow. During braking and also during diagnosis, a leak in the seals in the master brake cylinder 201 (HZ) can be discovered even if a hole, e.g. 537, is blocked.

[0160] Fig. 9c shows a complete braking system as an extension of the braking system of Fig. 9a. The extension mainly concerns the redundancy of the pressure supply with drive and is now described.

[0161] The annular chamber (87, Fig. 3) of the dual-circuit pressure supply 500 (DV1) is now connected to the primary circuit 502 via the hydraulic line 501, the isolating valve 601 and the hydraulic line 602. The chamber (86, Fig. 3) The dual-circuit pressure supply 500 (DV1) is now connected to the secondary circuit 504 via the hydraulic line 503, the isolating valve 603, and the hydraulic line 604. The valve 612 is connected in parallel to the suction valve 506. This allows the pressure in the primary circuit 502 to be quickly reduced to chamber VB2 of the storage tank 508 via the hydraulic line 602, the isolating valve 601, the hydraulic line 501, and the valve 612. Likewise, the valve 613 is connected in parallel to the suction valve 510. This allows the pressure in the secondary circuit 504 to be quickly reduced to chamber VB1 of the storage tank 508 via the hydraulic line 604, the isolating valve 603, the hydraulic line 503, and the valve 613.

[0162] Similar to the pressure supply 500 (DV1), the annular chamber (87, Fig. 3) the dual-circuit pressure supply 605 (DV2) is connected to the primary circuit 502 via the hydraulic line 606, the isolating valve 607, the hydraulic line 608 and the hydraulic line 602. The chamber (86, Fig. 3) the dual-circuit pressure supply 605 (DV2) is now connected to the secondary circuit 504 via the hydraulic line 609, via the isolating valve 610, via the hydraulic line 611 and via the hydraulic line 604.

[0163] If the pressure supply 500 (DV1) is intact, the brake boost and ABS pressure modulation are carried out via the pressure supply 500 (DV1). If the pressure supply 500 (DV1) fails, e.g., due to a fault in the drive of the double-acting piston (71, Fig. 3), the isolation valves 601 and 603 are closed and the operation of the pressure supply 500 (DV1) is shut down. The isolation valves 607 and 610 are opened and the operation of the braking system is taken over by the pressure supply 605 (DV2). In this way, fail-operational operation of the braking system is ensured, even in the event of a failure of the pressure supply 500 (DV1).

[0164] Fig. Figure 9d shows the basic concept of a redundant control unit (ECU) for the braking systems of Fig. 9a and Fig. 9c. The power supply 700 is provided redundantly from the redundant electrical storage devices U1, U2 and, in some cases, additionally from U3, comparable to aircraft technology with the so-called “2 out of 3” selection, as in Fig. 9a. This power supply 700 supplies the computers 701 (CP1 to CP3). The output signals of the computers CP1 and CP2 affect the control 702 of, for example, the motor and valves, with the corresponding output stages 703. Here, it is possible to control the motors and valves with double or triple redundancy. However, this requires a lot of effort; for example, with ESP 12, additional valve controls would have to be installed. Smart redundancy is possible here, as in Fig. As shown in Figure 9a, only selected valves are designed with redundant control. It is common practice with ESP to continuously monitor the control via lines 704 to computer CP1 and computer CP2. It is also possible to configure redundant control only with computers CP1, CP2, and CP3. For example, it is known to control a BLCD motor with two three-phases instead of three, assuming that the motor bearings and drive are fail-safe.

[0165] Sensor signals 705 act on the ECU and are routed to the computers CP1, CP2 and CP3 via the input / output 706 (I / O). In a fully redundant braking system according to Fig. 9c, preferably for fully autonomous driving (AD) (Level 5 of automated driving), it is also conceivable to design the braking system without a tandem master cylinder (THZ) (not shown). Here, the THZ can be replaced by a "Brake and Go" signal 707, which is generated by the AD in the central ECU.

[0166] For the entire computing functions for processing the input signals, e.g., from the sensors 705 via the corresponding first I / O 706a and second I / O 706b, one or more powerful computer CPUs, e.g., microcontrollers, are used, which control the actuators, e.g., motors and valves, via the corresponding integrated or separate control 702 with output stages 703. The designations 702 and 703 refer to only one symbol, but also apply to the neighboring symbols.

[0167] The computers CP1, CP2, and CP3 can be configured redundantly, e.g., doubly redundant as CP1 and CP2 or triple redundant as CP1, CP2, and CP3. Due to the complexity involved, the computer CP2 can alternatively be used for reduced functions and the computer CP3 for emergency functions of the braking system. This also applies to the actuators and valves. For the engine, this means Fig. 9a that the redundant control for the two-winding combination, i.e., three-phase redundant, and for the valves, that only one or two valves of an axis are controlled redundantly. Or even just the control is redundant and acts on one valve, since the failure rate of a valve's coil is extremely low.

[0168] If only partial functions are to be fulfilled according to the invention, such as partial ABS function per axle, partial redundancy of the valves may be sufficient. In certain cases, such as ESP, this may require an additional sensor (yaw angle sensor for ESP).

[0169] The block diagram shows that all input signals from sensors 705 and the brake and go signals 706 affect all computers CP1, CP2, and CP3. The output signals to the control unit 702 with output stages 703 are also provided separately from each CP.

[0170] With the trend toward architectures with domains and central computers, it makes sense to design the control system separately in an ECU as a slave. The slave ECU then contains the entire control system with power amplifiers and, if necessary, I / O for sensors or switch signals (Brake and Go 707). Signal transmission to the master ECU then takes place via redundant bus systems, possibly according to the computer structure mentioned above for full functionality to emergency function with different structures and different protocols.

[0171] Due to the low complexity of the slave ECU, costs can be saved by simply routing the circuit board to one or just a few layers. Due to the high complexity of the functions, neural networks in the software are particularly suitable.

[0172] The above advantageous embodiments and configurations describe in particular in the Fig.4 to 9 systems, in particular brake or clutch systems. The solutions according to the invention can also be advantageously applied to other hydraulic systems and critical seals of such systems. Individual elements of the invention described above and illustrated in the drawings, or their embodiments, as well as other combinations, can also be advantageously applied. List of reference symbols BK1 primary circuit BK2 secondary circuit D Diagnosis period (t3 to t7) EV intake valve FV isolation valve (216) P Brake pressure in the primary circuit PDC Pre-Drive Check t1 Time at which the pressure is kept constant t2 Time at which the pressure is reduced t3 Time at which the pressure is kept constant for diagnosis t4 Time when pressure drop is checked and the inlet valves are closed t5 Time when the intake valves are opened t6 Time when the isolation valve FV is opened t7 Time when the isolation valve FV is closed t8 Time when the driver's door is opened, termination of the diagnosis t9 Time when the driver's door is closed t10 Repetition of vehicle stop diagnosis 1 secondary piston of a brake system 2 tandem master cylinders (THZ) 3 Primary chamber of the tandem master cylinder 4 Secondary chamber of the tandem master cylinder 5 channels in the cylinder 6 Hydraulic line 7 storage containers (VB) 8 Cylinder seal 9 Cylinder seal 9a Redundant cylinder seal 10 channels in the cylinder 11 Hydraulic line 12 Throttle 13 channels in the cylinder 14 Hydraulic line 15 channels in the cylinder 16 Hydraulic line 17 Bore in the secondary piston 21 actuator pistons 22 piston tappets 23 hydraulic cylinders 24 Working space of the hydraulic cylinder 25 Interior of the hydraulic cylinder 26 Force 27 channels in one cylinder 28 Hydraulic line 41 Primary piston of the tandem master cylinder 41a Tappet 42 Tandem master cylinder (THZ) 43 Primary chamber of the tandem master cylinder 44 Piston tappet chamber 45 Primary piston bore 46 channels in the cylinder 47 Hydraulic line 48 Seal 49 Seal 49a Redundant seal 50 channel 51 Hydraulic line 52 Throttle 53 Channel 54 Hydraulic line 71 stepped pistons or double-stroke pistons (DHK) 72 cylinders of the stepped piston 73a Channel in the cylinder 73b Channel in the cylinder 73c Channel in the cylinder 73d channel in the cylinder 74a Hydraulic line 74b Hydraulic line 74c Hydraulic line 74d Hydraulic line 75a suction valve 75b suction valve 75c check valve 75d check valve 76 Hydraulic line 78 channel 79 Seal in the stepped piston 80 Seal in the stepped piston 81 channel in the stepped piston 81a Channel in the stepped piston 82 Throttle in the stepped piston 83 Seal 84 Seal 85 Throttle 86 Chamber 87 Annular chamber 88 Piston rod 89 Piston rod chamber 101 Brake pedal 102 pedal tappets 103 pedal piston 104 Pedal piston spring 105 primary pistons 106 Primary piston bore 107 Seal 108 Isolating valve 109 Isolating valve 110 Simulator valve 111 Primary chamber of the tandem master cylinder 112 Tandem master cylinder (THZ) 113 Channel 114 Hydraulic line 114a Hydraulic line 115 Throttle 116 path simulator 117 Travel simulator piston 118 Spring package of the path simulator 119 Secondary piston 120 Bore of the secondary piston 121 Seal 122 Secondary chamber of the tandem master cylinder 123 Primary piston spring 124 Secondary piston spring 125 Seal 126 channel 127 Seal 128 channel 129 Hydraulic line 129a Hydraulic line 130 diagnostic valve 131 Storage container (VB) 132 Exterior of the tandem master cylinder 133 displacement sensor 133a displacement sensor 134 Hydraulic line 135 Throttle 136 channel 137 Hydraulic line 137a Hydraulic line 138 check valve 139 Working chamber of the path simulator 140 Seal of the travel simulator piston 140a Redundant seal of the travel simulator piston 141 Channel in the travel simulator piston 141a Channel in the travel simulator piston 142 Throttle in the travel simulator piston 143 Space of the spring assembly of the travel simulator piston 144 Feed valve 144a Isolation valve, normally open 144b Isolation valve, normally open 145 Pressure supply motor (DV) 147 Hydraulic line 147a Hydraulic line 148 Hydraulic line 149 Hydraulic line 150 channels 151 Pedal return spring 201 Master brake cylinder (HZ) 204 Auxiliary piston chamber 206 Partition between auxiliary piston chamber and primary chamber 211 auxiliary piston 212 auxiliary piston tappet 213 Hole in the partition wall 214 Bore of the auxiliary piston 215 Seal 216 Isolation valve 216a Redundant isolation valve 217 Channel 218 Hydraulic line 228 Pressure supply motor 229 Pressure supply (DV1) 233 Primary circuit 236 channel 237 Secondary circuit 241 Seal 242 Seal 243 channel 244 Hydraulic line 245 Throttle 247 storage containers (VB) 248 channel 249 Hydraulic line 250 Hydraulic line 252 Pressure sensor in the primary circuit 253 Hydraulic line 254 Electronic Stability Program (ESP) 255 Pressure supply of the ESP (DV2) 301 Seal 301a Redundant seal 302 channel 304 Hydraulic line 305 Throttle 311 Hydraulic line 312 Flow check valve 313 Hydraulic line 320 Hydraulic line 321 Flow check valve 322 Hydraulic line 328 Seal 329 Redundant seal 330 channel 331 Hydraulic line 332 Throttle 334 Simulator valve 401 master brake cylinder 402 Piston travel simulator 403 primary piston as stepped piston 404 secondary piston 404a Stop right of the secondary piston 405 Annular chamber of the master brake cylinder 406 Primary Chamber 407 Hydraulic line 408 Working chamber of the piston travel simulator 409 Secondary chamber of the master brake cylinder 410 bore 411 pedal tappet 412 Seal 412a Redundant seal 413 Piston of the piston travel simulator 414 Spring of the piston travel simulator 415 channel 416 Hydraulic line 417 Check valve 418 Hydraulic line 419 Hydraulic line 421 Symbolic hydraulic line 422 channel 423 Channel 424 bore 425 channel 426 Hydraulic line 427 Check valve 428 Hydraulic line 429 Seal 429a Redundant seal 430 channel 431 Hydraulic line 432 Throttle 433 channel 434 Throttle 435 Protected space of the pedal tappet 436 Seal in the primary piston 436a Redundant seal in the primary piston 437 Channel 438 Throttle 439 Spring chamber of the piston travel simulator 440 Seal 440a Redundant seal 441 channel 442 Hydraulic line 443 Thrush 444 channel 446a Redundant seal 447 Channel 448 Thrush 449 Hydraulic line 500 Dual-circuit pressure supply (DV, DV1) 501 Hydraulic line 502 primary circuit 503 Hydraulic line 504 Secondary circuit 505 Hydraulic line 506 suction valve 507 Chamber in the storage container (VB1) 508 storage container with three chambers (VB) 509 Hydraulic line 510 suction valve 511 Chamber in the storage container (VB2) 512 Two three-phase motors 513 Redundant anchor angle sensor 514 Wheel brake front left 515 Wheel brake rear right 516 Wheel brake front right 517 Wheel brake rear left 518 valve 519 Valve 519a Redundant valve 520 valve 521 Valve 521a Redundant valve 522 exhaust valve 524 Hydraulic line 525 Hydraulic line 526 Hydraulic line 527 Third chamber in the storage tank (VB3) 528 Thrush 529 Thrush 530 Level sensor in the third chamber of the storage tank 531 Control Unit (ECU) 532 Redundant Electrical Storage (U1) 533 Redundant Electrical Storage (U2) 534 Redundant Electrical Storage (U3) 535 Perforated plate for the throttle 536 Hydraulic line 537 Hole in the perforated plate 537a Redundant hole in the perforated plate 538 Throttle filter screen 601 Isolating valve 602 Hydraulic line 603 Isolating valve 604 Hydraulic line 605 Redundant dual-circuit pressure supply (DV2) 606 Hydraulic line 607 Isolating valve 608 Hydraulic line 609 Hydraulic line 610 Isolating valve 611 Hydraulic line 612 Pressure relief valve 613 Pressure relief valve 700 power supply 701 Computers CP1, CP2, CP3 702 Control of motor, valves 703 power amplifiers 704 Electrical cable 705 sensor signals 706a First Input / Output (I / O) 706b Second input / output (I / O) 707 Brake-and-Go switch signal

Claims

[1] Piston-cylinder unit (2, 42, 72), - which has a piston (1, 41, 71) which defines at least one working chamber (3, 43, 86, 87), - wherein a first seal (9, 49, 79) for sealing at least one first working chamber (3, 43, 86, 87) is arranged sealingly either between the piston (1, 41, 71) and the cylinder (23, 42, 72) or between a tappet (88) connected to the piston (71) and the cylinder (23, 42, 72), - and that a second seal (9a, 49a, 80, 83) is arranged between the first seal (9, 49, 79) and the first working chamber (3, 43, 86, 87), - and the piston-cylinder unit (2, 42, 72) has a first channel (10, 46, 78, 81, 81a) which is arranged in the wall of the cylinder (23, 42, 72) and opens between the first seal (9) and the second seal (9a), in particular in the interior of the cylinder, and - that the first channel (10) and / or a hydraulic line (11, 51, 76) connected thereto has a throttle device (12) and / or a valve device, and is connected to a storage container (7) or opens into it, - and that at least one further channel (5, 46) is provided in the cylinder, which opens into the interior of the cylinder and leads to a substantially pressure-free space, in particular a storage container (7), and which can be closed by means of the piston (1, 41, 71), in particular by means of movement of the piston (1, 41, 71), or a valve device (75a, 75b), - wherein the first seal (9, 49, 79) is arranged on one side of the further channel (5, 46), - and that an electronic control unit (ECU) with a diagnostic or monitoring function is provided to diagnose or monitor a possible defect or failure of a seal, - and that in order to diagnose a defective seal, a leakage current flowing through the first channel (10) is diagnosed or monitored, characterized by that a leakage current occurring at a defective seal (9a, 49a, 83) is limited, in particular by means of a throttle (12, 52, 82, 85) or a valve (130) which is arranged in the channel (10) or a hydraulic line (129) connected thereto, wherein in the case of a valve (130) this is closed after the leakage current has been detected. [2] Piston-cylinder unit in the form of a travel simulator (116), - which has a piston (117) which defines at least one working chamber (139), - wherein a first seal (140) for sealing at least the first working chamber (139) is sealingly arranged between the piston (117) and the cylinder (23, 42, 72) of the travel simulator (116), - and that a second seal (140a) is arranged between the first seal (140) and the first working chamber (139), - and the travel simulator (116) has a first channel (141, 141a) which opens with one end between the first seal (140) and the second seal (140a), in particular in the interior of the cylinder, and with its other end (141a) - that the first channel (141, 141a, 442) is either a) is arranged in the cylinder of the travel simulator (116) and is in hydraulic connection with a reservoir (131) or b) is arranged in the piston (117) of the travel simulator (116) and opens with its other end into the space (143) of the spring assembly (118) of the travel simulator (116), - and that an electronic control and regulating device (ECU) with a diagnostic or monitoring function is provided in order to diagnose or monitor a possible defect or failure of a seal (140, 140a), characterized bythat a leakage current occurring at a defective seal (140, 140a) is limited, in particular by means of a throttle (142, 438) or a valve (130) which is arranged in the channel (10) or a hydraulic line (129) connected thereto, wherein in the case of a valve (130) this is closed after the leakage current has been detected. [3] Piston-cylinder unit (116) according to claim 2, characterized by that a throttle (142, 438) is arranged in the channel (141, 141a, 442). [4] Piston-cylinder unit according to one of claims 1 to 3, characterized by that a leakage current occurring at a defective seal (9a, 49a, 83) is guided via the first channel (10) or a line (11, 51, 76, 129) connected thereto to a substantially pressure-free space, in particular a storage container (7) or to the outside. [5] Piston-cylinder unit according to one of claims 1 to 3, characterized bythat at least one further channel (5, 46) is provided in the cylinder, which opens into the interior of the cylinder and leads to a substantially pressure-free space, in particular a storage container (7), and which can be closed by means of the piston (1, 41, 71), in particular by means of movement of the piston (1, 41, 71), or a valve device (75a, 75b). [6] Piston-cylinder unit according to one of the preceding claims, characterized by that in the case of a non-intact seal, in particular a redundant seal (107a, 127, 140a)), an outflow of the hydraulic medium via the seal (leakage flow) is compensated by means of additionally supplied hydraulic medium (compensation flow), in particular by means of a pressure supply device (DV) (146) or by means of actuation of an actuating device (depressing the brake pedal 101) in the case of a braking device. [7] Piston-cylinder unit according to one of the preceding claims, in particular for use in a pressure supply device, characterized by that the piston-cylinder unit has a double-acting piston (71), wherein a piston rod (88) of the double-acting piston (71) is hydraulically sealed off from the cylinder exterior by means of a seal (83), and that a further (redundant) seal (84) is provided for the piston rod (88), wherein a channel (78) is arranged between these seals, which channel leads to a reservoir (7) and in which a throttle (85) is arranged, wherein in particular the double-acting piston (71) has a further channel (81, 81a), one section (81) of which ends between two seals (79, 80) and the other section (87) of which leads outwards through the piston rod (88) into a piston rod chamber (89), wherein a throttle (82) is arranged in the further channel (81, 88). [8] Piston-cylinder unit according to one of the preceding claims, characterized by that the working chambers of the double-acting piston (71) each have an inlet channel (73a, 74b) and an outlet channel (73c, 73d)), to which hydraulic lines are connected, in which check valves or switched solenoid valves (75c, 75d, 75a, 75b) are arranged, and that the lines (74a, 74b) connected to the inlet channels are connected to a storage container (7). [9] Piston-cylinder unit according to one of the preceding claims, characterized bythat a first seal (107) is provided for a piston (primary piston 105) in order to hydraulically separate a working chamber (primary chamber) of the piston from a channel (128) of the piston-cylinder unit and that an additional (redundant) seal (107a) is arranged on the other side of the channel and that a solenoid valve (diagnostic valve) (130) is arranged in a line (129) leading from the channel to the reservoir (131), wherein in particular the solenoid valve (130) has a dual function in that it closes in the event of a leak in the first seal (107) detected by means of the monitoring function, as well as in the event of a diagnosis of the redundant seal (107a) and the seal of a travel simulator (110) carried out by means of the diagnostic function, wherein in particular a required test pressure is supplied by a pressure supply (DV) (146). [10] Piston-cylinder unit according to one of the preceding claims, characterized bythat a travel simulator (116) has a piston (117) provided with a seal (140), which separates a working chamber (139) from a spring chamber (118), with a through-channel (channel sections 141, 141a) to the spring chamber (118), in which in particular a throttle (142) is arranged and that an additional (redundant) seal (140a) is arranged on the other side of the channel section (141). [11] Piston-cylinder unit according to one of the preceding claims, characterized by that the piston-cylinder unit has a working chamber (12) with a channel (236) to which in particular an ESP device can be connected, furthermore a channel (302) which is connected to the reservoir via a hydraulic line (304), into which in particular a throttle (305) is connected, in order to suck brake fluid out of the reservoir or to supply it to it and that on the channel (236) next to the seal (301) an additional (redundant) seal (301a) is arranged. [12] Piston-cylinder unit according to one of the preceding claims, characterized by that plausibility checks are carried out using the electronic control unit (ECU) to diagnose or monitor seal failures that lead to leakage current. [13] Piston-cylinder unit according to claim 12, characterized by that when carrying out the plausibility considerations, the path of an actuating device, in particular a brake pedal (101) is correlated to the pressure in a working chamber (111) and / or the differential path of two pedal travel sensors (133, 133a), in particular a force-displacement sensor unit with a spring (104) and / or a pressure-volume measurement (pressure-volume characteristic curve) of the piston-cylinder unit is used as a basis. [14] Piston-cylinder unit according to one of the preceding claims, characterized bythat in the event of a defective seal, in particular the redundant seal, a discharge of the hydraulic medium via the seal or the compensating flow is used as an indicator of the leakage of the seal by determining a leakage flow by comparing the pressure-volume characteristic curve of the device with the volume of a pressure supply (146). [15] Piston-cylinder unit according to one of the preceding claims, characterized by that for the diagnosis or monitoring of seal failures leading to a leakage current, the pressure-volume characteristic is correlated with the volume displacement of a pressure supply (146) and the signal of a pressure sensor (252) in a pressure circuit (233). [16] Piston-cylinder unit according to one of the preceding claims, characterized bythat for the (additional) leak test of seals, in particular when the actuating device, in particular the brake pedal (1), is not actuated, a working chamber (111) of the piston-cylinder unit is pressurized by a pressure supply (146), wherein the working chamber (111) is hydraulically closed off from the pressure supply by means of valves except for an inflow channel, that the pressure in the working chamber (111) is increased by means of the pressure supply and it is determined whether the pressure supply has to supply hydraulic fluid in order to keep the pressure in the working chamber constant. [17] Piston-cylinder unit according to one of the preceding claims, characterized by that the storage chambers (507, 527) are provided with redundant level sensors (151), wherein level changes in the chambers detected in particular by means of the level sensors are used to diagnose leaks in seals. [18] Hydraulic devices, such as brake or clutch devices and the like, in particular for automated driving, and their components, - wherein the device comprises at least one piston-cylinder unit (112, 116) according to one of the preceding claims and pressure can be built up in at least one working chamber of the piston-cylinder unit or in devices connected thereto via hydraulic lines by means of movement of the piston (105, 117, 119), - furthermore, a pressure supply (500), in particular an electromechanical one, which in particular has a further piston-cylinder unit - and with an electronic control unit (ECU), characterized bythat safety-relevant assemblies and / or components (112, 116, 500, 521) of the hydraulic device are designed to be at least partially redundant in order to fulfil “fail operational” criteria, and that a malfunction or failure of one or more of these assemblies or components is diagnosed or monitored by means of a diagnostic or monitoring function of the control and regulating device (ECU), wherein in particular for the diagnosis or monitoring of the safety-relevant assemblies or components in order to detect a malfunction orof a failure, plausibility checks are carried out in the electronic control and regulation unit (ECU), in particular the paths of components of an actuating device (101, 104) and the pressure in a piston chamber (111) of the device being used as a basis, and that pressure medium is supplied to a brake circuit by means of the piston-cylinder unit via valves (switching or inlet valves) and the valves are closed after a corresponding plausibility check in the event of a failure (leakage) of the brake circuit and these valves are diagnosed at short intervals, in particular in a test cycle during a parking stop at zero speed. [19] Hydraulic device according to claim 18, characterized by that one computing unit (CP2) is designed for reduced functions and, if necessary, another computing unit (CP3) is designed for an emergency function of the system. [20] Hydraulic device according to claim 18 or 19, characterized bythat the system has a redundant power supply, in particular with at least two separate energy storage devices (U1, U2, U3). [21] Hydraulic device according to one of claims 18 to 20, characterized by that (only) selected actuators and / or valves are designed redundantly, in particular only one or two valves on a vehicle axle. [22] Hydraulic device according to claim 21, characterized by that only the control is redundant and acts on one valve. [23] Hydraulic device according to one of claims 18 to 22, characterized by that the control of components such as actuators and valves is designed separately in an ECU as a “slave” and the signal transmission to a “master” ECU takes place via redundant bus systems, in particular with different structures and different protocols (“full function”, “reduced function”, “emergency function”). [24] Hydraulic device according to one of claims 18 to 23, characterized by that in a diagnostic cycle when the vehicle is stationary, the existing or slightly increased brake pressure is used to diagnose the tightness of the inlet valves and / or valve FV assigned to the wheel brakes and then the switching (opening) of the valve FV with subsequent repeated tightness test. [25] Hydraulic device according to one of claims 18 to 24, characterized by that a travel simulator system is designed without a valve (110) and a return spring (99) (still to be taken into account in the drawing) of the piston-cylinder unit (master cylinder) takes over the first surface part of the travel simulator characteristic curve, in particular by axially displacing a sniffer hole provided on the piston-cylinder unit (master cylinder) by the corresponding amount (distance between sniffer hole and piston in the retracted position).

Images