FAIL-SAFE BRAKING SYSTEM

Description

Technisches Gebiet

[0001] The present invention relates to a hydraulic brake system with at least two brake circuits and at least one pressure supply unit. Hintergrund

[0002] The requirements, particularly safety requirements (e.g. dual-circuit braking system), have a major influence on the design of a braking system and increase with the level of automation (levels zero to five of the SAE J3016 standard) of the motor vehicle. For example, in autonomous driving for level one or higher (e.g. for adaptive cruise control), braking force must be guaranteed even without the driver depressing the brake pedal. This requires at least one pressure supply unit in a hydraulic braking system and a correspondingly designed electronic sensor and control unit. The acceptance of errors also depends on the level of automation. In level two, individual errors are permitted if braking of at least approximately 0.3 g is possible, whereas in level three, braking of at least approximately 0.5 g should be guaranteed in the event of individual errors.For levels three and higher, ABS / ESP functionality must also be guaranteed even in the event of a single fault. Double faults are generally accepted if the failure probability is low based on ppm and FIT data.

[0003] DE 4340467 A1 discloses a hydraulic vehicle brake system with a dual-circuit emergency brake pressure source that can be activated by a pedal and with wheel brakes that can be supplied from this via emergency brake main lines, as well as with an external power braking device that has an external power source and, between this and the at least one wheel brake, at least one valve arrangement by means of which brake pressures can be generated and also reduced using pressure medium from the external power source. At least one valve arrangement is installed between the emergency brake pressure source and the wheel brakes, which connects the emergency brake pressure source to the wheel brakes during emergency braking operation and separates the emergency brake pressure source from the wheel brakes during external power braking operation. This valve arrangement is designed such that it allows pressure medium to be released from the wheel brakes during external power braking operation to escape through the emergency brake main lines and a return line to a reservoir of the emergency brake pressure source.This valve arrangement can be controlled with a small control force and is therefore cost-effective. The vehicle brake system is suitable for motor vehicles.

[0004] DE 19914403 A1 discloses a braking system in which a hydraulic fluid can be controlled from a pressure accumulator via valve means into respective wheel brake cylinders, wherein the hydraulic fluid can be conveyed into the pressure accumulator by means of a pump, with a pressure sensor arranged on the output side of the pump for detecting pressure pulsations occurring in the hydraulic fluid during pump operation and means for evaluating the pressure pulsations to obtain a measuring signal for controlling and / or monitoring the pump.

[0005] DE 202015008975 U1 discloses a brake system for motor vehicles, with a master brake cylinder and a floating piston arranged therein, which seals off a first and a second pressure chamber, wherein the first pressure chamber is hydraulically connected to a first brake circuit and the second pressure chamber is hydraulically connected to a second brake circuit; with a pressure medium reservoir under atmospheric pressure; with wheel brakes; with an electrically controllable pressure supply device for pressure build-up and pressure reduction in the wheel brakes; with a valve block with a normally open inlet valve / switching valve for each wheel brake and with at least one outlet valve; wherein each wheel brake is hydraulically connectable to a pressure chamber of the master brake cylinder via the switching valve assigned to it and is also hydraulically connected or disconnected to the pressure supply unit directly or via isolating valves.is connectable, wherein each brake circuit is hydraulically connected to the pressure supply device or is hydraulically connectable to the pressure supply device by means of at least one controllable valve; wherein both pressure chambers are pressurized with a pressure corresponding to the pressure generated by the pressure supply device, at least in normal brake booster operation, both during pressure build-up and pressure reduction in at least one wheel brake, and that in braking situations in which the pressure change in at least one wheel brake must occur with high dynamics, in particular in ABS / ESP operation, the pressure change occurs simultaneously in at least one wheel brake by means of the volume control of the pressure supply device and in at least one other wheel brake, in particular at the same time, a pressure reduction occurs via at least one outlet valve.

[0006] US6517170B1 discloses a braking system in which a hydraulic fluid can be fed from a pressure accumulator via a valve into individual wheel brake cylinders, the hydraulic fluid being fed from a pump into the pressure accumulator, with a pressure sensor arranged on the outlet side of the pump for detecting pressure pulsations in the hydraulic fluid occurring during operation of the pump and with an arrangement for evaluating the pressure pulsations in order to obtain a measuring signal for controlling and / or monitoring the pump. Zusammenfassung der Erfindung

[0007] The present invention relates to a braking system with two brake circuits. Preferably, at least the requirements of level two according to the SAE J3016 standard are met. Furthermore, double faults that lead to total failure of the braking system can be avoided, and so-called dormant single faults can be detected in a timely manner through redundancies and diagnostics.

[0008] The present invention is defined by claim 1.

[0009] A braking system for a vehicle is disclosed, comprising the following components: at least two hydraulic brake circuits (BK1, BK2), each with at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4); at least one pressure supply device (DV) which is connected to a brake circuit (BK1, BK2) via a hydraulic line; one switching valve (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4), which switchably connects a respective hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2); at least one hydraulic connection, switchable via at least one outlet switching valve (ZAV), between at least one of the brake circuits (BK1, BK2) and a reservoir (VB); and a hydraulic brake pedal system, of which a hydraulic output is switchably coupled to at least one brake circuit (BK1, BK2) via a feed switching valve (FV);at least one hydraulic connection between the two brake circuits (BK1 and BK2) that can be switched via at least one bypass switching valve (BP1);

[0010] The pressure reduction in at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) can be achieved by opening the outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV4).

[0011] The at least one pressure supply device (DV) can comprise a rotary pump. Rotary pumps are generally more cost-effective than, for example, plunger pumps.

[0012] The rotary pump can be designed as a gear pump or as a multi-piston pump, in particular a three-piston pump.

[0013] The pressure supply device (DV) can be connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) closing towards the pressure supply device (DV) or via a solenoid valve.

[0014] The multi-piston pump can be directly connected to at least one of the brake circuits (BK1, BK2), where "directly connected" means that no valve or pressure-control device is present between the multi-piston pump and the at least one brake circuit (BK1, BK2). With a suitable design of the multi-piston pump, the operation of the pump itself can prevent backflow of brake fluid, thus eliminating the need for a valve to prevent backflow.

[0015] The pressure supply device (DV) can comprise a motor, wherein the motor is preferably a brushless DC motor, which in particular has a redundant winding and / or a connection with 2 x 3 phase control.

[0016] The switching valves (SV1, SV2, SV3, SV4) may be normally open switching valves, and the bypass switching valve (BP1) may be a normally open bypass switching valve, and the outlet switching valve (ZAV) may be a normally closed outlet switching valve, and the feed switching valve (FV) may be a normally open feed switching valve.

[0017] The switching valves (SV1, SV2, SV3, SV4) can be designed and connected in such a way that residual pressure in a wheel brake (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) when the power is off. This can prevent unwanted residual pressure in the brake system in the event of a fault.

[0018] The two hydraulic brake circuits (BK1, BK2) can have exactly one, two, or more pressure sensors (DG). A single pressure sensor is sufficient for pressure measurement in both brake circuits (BK1, BK2). To increase safety, one pressure sensor can be used in each brake circuit. Additional redundant sensors can also be used.

[0019] ABS and / or ESP control can be carried out via at least one switching valve (SV1, SV2, SV3, SV4) and the exhaust switching valve (ZAV).

[0020] A valve is not required between the exhaust switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK2). Preferably, two switching valves (SV3, SV4) are connected directly to the central exhaust switching valve (ZAV). This eliminates the need for one valve.

[0021] There does not need to be a valve between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV4).

[0022] It is possible that only the outlet switching valve (ZAV) connects the brake circuits (BK1, BK2) to the reservoir (VB).

[0023] It is possible that each wheel brake (RB1, RB2, RB3, RB4) has only the corresponding switching valve (SV1, SV2, SV3, SV4).

[0024] A second outlet switching valve (ZAV2) may be provided, which is directly connected to the outlet of the pressure supply device (DV) or to an associated check valve (RV3) and switchably connects to the reservoir (VB), in particular, with only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connecting the brake circuits (BK1, BK2) to the reservoir (VB). The second outlet switching valve (ZAV2) represents a further possibility for increasing safety.

[0025] The two hydraulic brake circuits (BK1, BK2) can be connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2), which are connected in series, whereby the outlet switching valve (ZAV) is connected to a line section between the two bypass switching valves (BP1, BP2).

[0026] In addition, a separating switching valve (TV) may be present, which is directly connected to the outlet of the pressure supply device (DV) or to an associated check valve (RV3) and is directly connected to at least one of the switching valves (SV1, SV2).

[0027] Aspect 18: A braking system according to any one of the preceding aspects, wherein the hydraulic brake pedal system comprises a single master cylinder (SMC) or a dual master cylinder (DMC). The system described here can meet at least the requirements of level two according to the SAE J3016 standard even with a single master cylinder, which can be designed to be fail-safe.

[0028] The braking system may also include a travel simulator (WS).

[0029] The travel simulator (WS) can be connected to the single master cylinder (SHZ) or the double master cylinder (DHZ) via an optional switchable travel simulator isolation valve (14).

[0030] The single master cylinder (SHZ) or the double master cylinder (DHZ) can be equipped with a force travel sensor (KWS). However, the single master cylinder (SHZ) or the double master cylinder (DHZ) do not have to be equipped with a force travel sensor (KWS).

[0031] The braking system can be designed as a brake-by-wire system.

[0032] The hydraulic brake pedal system may have a vent opening connected to the reservoir (VB) via a parallel circuit of a throttle (Dr1) and a check valve (RV1) closing off the reservoir (VB). The throttle (Dr1) and the check valve (RV1) serve as redundancy to the primary seal (D2).

[0033] The braking system may further comprise a control and regulation unit (ECU) which controls or regulates the braking system. Kurzbeschreibung der Figuren

[0034] Fig. 1a shows a first possible embodiment of the braking system according to the invention in a minimal valve arrangement in the HCU with a bypass valve (BP1) and a central outlet valve (ZAV). Fig. 1b shows a second possible embodiment of the brake system according to the invention in an extended valve arrangement in the HCU with two bypass valves (BP1 and BP2), two (central) outlet valves (ZAV1, ZAV2), and a separating valve (TV). Fig. 2 shows the structure of a diagnostic valve (VD ). Fig. 3a shows an embodiment according to the invention for the connection between the single master cylinder and the reservoir (VB) with two throttles (Dr1, Dr4) and a check valve (RV1) as well as a redundant secondary seal (D1r). Fig. 3b shows an embodiment according to the invention for the connection between the single master cylinder and the reservoir (VB) with diagnostic valve (VD) and a redundant primary seal (D2r). Fig. 3c shows an embodiment according to the invention for the connection between the individual master cylinder and the storage tank (VB) with a storage tank shut-off valve (17), a throttle (Dr4) and a redundant primary (D2r) and secondary seal (D1r). Fig. 3d shows an example pedal force-travel characteristic for a single master cylinder with an additional return spring (RF2) and a travel simulator (WS). Fig. 4a shows an embodiment according to the invention with a single master cylinder unit (SHZ) and a dual-circuit double-acting piston pump with four check valves (RV3, RV4, RV5, RV6). Fig. 4b shows an embodiment according to the invention with a single master cylinder unit (SHZ) and a dual-circuit double-acting piston pump with three check valves (RV4, RV5, RV6) and a solenoid valve (PD1). Fig. 4c shows an embodiment with a single master cylinder unit (SHZ) and a dual-circuit double-acting piston pump with four solenoid valves (PD1, PD2, PD3, PD4). Fig. 5a shows an embodiment according to the invention with a conventional tandem master cylinder unit (THZ) and a dual-circuit double-acting piston pump with four check valves (RV3, RV4, RV5, RV6). Fig. 5b shows an embodiment according to the invention with a tandem master cylinder unit (THZ) with tappet and a dual-circuit double-acting piston pump with four check valves (RV3, RV4, RV5, RV6). Ausführliche Beschreibung

[0035] Fig. 1a shows elements of a hydraulic braking system with a single master cylinder unit (SHZ) with brake pedal (1), single master cylinder and reservoir (VB), a pressure supply unit (DV), an electronic control unit (ECU), and one wheel brake (RB1, RB2, RB3, RB4) (not shown) for each wheel, each with a wheel cylinder (RZ1, RZ2, RZ3, RZ4). Pressure supply unit (DV) and pressure supply unit are used synonymously here. Two wheel cylinders (RZ1, RZ2) are each connected to a first brake circuit (BK1) via a switching valve (SV1, SV2), and a further two wheel cylinders (RZ3, RZ4) are each connected to a second brake circuit (BK2) via a switching valve (SV3, SV4). Instead of one switching valve per wheel cylinder, two or more switching valves per wheel cylinder can also be provided.The pressure supply unit (DV) comprises a pump and a brushless DC motor, which optionally has a redundant winding and / or is connected to the electronic control unit (ECU) via 2 x 3 phases. The pump can be a plunger pump (not shown) with a spindle drive or a rotary pump, whereby the rotary pump can in turn be designed as a multi-piston pump (e.g. a three-piston pump) or a gear pump. In the case of a gear pump that can rotate in both directions, the pressure supply unit (DV) can be connected to the first brake circuit (BK1) via a check valve (RV3) closing towards the pressure supply unit (DV). In the case of a multi-piston pump that can only deliver volume in one direction, the pressure supply unit (DV) can be connected directly (without RV3) to the first brake circuit (BK1). One or more check valves can be integrated into the multi-piston pump.In the case of a plunger pump, a solenoid valve (not shown) is required instead of the check valve RV3. In addition, the plunger or rotary pump can be connected to the reservoir (VB). The two brake circuits (BK1 and BK2) are connected via a switchable bypass valve (BP1). The second brake circuit (BK2) is connected to the reservoir (VB) via a switchable central outlet valve (ZAV) and to a hydraulic output of the pressure chamber of the individual master cylinder via a switchable feed-in switching valve (FV). As an alternative to the single master cylinder, a double master cylinder with appropriate connection can also be used, such as in . Fig. 5a or Fig. 5b can be used for additional increased safety. The pressure in one of the two brake circuits (e.g. BK2) can be measured via a pressure sensor (e.g. DG) on this brake circuit (e.g. BK2) and passed on to the ECU. Optionally, other pressures in the brake circuits (e.g. BK1) can also be measured via additional pressure sensors (e.g. DG2) and passed on to the ECU. The hydraulic arrangement with the wheel cylinders (RZ1, RZ2, RZ3, RZ4), the switching valves (SV1, SV2, SV3, SV4), the two brake circuits (BK1, BK2), the pressure sensors (DG1, DG2), the bypass valve (BP1), the central outlet valve (ZAV), the pressure supply unit (DV) and, if present, the check valve (RV3) can be combined in a so-called hydraulic control unit (HCU). In a preferred embodiment, the hydraulic control unit (HCU) has only one pressure supply (DV).

[0036] In the single master cylinder unit (SHZ), a travel simulator (WS) with or without a switchable travel simulator isolation valve (14) can be connected to another hydraulic output of the single master cylinder (or to the hydraulic line between the feed switching valve (FV) and the single master cylinder). The travel simulator can transmit a specific pedal travel force characteristic to the brake pedal (1) via a slave piston, which can be disengaged, for example, by foot actuation of the brake pedal (1) against an arrangement of return springs. The hydraulic connection of the travel simulator (WS) to the single master cylinder can, as in Fig. 1a shown, e.g., via a parallel connection with a throttle (Dr2) and a check valve (RV2) or in another way. The pedal movement can be reduced via throttle Dr2 when pressure builds up, and when the travel simulator (WS) is emptied, the throttle Dr2 can be bypassed via the check valve RV2.

[0037] In normal operation, especially when a power supply and a functioning pressure supply (DV) are available, braking is initiated by the driver pressing the brake pedal. The feed switching valve (FV) is closed when the brake pedal is depressed and remains closed as long as the brake pedal (1) remains engaged. This hydraulically decouples the pedal system from the hydraulic control unit (HCU). Instead, the coupling is implemented "brake-by-wire" via the redundant pedal travel sensors, the ECU, and the pressure supply unit (DV). When the switching valves (SV1, SV2, SV3, SV4), the bypass valve (BP1) and the central outlet valve (ZAV) are open, the pressure supply unit (DV) can pump brake fluid volume from the reservoir (VB) into the wheel cylinders (RZ1, RZ2, RZ3, RZ4) of both brake circuits (BK1, BK2), thereby building up brake pressure.Depending on the desired braking force and other boundary conditions, the bypass valve (BP1) can also be closed during regular braking if braking is only required with the wheel cylinders (RZ1, RZ2) in the first brake circuit (BK1). A target pressure can be adjusted depending on the pedal travel via at least one pressure sensor (DG) in one of the brake circuits (BK1, BK2) and / or pulse width modulation of the switching valves (SV1, SV2, SV3, SV4) and / or the bypass valve (BP1). The travel simulator (WS) and the return spring (RF) in the individual master cylinder provide the driver with a specific pedal travel force characteristic, which should preferably always be as constant as possible and independent of the brake pressures in the brake circuits (BK1, BK2).In particular, the combination of travel simulator (WS) and return spring (RF) in the brake-by-wire system counteracts brake pedal deflection and returns the pedal to a defined starting position after foot activation. Particularly in electric or hybrid vehicles, this allows the recovery of braking energy (recuperation) in the electric traction motors to be decoupled from the brake pedal (1). In particular, the pedal travel force characteristic is not affected even in abnormal situations, such as the failure of a brake circuit.

[0038] When the brake pedal force is released, the central outlet valve (ZAV) can be opened, especially when using a rotary pump. In addition, the switching valves (SV1, SV2, SV3, SV4) and / or the bypass valves (BP1, BP2) are opened completely or depending on the desired pressure reduction gradient via pulse width modulation (PWM) or short stops (e.g. after a time Δt or after a differential pressure Δp) or otherwise. This allows the brake fluid volume to be returned to the reservoir (VB) and brake pressure to be reduced. If the piston (3) of the individual master cylinder returns to its defined starting position after the brake pedal (1) has been depressed, the exchange of brake fluid between the pressure chamber of the individual master cylinder and the reservoir (VB) can take place, for example, through radial sniffer openings in the piston (3) and in the individual master cylinder, as well as via a hydraulic connection. This hydraulic connection can be implemented as in Fig. 1a by a parallel connection of a throttle (Dr1) and a check valve (RV1) or in another way. The sealing of the pressure chamber in the individual master cylinder can be realized via a primary seal (D2) and a secondary seal (D1) as well as other redundant seals not shown, whereby in particular the primary seal (D2) can be mounted in the individual master cylinder or on the piston (3) of the individual master cylinder.

[0039] Normally, individual brake pressures can be regulated for each wheel for driving dynamics interventions such as ABS or ESP. The control function for ABS, for example, is as follows: If the controller reports during pressure build-up P up that a brake cylinder (e.g. RZ1) of a wheel, for example, meets the criterion of too much brake pressure, the pressure build-up P up can be stopped in order to monitor the wheel or (if necessary after such an observation period) the brake pressure can be reduced by pressure reduction P down. Since the feed switching valve (FV) remains closed and the pump, depending on the design in the pressure supply unit (DV), cannot absorb any volume from the brake circuits, the opening of the central outlet valve (ZAV) represents the only possibility for pressure reduction P down in one possible embodiment. With the central outlet valve (ZAV) open, different pressure reduction gradients can then be achieved, preferably by PWM control of the associated switching valve (e.g.SV1). If the pressure reduction P ab is stopped by the controller, the central exhaust valve (ZAV) is closed again. Two, three, or four wheel cylinders can also be controlled simultaneously and individually for each wheel in the pressure reduction P ab. Likewise, the pressure build-up P auf can be controlled in one wheel cylinder, in two, three, or four wheel cylinders simultaneously and individually for each wheel, as required.

[0040] In the case of a driver assistance system intervention which is usual in partially automated driving (level 2), such as a distance control cruise control or traffic jam assistant, braking can also be carried out without the driver operating the pedal via the pressure supply unit (DV), whereby the brake pedal (1) is hydraulically decoupled from such an intervention by the feed switching valve (FV) which is then closed.

[0041] Similar to the so-called conventional three-box systems (braking system with ABS / ESP functionality, vacuum brake booster, and electric or mechanical vacuum pump) and the so-called conventional two-box systems (braking system with ABS / ESP functionality and electromotive brake booster unit), the inventive "brake-by-wire" braking system with travel simulator (WS), electromotive pressure supply unit (DV), and ABS / ESP functionality can be referred to as a so-called one-box system. Due to the high degree of integration of such a one-box system, the installation space, weight, and costs of the entire unit can be reduced, and installation and logistics can be optimized.

[0042] The valves FV, BP1, SV1, SV2, SV3, SV4 can be designed as normally open solenoid valves, while the valves ZAV and, if present, the travel simulator isolating valve (14) are preferably normally closed solenoid valves. In addition, the switching valves (SV1, SV2, SV3, SV4) are preferably connected to the respective wheel cylinders (RZ1, RZ2, RZ3, RZ4) via their output side, so that each switching valve (SV1, SV2, SV3, SV4) opens itself in the event of a fault, e.g. if its electrical connection fails, due to the pressure in the respective wheel cylinder (RZ1, RZ2, RZ3, RZ4). This valve configuration can be used to ensure, in particular, that in the event of a power failure, the brake pedal (1) can be hydraulically coupled to the wheel cylinders (RZ1, RZ2, RZ3, RZ4) via the open feed switching valve (FV) and brake pressure can be built up.If the normally closed travel simulator isolation valve (14) is present, the travel simulator (WS) can also be decoupled from the brake pedal (1), which can save, for example, approximately 40% of the pedal travel.

[0043] All solenoid valves, especially the ZAV, can be designed as redundant valves and / or with redundant coils and / or with redundant control, thereby reducing the probability of valve failure. For a single failure with a probability of, for example, 1e-6 per year, redundancy with the same failure probability can reduce the failure probability per year to 1e-6 x 1e-6 = 1e-12.

[0044] Even when there is a power supply and the pressure supply unit (DV) fails, the valves FV, BP1, SV1, SV2, SV3, SV4 can be opened and the valves ZAV and, if present, the travel simulator isolation valve (14) can be closed so that brake pressure can be built up via the brake pedal actuation. Alternatively, the bypass valve (BP1) can be closed and sufficient brake pressure can still be built up in the second brake circuit (BK2) by foot actuation of the brake pedal (1). The failure of the electrical control of the pressure supply unit (DV) can be considered very unlikely, especially in the preferred designs with a (simple) multi-piston or gear pump and redundant windings with 2 x 3 phase control. Since a power failure is also unlikely, the travel simulator isolation valve (14) can be dispensed with.

[0045] According to the invention, the braking system can have various sensors, in particular pressure sensors (DG, DG2), redundant pedal travel sensors (Sp1 and Sp2) for determining the pedal travel, a force travel sensor (KWS) in the piston of the individual master cylinder for determining a force-pedal travel characteristic, a fill level sensor element (6) for determining the fill level of the brake fluid in the reservoir (VB), a yaw angle sensor (GWS) for e.g. ESP interventions or other sensors (e.g. a temperature sensor) whose sensor values can be transmitted to the electronic control unit (ECU). Alternatively or in addition to the force travel sensor (KWS), a pressure sensor (not shown) can be integrated into the individual master cylinder, which can measure the pressure in the pressure chamber and transmit it to the ECU.In addition, all solenoid valves, in particular valves SV1, SV2, SV3, SV4, BP1, ZAV, FV, 14, can be switched by the electronic control unit (ECU), preferably via a redundant electronic control or via a redundant coil. In single-box devices with ABS / ESP, the electronic control unit (ECU) can be attached to the hydraulic control unit (HCU) and preferably connected to the vehicle's electrical system via a connector (13). Bus communication can be implemented, for example, via FlexRay or CAN or in another way.

[0046] The redundant pedal travel sensors (Sp1 and Sp2) can be implemented in different ways. Fig. 1a Two sensor rods are moved by an extension of the individual master cylinder piston (3), which act on the redundant pedal travel sensors (Sp1 and Sp2). To protect the rods from jamming, locking elements can be housed in an extension of the piston (3). The redundant pedal travel sensors (Sp1 and Sp2) can also be coupled with two pistons and a spring between the two pistons. This has the advantage of enabling force travel measurement with additional benefits in fault analysis, e.g., regarding a jammed piston (3). See also DE102010050132.

[0047] Further error cases, their consequences and detection through diagnostics are discussed below.

[0048] A loss of braking force caused by a leaky seal in one of the wheel cylinders (RZ1, RZ2, RZ3, RZ4) can be detected by comparing it with a predetermined pressure-volume characteristic for the pressure build-up P to , which can depend on various boundary conditions such as valve positions, temperature, venting of the brake system, air gap of the wheel brakes (RB1, RB2, RB3, RB4), etc., via the additional loss volume absorption or the additional volume delivery of the pressure supply unit (DV). The wheel cylinder in which the loss of braking force occurs can be localized using the following diagnosis: After the pressure build-up P to , all switching valves (SV1, SV2, SV3, SV4) are open and the pressure supply unit (DV) is no longer supplied with current if there is residual pressure in the brake circuits (BK1, BK2). After closing the bypass valve (BP1), the pressure measured by the pressure sensor (DG) in the second brake circuit (BK2) can be examined.If the pressure drops, wheel cylinders RZ3 and / or RZ4 must be leaking. By closing, for example, switching valve SV3, a leak in wheel cylinder RZ4 can be detected when the pressure drops, or a leak in wheel cylinder RZ3 when the pressure remains constant. If, on the other hand, the pressure remains constant after the bypass valve (BP1) is closed, wheel cylinders RZ3 and RZ4 can be detected as leaking. In this case, the bypass valve (BP1) is opened and the switching valves SV1, SV3 and SV4 are closed. If the pressure drops, the leak in wheel cylinder RZ2 can be detected, while at constant pressure the leak in wheel cylinder RZ1 can be detected. After locating the wheel cylinder (e.g. RZ1) with the loss of braking force, the corresponding switching valve (e.g. SV1) can be closed before each braking application until the unit is replaced in the service department, so that two or three wheel cylinders (e.g.RZ2, RZ3, RZ4) can be decelerated with reduced braking force, but still sufficient for level two of autonomous driving. If a small leak is detected in a wheel cylinder as described above, the leak can be compensated for by additional pressure via the pressure supply unit (DV) as an alternative to shutting down the wheel cylinder.

[0049] After closing all switching valves SV1, SV2, SV3, SV4, the tightness of the central outlet valve ZAV and the feed switching valve FV can be checked, preferably at standstill with or without volumetric delivery via the pressure supply unit (DV), with the valves ZAV and FV alternately closed or opened. If a possible leak can be localized, for example via a pressure oscillation from the pressure supply unit (DV) and through an interaction of the level sensor element (6) in the storage container (VB) and pedal movement in the ZAV or FV, the following measures can be distinguished: In the case of e.g.If the central outlet valve (ZAV) is blocked by a dirt particle and no longer seals, or if the central outlet valve (ZAV) can no longer be closed due to a failure of the electrical control, the bypass valve (BP1) can be closed, whereby sufficient brake pressure can then still be built up via the pressure supply unit (DV), at least in the first brake circuit. On the other hand, if the feed switching valve (FV) is blocked, e.g. by a dirt particle, and no longer seals, the bypass valve (BP1), the switching valves SV3 and SV4 in the second brake circuit (BK2) and the central outlet valve (ZAV) can be closed, whereby the detuning of the pedal characteristics in the individual master cylinder, which is in principle possible due to the leak in the feed switching valve (FV), can be prevented and sufficient brake pressure can still be built up via the pressure supply unit (DV) in the first brake circuit (BK1).If it is not possible to locate the leak in the ZAV or FV, the procedure can be the same as for a leak in the FV. Furthermore, if the leakage flow is small, it can be compensated for by the volumetric flow of the pressure supply unit (DV), as mentioned above.

[0050] If the central outlet valve (ZAV) fails in the sense that it can no longer be opened, brake pressure can be reduced by opening the feed-in switching valve (FV) via the single master cylinder and the reservoir (VB). In the case of an alternatively used double master cylinder, whose additional pressure chamber as in Fig. 5a and Fig. 5b is connected to the hydraulic control unit via another feed switching valve (FV2), both feed switching valves (FV, FV2) can be opened to reduce the pressure P ab.

[0051] If one (e.g. SV3) of the switching valves (SV3, SV4) in the second brake circuit fails in the sense that it can no longer be closed, e.g. due to a dirt particle, the bypass valve (BP1) can be closed and sufficient braking force, particularly for level two in autonomous driving, can still be built up via the pressure supply unit (DV) in the first brake circuit (BK1). If one of the two brake circuits (BK1, BK2) fails, the so-called diagonal distribution of braking force across the four wheels of the vehicle can be particularly advantageous. This can lead to greater braking compared to distributing the brake circuits (BK1, BK2) between the front and rear axles of the vehicle (e.g. approx. 50% with diagonal distribution compared to approx. 30% with front / rear axle distribution if the front drive circuit fails).Diagonal distribution of braking force means that one brake circuit is assigned to the front brake on one side of the vehicle and the rear brake on the other side. The second brake circuit is assigned to the wheel brakes on the other diagonals.

[0052] If one of the switching valves (SV1, SV2) in the first brake circuit fails (e.g., SV1) in such a way that it can no longer be closed, e.g., due to a dirt particle, the bypass valve (BP1) can be closed and the feed switching valve (FV) can be opened, allowing sufficient brake pressure to be built up in the second brake circuit (BK2) by foot actuation of the brake pedal (1). If present, the travel simulator isolation valve (14) can also be closed, which can, for example, save approximately 40% of pedal travel.

[0053] If the feed switching valve (FV) fails in the sense that it can no longer be closed, e.g. due to a dirt particle, the second brake circuit can be decoupled by closing the switching valves SV3 and SV4, the central outlet valve (ZAV), and the bypass valve (BP1). Since this prevents any imbalance in the pedal travel characteristics in the individual master cylinder, sufficient brake pressure can still be built up in the first brake circuit (BK1) via the pressure supply unit (DV). In the event of an emergency braking, the braking force in the wheel brakes (RB1, RB2, RB3, RB4) can be further increased by foot actuation of the brake pedal (1) after the switching valves (SV3, SV4) in the second brake circuit (BK2) have opened.If the leakage flow in the feed switching valve (FV) is small and one of the wheel brakes (RB1, RB2, RB3, RB4) locks during emergency braking, ABS control can take place via the central outlet valve (ZAV) and the pressure supply unit (DV).

[0054] If a pressure sensor (e.g. DG) in one of the brake circuits (BK1, BK2) fails, another pressure sensor (e.g. DG2) in one of the brake circuits (BK1, BK2), if available, can be used. If there is only one pressure sensor (DG) in the braking system, the pressure in the brake circuits (BK1, BK2) can also be regulated via the electrical current in the motor of the pressure supply unit (DV) according to predetermined current-pressure relationships (e.g. characteristic maps) stored in the ECU, whereby these current-pressure relationships can include dependencies on various boundary conditions, e.g. pressure build-up P up or pressure reduction P down, solenoid valve positions, temperature, etc.

[0055] If the primary seal (D2) in a pressure chamber of the master cylinder fails, i.e., if the primary seal (D2) is leaking, a leakage of the brake fluid in the master cylinder is possible, which can uncontrollably influence the pedal travel (in this case: increase it) and, via "brake-by-wire," can cause too much brake pressure and thus undesirably harsh braking. In the following, the master cylinder is assumed to be a single master cylinder, although the use of a tandem master cylinder is also possible. To avoid a possible total failure of the master cylinder, a connection of the single master cylinder to the reservoir (VB) can be used, as in Fig. 1a via a parallel circuit of a check valve (RV1) closing towards the reservoir and a throttle (Dr1). If the primary seal (D2) is leaking and the secondary seal (D1) is tight, the leakage flow is blocked by the check valve (RV1) and throttled by the throttle (Dr1) to such an extent that only an insignificant piston or pedal movement results, which only slightly disrupts the brake-by-wire braking system. The throttle (Dr1) can, for example, be designed so that the pedal movement caused by the leak is approximately 0.2 mm / s. With an average braking time of approximately 3 seconds to decelerate a vehicle from 100 km / h with 1 g, this can result in a detuning of the pedal travel of 0.6 mm, which is small and negligible compared to the total pedal travel.The check valve (RV1) allows for rapid filling of the brake system with brake fluid and rapid venting via open bleeder screws on the wheel cylinders (RZ1, RZ2, RZ3, RZ4). The throttle (Dr1) also allows for volume compensation in the event of temperature changes.

[0056] A critical double fault consisting of a leaking primary seal (D2) and the additional dormant single fault of a leaking secondary seal (D1), where the leakage can no longer be throttled by the throttle (Dr1), can be intercepted by additional (not shown) redundant primary and / or secondary seals. According to the invention, as shown in Fig. 1a the tightness of the secondary seal (D1) is regularly monitored by diagnostics (e.g. during every parking stop). In the case of no travel simulator (WS) or in the case of a travel simulator (WS) that is switchably connected via the travel simulator isolating valve (14), the leak can be clearly attributed to the secondary seal (D1). The procedure in one of these cases can be implemented as follows, for example: If, after the vehicle has been parked, the residual pressure in the brake system reaches the individual master cylinder via the open feed switching valve (FV) as a result of appropriate valve switching, the tightness of the entire brake system can be checked over a period of e.g. 10s based on the pressure change detected by the pressure sensor (DG). A detected drop in pressure can indicate a leak.If such a leak is detected, after closing the switching valves (SV1, SV2, SV3, SV4) and, if present, the travel simulator isolation valve (14), the individual master cylinder can be pressurised with a constant pressure of, for example, 20 bar for a specific time via the pressure supply unit (DV). The delivery rate can be determined, for example, via the change in angle in the motor of the pressure supply unit (DV) recorded by the rotor position sensor. If this is greater than the known delivery rate of the throttle (Dr1) at, for example, 20 bar, the secondary seal (D1) can be assessed as leaking. A double fault with a leaky primary (D2) and secondary seal (D1) can therefore only occur in the unlikely event that both seals (D1, D2) fail simultaneously while driving.In the case of a travel simulator (WS) without a travel simulator isolating valve (14), a detected leak may not be able to be clearly attributed to the secondary seal (D1) of the individual master cylinder using the diagnosis just described, as the leak may also be caused by a leaking travel simulator seal (D3) of the travel simulator (WS), which, due to the throttling caused by the leaking travel simulator seal (D3) and via a further throttle (Dr3) between the travel simulator seal (D3) and a further redundant seal (D3r) of the travel simulator (WS), can also lead to a leakage flow via a connection (not shown) into the reservoir (VB). In this case, different designs of the hydraulic resistances for the throttles Dr1 and Dr3 can result in different leakage flows through Dr1 or Dr3 to a certain extent in the event of a leak in D1 or D3.Dr3 can be adjusted, allowing the diagnosis described above to locate the leak at D1 or D3. On the other hand, even without locating the leak at D1 or D3, a dormant failure of D1 or D3 can be prevented by replacing both seals (D1, D3) simultaneously, thus ensuring the safety of the braking system. An additional failure of the redundant primary seal (D3r) can be classified as an unlikely double fault.

[0057] The reservoir (VB) can have two mutually redundant fluid chambers. The reservoir (VB) has a float (8) with a sensor target (7) in at least one fluid chamber. This float, together with a fill level sensor element (6) on the PCB (5) of the electronic control unit (ECU) connected to the reservoir (VB), can measure the fill level of the brake fluid in the reservoir (VB) almost continuously. This also allows small leaks to be detected redundantly in the brake circuit, e.g., leaks from D1 or from one of the wheel cylinders RZ1-RZ4. The integration of the fill level sensor element (6) into the electronic control unit (ECU) can reduce costs.

[0058] Fig. 1b shows a further embodiment of a braking system which, in comparison to Fig. 1a an additional bypass valve (BP2), a separating valve (TV), and another (central) outlet valve (ZAV2). This can increase the safety of the braking system, particularly with regard to double faults.

[0059] The additional bypass valve (BP2) can be inserted into the second brake circuit (BK2) in such a way that the second brake circuit (BK2) with the wheel cylinders RZ3 and RZ4 can be decoupled from the rest of the braking system in the event of a fault in the second brake circuit (BK2). As shown in Fig. 1b As shown, for example, the second bypass valve (BP2) can be inserted into the hydraulic line between the first bypass valve (BP1) and the pressure sensor (DG) in the second brake circuit (BK2), whereby the central outlet valve (ZAV) can then be connected to the second brake circuit (BK2) via the second bypass valve (BP2). The combination of both bypass valves (BP1, BP2) can be referred to as a safety gate (SIG), possibly also in a possible extension by the isolation valve (TV).

[0060] The isolation valve (TV) can be inserted into the first brake circuit (BK1) in such a way that the first brake circuit (BK1) with the wheel cylinders RZ1 and RZ2 can be decoupled from the rest of the brake system in the event of a fault (e.g. double fault RZ and SV) in the first brake circuit (BK1). As in Fig. 1b As shown, for example, the isolation valve (TV) can be inserted into the hydraulic line between the pressure supply unit (DV) or, if present, the check valve (RV3) or a solenoid valve on the pressure supply unit (DV) and the switching valves (SV1, SV2) of the first brake circuit (BK1). Furthermore, a redundant pressure sensor (DG2) (not shown) can be coupled to the first brake circuit (BK1).

[0061] The additional central outlet valve (ZAV2) can be inserted into the brake system in such a way that pressure in the brake system can be reduced redundantly to the central outlet valve (ZAV). As in Fig. 1b As shown, it can be connected, for example, to the hydraulic line between the isolation valve (TV) and the pressure supply unit (DV) or, if present, to the check valve (RV3) or a solenoid valve on the pressure supply unit (DV). For safety reasons, ZAV and ZAV2 should be connected to separate parts of the reservoir (VB). ZAV2 can, for example, be connected as shown in Fig. 1b shown can also be connected to the reservoir (VB) via a further opening in the main cylinder and an annular sniffer opening in the piston (3).

[0062] The second bypass valve (BP2) and the isolating valve (TV) can be designed as normally open solenoid valves, while the further central outlet valve (ZAV2) can be designed as normally closed solenoid valve. The second bypass valve (BP2) and the isolating valve (TV) can each be connected with their output side to the second brake circuit (BK2) or to the first brake circuit (BK1) in such a way that they can be opened by the residual pressure in the brake circuits (BK1, BK2) in the event of a valve control failure (e.g., in the absence of current). This allows, as with the brake system in Fig. 1a Even in the absence of power, braking can be carried out by operating the brake pedal (1) by foot.

[0063] If one (e.g. ZAV) of the two (central) outlet valves (ZAV, ZAV2) fails in the sense that it can no longer be opened, the pressure reduction P ab can take place via the other central outlet valve (ZAV2). Unlike in Fig. 1a The feed switching valve (FV) does not have to be opened, which means that the "brake-by-wire" functionality can be maintained and, in particular, a detuning of the pedal travel characteristics and thus an influence on the pedal movement can be avoided.

[0064] In an embodiment according to the invention, the further central outlet valve (ZAV2) also has the advantage that the pressure reduction P ab during a driving dynamics intervention (e.g. ABS) can be independently regulated in two wheel cylinders (RZ1, RZ2 or RZ3, RZ4) per brake circuit (BK1, BK2).

[0065] The second bypass valve (BP2) can increase safety if the feed switching valve (FV) can no longer be closed (e.g. due to a dirt particle or a fault in the electrical connection). In such a case, the individual master cylinder can be decoupled from the braking system by closing both bypass valves (BP1, BP2), and sufficient brake pressure can still be built up via the pressure supply unit (DV) in the first brake circuit (BK1). The pressure reduction P ab can, for example, take place via the additional (central) outlet valve ZAV2. In the event of an emergency braking, the braking force can also be further increased after the second bypass valve (BP2) has been opened by foot actuation of the brake pedal (1) in the second brake circuit (BK2). This can, for example, achieve a braking effect of approximately 75% of the full regular braking effect. In the event that the leakage is small due to the feed switching valve (FV) no longer closing, e.g.Pressure reduction P off (and pressure build-up P up ) for ABS intervention can still take place via the switching valves (SV3, SV4) and one of the central outlet valves (ZAV).

[0066] In addition to the primary seal (D2) and the secondary seal (D1), the single master cylinder may have further redundant primary and / or secondary seals, in particular one in Fig. 1b have the redundant primary seal (D2r) shown.

[0067] The sniffer opening in the single master cylinder between the primary seal (D2) and the secondary seal (D1) can be opened via a so-called diagnostic valve (VD ), which is located in Fig. 2 shown and described below, are connected to the reservoir (VB). In the event of a fault, in which the pressure reduction P ab in the brake circuits (BK1, BK2) cannot be achieved via the (central) outlet valves (ZAV and, if present, ZAV2), pressure can be reduced via the opened feed switching valve (FV) and the individual master cylinder in the reservoir (VB). While the pressure reduction P ab in Fig. 1a Due to the parallel connection of a throttle (Dr1) and a check valve (RV1) in the hydraulic connection of the individual master cylinder to the reservoir, only very low volume flows can be achieved, during pressure reduction P ab in Fig. 1b larger volume flows can flow back into the reservoir (VB), provided that these volume flows are smaller than a closing volume flow predetermined by the design of VD. By appropriate control, e.g. via pulse width modulation (PWM), of the solenoid valves involved (e.g. SV1, SV2, SV3, SV4, BP1, BP2, FV), the pressure reduction P ab can be carried out in such a way that the limit volume flow of the diagnostic valve (VD ) is not exceeded and the diagnostic valve (VD ) thus remains open during the pressure reduction. On the other hand, the Fig. 1a The diagnosis described above for monitoring the sealing of the master cylinder, i.e. the tightness of the secondary seal (D1), can be carried out in a similar way via the diagnostic valve (VD ), whereby volume flows above the closing volume flow of VD are deliberately fed into the master cylinder via the pressure supply unit (DV), since when the diagnostic valve (VD ) is closed, the tightness can be determined via a pressure curve recorded by the pressure sensor (DG). To increase safety in Fig. 1a With only one central outlet valve (ZAV), the hydraulic connection between the individual master cylinder and the reservoir (VB) can also be made by connecting it to the diagnostic valve (VD ) from Fig. 1b be replaced.

[0068] To protect the primary seal (D2) in the master cylinder, which, in contrast to Fig. 1a If the primary seal is not protected by a throttle-check valve combination (Dr1, RV1), a redundant primary seal (D2r) can be used. Diagnosis of the primary seal can be performed during braking using the force travel sensor (KWS) and the pedal travel sensors (Sp1, Sp2). Alternatively, diagnosis of the primary seal can be performed using the pressure sensor in the individual master cylinder and the pedal travel sensors (Sp1, Sp2).

[0069] Fig. 2 shows a possible embodiment for a back pressure valve, which can be used as a diagnostic valve (VD ) e.g. in Fig. 1b can be used. The back pressure valve can have two openings, wherein one of the two openings can have a valve seat and preferably a larger opening cross-section than the other opening. Furthermore, it can have a tappet with a sealing ball (18), wherein the tappet can be clamped in the valve housing by a spring (F) in the absence of fluid flow such that the sealing ball (18) cannot close the valve seat of the preferably larger opening. If, on the other hand, a fluid flows through the opening with a valve seat via the opening without a valve seat, the predetermined geometry of the openings, valve seat and sealing ball (18) can cause a back pressure above a so-called closing volume flow, which presses the sealing ball (18) into the valve seat and thus closes the valve in this direction.If the diagnostic valve (VD) closes at flow rates above the closing flow rate, it can reopen in the same flow direction when the flow rate falls below a further opening flow rate predetermined by the design of VD. In the other flow direction, brake fluid can be pumped through the valve without closing.

[0070] Fig. 3a -c show various embodiments according to the invention for a so-called fail-safe single master cylinder unit (SHZ) in a brake system according to the invention, wherein the safeguards described below can also be used in a tandem master cylinder unit (THZ). Fig. 3a -c The respective single master cylinder units (SHZ) described can be used in the systems according to Fig. 1a -b, Fig. 4a -c and Fig. 5a -b be used.

[0071] Fig. 3a shows an embodiment of a single master cylinder unit (SHZ), which in comparison to the one in Fig. 1a To ensure the external sealing of the master cylinder, it has another redundant secondary seal (D1r). The master cylinder also has another opening between the secondary seal (D1) and the redundant secondary seal (D1r), which is connected to the reservoir (VB) via a throttle (Dr4). This connection also allows the tightness of the secondary seal (D1) to be diagnosed.

[0072] Fig. 3b shows an embodiment of a single master cylinder unit (SHZ), which with regard to the connection of the master cylinder to the reservoir (VB) of the Fig. 1b corresponds.

[0073] Fig. 3c shows an embodiment of a single master cylinder unit (SHZ) having a redundant primary seal (D2r) and optionally a redundant secondary seal (D1r). In addition to the sniffer opening between the primary seal (D2) and the secondary seal (D1), the master cylinder may have a further opening between the primary seal (D2) and the redundant primary seal (D2r). Both openings may be connected via a hydraulic line, which in turn is connected to the reservoir (VB) via a switchable reservoir shut-off valve (17).

[0074] The reservoir shut-off valve (17) can be considered as a redundancy for the pressure chamber seal, since it can be closed in case of a leak in one of the primary seals (D2, D2r). The reservoir shut-off valve (17) in Fig. 3c can be designed as a normally open solenoid valve. This allows the brake system to be filled and vented even when de-energized.

[0075] Similar to the throttle-check valve combination made of Fig. 1a and Fig. 3a Furthermore, when the system is at a standstill and the reservoir shut-off valve (17) is closed, the seal of the main cylinder to the outside, i.e., the secondary seal (D1), can be diagnosed via the residual pressure or the pressure supply unit (DV). In the case of a further redundant secondary seal (D1r) and a further opening of the main cylinder between the secondary seal (D1) and the redundant secondary seal (D1r), which is connected to the reservoir (VB) via a throttle (Dr4), the leakage flow through Dr4 can be taken into account in the diagnosis.

[0076] Additional openings can be provided between additional redundant primary seals, which can also be connected to the storage tank (VB) via the storage tank shut-off valve (17).

[0077] Fail-safety in general means that a single failure of an element of the braking system is protected by redundancy and that the failure of the element of the braking system or the failure of the redundancy can be detected by diagnostics. A single failure (or single fault) is a failure (or fault) of only one element of the braking system. Double failures (or double faults) or multiple failures (or multiple failures), on the other hand, refer to failures (or faults) of two or more elements of the braking system. In general, double or multiple faults can be accepted if their occurrence is very unlikely. However, double faults, which could lead to total failure of the braking system, should be avoided in a fail-safe system.Double faults in a fail-safe system can be avoided if so-called dormant single faults, which lead to double faults with another single fault, are protected or detected by redundancy with additional diagnostics.

[0078] A single master cylinder is fail-safe if the pressure chamber seal of the master cylinder is fail-safe. In the normal case, i.e. in the absence of faults, the pressure chamber seal of a single master cylinder is provided, for example, by the primary seal (D2) of the single master cylinder. A single failure of the seal of the single master cylinder pressure chamber, e.g. caused by a leaking primary seal (D2), can lead to total failure of the braking system. The desired fail-safety therefore requires at least redundancy for the pressure chamber seal and at least one diagnosis of the pressure chamber seal or the redundancy of the pressure chamber seal. A fail-safe master cylinder can be used in levels three to four according to the SAE J3016 standard.

[0079] The required minimum redundancy for the pressure chamber seal can be, for example, as in Fig. 1a and Fig. 3a by the already described throttling by the combination of a throttle (Dr1) and a check valve (RV1) in the connection of the master cylinder to the reservoir (VB), in this case with negligible pedal travel change, or as in Fig. 1b , Fig. 3b and Fig. 3c by a second redundant primary seal (D2r), or as in Fig. 3c by closing a switchable reservoir shut-off valve (17) via which the sniffer opening of the individual master cylinder is connected to the reservoir (VB), be implemented. While (apart from the continued requirement of at least one diagnostic function) redundancy is sufficient for the fail-safe operation of the master cylinder, redundancies can be combined in a meaningful way to increase safety. For example, independent of redundancy (combination Dr1 / RV1 or reservoir shut-off valve 17), additional redundant primary seals (e.g., D2r) can be used in the connection of the master cylinder to the reservoir (VB). In principle, a combination of the combination Dr1 / RV1 and reservoir shut-off valve 17 is also conceivable.

[0080] The at least one diagnosis of the pressure chamber seal or the redundancy of the pressure chamber seal can be realized as a diagnosis of the pressure chamber seal, e.g. as in Fig. 1b , Fig. 3b and Fig. 3c ,wherein the tightness of the primary seal (D2) is monitored during braking operation via a force travel sensor (KWS) in the piston of the master cylinder or via a pressure sensor in the pressure chamber of the master cylinder, which measures the pedal force (F p ) or the pressure in the pressure chamber, by analyzing the pedal force (F p ) or the pressure as a function of the movement of the piston (3), which is detected via the pedal travel sensors (Sp1, Sp2), during foot actuation; or be implemented as a diagnosis of the redundancy of the pressure chamber seal, e.g. as in Fig. 1a and Fig. 3a ,wherein the throttle-check valve combination (Dr3, RV1) can be diagnosed as described above via the residual pressure in the brake system or via the pressure supply unit (DV) when the vehicle is stationary, preferably when parked, by comparing the return flow to the reservoir (VB), which can be determined e.g. via the delivery volume of the pressure supply unit (DV) and / or via the change in the fill level in the reservoir (VB), with the expected blocking by the check valve (RV1) and the throttling by the throttle (Dr1); or as in Fig. 3c , whereby the tightness of the switchable reservoir shut-off valve (17), if necessary including the fill level sensor in the reservoir (VB), can be checked via the pressure supply unit (DV) and corresponding valve positions (e.g. closed SV1, SV2, SV3, SV4, ZAV, 14 and open BP1, FV).

[0081] Compared to diagnostics performed while the vehicle is stationary, preferably while parked, reliability can be increased by performing diagnostics during braking, and thus, especially multiple times while driving. Additional redundant primary seals (e.g., D2r) in the master cylinder can also be diagnosed via the force travel sensor (KWS) or the pressure sensor in the pressure chamber of the master cylinder.

[0082] If the braking system is coupled with a travel simulator (WS), as is common with brake-by-wire systems, the travel simulator (WS) should also be designed to be fail-safe. A travel simulator (WS) is fail-safe if the pressure chamber seal of the travel simulator (WS) is fail-safe. In the normal case, i.e., in the absence of faults, the pressure chamber seal of the travel simulator (WS) is provided, for example, by the travel simulator seal (D3) of the travel simulator (WS). A single failure of the seal of the travel simulator pressure chamber, e.g., caused by a leaking travel simulator seal (D3), can also lead to a total failure of the braking system. The desired fail-safety therefore requires at least redundancy for the pressure chamber seal and at least one diagnosis of the pressure chamber seal or the redundancy of the pressure chamber seal.

[0083] The required minimum redundancy for the pressure chamber seal can be, for example, by a second redundant travel simulator seal (D3r); or as in Fig. 1a , Fig. 1b , Fig. 3a, Fig. 3b and Fig. 3c by a second redundant travel simulator seal (D3r) and the already described throttling of the leakage by the throttle (Dr3) between the travel simulator seal (D3) and the redundant travel simulator seal (D3r), in this case with slow pedal travel change; be realized.

[0084] At least one diagnosis of the pressure chamber seal of the travel simulator or the redundancy of the pressure chamber seal can be realized as a diagnosis of the pressure chamber seal, e.g. as in Fig. 1b , Fig. 3b and Fig. 3c ,wherein the tightness of the travel simulator seal (D3) (and the primary seal (D2)) is monitored during braking operation via a force travel sensor (KWS) in the piston of the master cylinder or via a pressure sensor in the pressure chamber of the master cylinder, which measures the pedal force (F p ) or the pressure, by analyzing the pedal force (F p ) or the pressure as a function of the movement of the piston (3), which is detected via the pedal travel sensors (Sp1, Sp2), when the foot is actuated; or as in Fig. 1a , Fig. 1b , Fig. 3a, Fig. 3b and Fig. 3c ,wherein the tightness of the travel simulator seal (D3) is monitored at corresponding valve positions via the residual pressure in the brake system or via the pressure supply unit (DV) when the vehicle is stationary, preferably when parked, by comparing the return flow to the reservoir (VB), which can be determined, for example, via the delivery volume of the pressure supply unit (DV) and / or via the change in the fill level in the reservoir (VB), with the expected blocking by the check valve (RV1) and the throttling by the throttles (Dr1, Dr2), if necessary including the fill level sensor in the reservoir (VB); or as in Fig. 3c , whereby the tightness of the travel simulator seal (D3), if necessary including the level sensor in the storage tank (VB), can be checked via the pressure supply unit (DV) and corresponding valve positions (e.g. closed SV1, SV2, SV3, SV4, ZAV, 17 and open BP1, FV, 14).

[0085] To increase safety, diagnoses can be combined in a meaningful way.

[0086] Due to the hydraulic coupling of the pressure chambers of the master cylinder and travel simulator (WS), a diagnosed leak in the coupled pressure chamber cannot generally be localized, as this can be caused, for example, by both a leaking primary seal (D2) of the master cylinder and a leaking travel simulator seal (D3). This is sufficient for fail-safe purposes in that a diagnosed leak in the coupled pressure chamber implies the tightness of both seals (D2, D3). If a travel simulator isolation valve (14) is present, any leak can be localized in the travel simulator (WS) or master cylinder.

[0087] The safety requirements for sealing the individual master cylinder to the outside, which is normally achieved by a secondary seal (D1), for example, can be less stringent than for sealing the master cylinder pressure chamber. This is because, firstly, the secondary seal (D1) is not subjected to high pressures and, secondly, the consequences of failure are less critical. In contrast to the more stringent requirement for fail-safe operation, safety is guaranteed if at least one element redundancy and / or element failure can be diagnosed.

[0088] A single failure of the sealing of the single master cylinder to the outside, e.g. a leaking secondary seal (D1), which can lead to a loss of brake fluid, can be caused, for example, by a redundancy as in Fig. 3a and Fig. 3c by a second redundant secondary seal (D1r) or as in Fig. 3a and Fig. 3c by throttling through a further throttle (Dr4), via which a further opening in the single master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r) is connected to the reservoir (VB), in this case with slowed leakage, which in turn can be monitored when the vehicle is stationary, e.g. via a change in the brake fluid level in the reservoir (VB), be secured.

[0089] In addition, in non-braking operation, where non-braking operation refers to operation in which no braking process takes place, and in particular when the vehicle is stationary (e.g. when parked), the tightness of the secondary seal (D1) can be determined or diagnosed by as in Fig. 1a and Fig. 3a and as already described above, in the first step via the residual pressure in the brake circuits (BK1, BK2) and in the second step via the pressure supply unit (DV) volume is delivered via the master cylinder into the reservoir (VB) and at a regulated pressure the delivery volume of the pressure supply unit (DV) is compared with the regular and expected throttle flow, or as in Fig. 1b and Fig. 3b and as already described above, volumes with fluid flows above the closing volume flow of the diagnostic valve (VD ) are conveyed via the pressure supply unit (DV) into the reservoir (VB) via the master cylinder and the pressure curve recorded by the pressure sensor (DG) is analyzed, or as in Fig. 3c via the pressure supply unit (DV) volume is conveyed with fluid flows via the main cylinder into the storage tank (VB), wherein the storage tank shut-off valve (17) is closed and, at a regulated pressure, the delivery volume of the pressure supply unit (DV) is compared with the regular and expected throttle flow through the throttle (Dr4).

[0090] To increase safety, redundancies and diagnostics can be combined in various, useful ways. The level sensor (6) in the reservoir (VB) can also be used for leak detection in the diagnostics, or in addition to it.

[0091] The safety requirements for sealing the feed-in switching valve (FV) in the closed state, i.e., the sealing of the feed-in switching valve (FV), which in the normal case is achieved, for example, by a seal in the valve seat, can also be less stringent than for sealing the master cylinder pressure chamber, since the consequences of failure are less critical. In contrast to the more stringent requirement for fail-safe operation, safety is guaranteed if at least one element redundancy and / or one element failure can be diagnosed.

[0092] A single failure of the seal of the feed-in switching valve (FV), which, for example, caused by a dirt particle, impairs the "brake-by-wire" functionality and can detune the force-displacement characteristic of the brake pedal system, can be caused, for example, by a redundancy by another solenoid valve connected in series (not shown in the figures), or as in Fig. 1a , Fig. 1b , Fig. 3a, Fig. 3b , Fig. 3c and already described by deactivating the second brake circuit (BK2) by closing the solenoid valves ZAV, SV3, SV4, BP1 or if applicable ZAV, BP1, BP2, whereby sufficient braking force (e.g. depending on the wheel distribution still 50% braking effect) is still available via the first brake circuit (BK1).

[0093] In addition, as in Fig. 1a , Fig. 1b , Fig. 3a, Fig. 3b , Fig. 3c Preferably, during non-braking operation, the tightness of the closed feed-in switching valve (FV) is determined via the pressure supply unit (DV) and pedal travel changes. To increase safety, redundancies and diagnostics can be combined in various, useful ways.

[0094] While in the event that the (central) outlet valves (ZAV, ZAV2) in the hydraulic control unit (HCU) can no longer be opened, the pressure reduction P ab via the master cylinder in Fig. 1a and Fig. 3a can only take place throttled (via Dr1), the pressure reduction P ab in Fig. 1b , Fig. 3b and Fig. 3c can also be done with little throttle via the master cylinder.

[0095] The hydraulic connection between at least one hydraulic output of the master cylinder and the feed switching valve (FV) can be as shown in Fig. 3b and Fig. 3c by means of a back pressure valve (19) which is constructed and connected in such a way that it becomes a throttle in the case of excessively high pedal forces (greater than approximately 500N) in the fluid direction from the master cylinder to the hydraulic control unit, for example by means of a perforated valve plate (20) within the back pressure valve (19) blocking the main outlet by means of the back pressure effect but maintaining the second throttle outlet via the arrangement of the throttle point in the valve plate (20).

[0096] Fig. 3d shows an exemplary pedal force-travel characteristic (21) of the brake pedal (1) of the single master cylinder unit (SHZ) in Fig. 3c , where the pedal travel (Sp) is specified relative to the total pedal travel. The return force of the brake pedal (1) is provided by a return spring (RF1) in the master cylinder (range up to 10% in Fig. 3d ) and a controllable elasticity in the path simulator (WS) (range from 40% in Fig. 3d )generated. In order to prevent failure of the brake pedal (1) in the event of faulty sealing of the pressure chambers of the master cylinder or the travel simulator (WS), an additional return spring (RF2) can be integrated into the master cylinder, which increases the gradient of the pedal force-travel characteristic of the brake pedal (1), e.g., from approximately 10% of the pedal travel.

[0097] A preferred embodiment of the braking system according to the invention can be Fig. 3b be derived, whereby the diagnostic valve VD in the connection of the master cylinder to the reservoir (VB) is dispensed with, i.e. the master cylinder is connected directly to the reservoir (VB) via the sniffer opening between the primary (D2) and secondary seal (D1). The single master cylinder in this embodiment is fail-safe thanks to the redundant primary seal (D2r), the redundant travel simulator seal (D3r) and the force travel sensor (KWS) according to the above definition. A leak in the secondary seal (D1) can be diagnosed when the vehicle is stationary via the fill level sensor element (6) in the reservoir (VB) or on the PCB. In addition, during service (e.g. every two to three years) the secondary seal (D1) can be tested for leaks by applying compressed air of e.g. 5 bar to the reservoir (VB) with the valves FV, ZAV and, if present, ZAV2, AV1-4 and travel simulator isolating valve closed.

[0098] Fig. 4a shows a further embodiment of a braking system according to the invention, wherein in comparison to Fig. 1a and Fig. 1b The pressure supply device (DV) comprises a dual-circuit, double-stroke piston pump instead of a rotary pump, which can comprise a piston, two pressure chambers, one in front of and one behind the piston, and a central rod, wherein the piston can be moved in both directions via the central rod and a gear with an electric motor drive. For example, the gear can be implemented as a ball screw drive and the electric motor drive as a brushless DC motor or in another way. Fig. 4a -c and Fig. 5a -b The respective designs of the pressure supply device (DV) described can be used in or with the systems according to the invention according to Fig. 1a -b and Fig. 3a -c be used.

[0099] The connection of the wheel cylinders (e.g. RZ1, RZ2) to a brake circuit (e.g. BK1) can be made, as is known in the prior art, via a switchable inlet valve (e.g. EV1, EV2) each, whereby the wheel cylinders (e.g. RZ1, RZ2) can then be connected to the reservoir (VB) via a switchable outlet valve (e.g. AV1, AV2). The inlet valves or outlet valves can also be seen as switching valves. Alternatively, the connection of the wheel cylinders (e.g. RZ3, RZ4) to a brake circuit (e.g. BK2) can be made as in Fig. 1a and Fig. 1b via only one switching valve each (e.g., SV3, SV4), whereby in this case, at least one brake circuit can be switchably connected to the reservoir (VB) via a central outlet valve (ZAV) and possibly additional valves. Such a connection allows the number of solenoid valves to be reduced, thereby saving costs.

[0100] One of the two pressure chambers of the double-acting piston pump can be connected to the first brake circuit (BK1) via a hydraulic output of the pump and a check valve (RV3) closing towards the pressure supply unit (DV), and possibly additional valves. Furthermore, this pressure chamber can be connected to the reservoir (VB) via a suction inlet (sniffer opening or opening) of the pump and another check valve (RV6) closing towards the reservoir (VB), as well as possibly additional valves. The other pressure chamber can also be connected to the second brake circuit via another hydraulic output of the pump and a check valve (RV4) closing towards the pressure supply unit (DV), as well as possibly additional valves. Furthermore, this pressure chamber can also be connected to the reservoir (VB) via another suction inlet (sniffer opening or opening).opening) of the pump and a further check valve (RV5) closing towards the reservoir (VB) as well as possible further valves are connected to the reservoir (VB). The pump with the two suction inlets and the two hydraulic outlets as well as the piston can be designed in such a way that in both directions of movement of the piston, i.e. both on the forward and return stroke, brake fluid can be pumped from the reservoir (VB) into at least one of the two brake circuits (BK1, BK2) and brake pressure can be built up, whereby by definition the forward stroke designates the direction of movement of the piston in which brake fluid is pumped from the pressure chamber facing away from the central rod of the piston (in . Fig. 4a via RV3). On the other hand, the return stroke refers to the direction of movement of the piston, in which brake fluid is drawn from the other pressure chamber (in Fig. 4a via RV4), whereby the effective area of the piston can be smaller compared to the effective area of the piston during the pre-stroke.

[0101] Depending on the design, the two brake circuits (BK1, BK2) can be connected as shown in Fig. 1a through a bypass valve (BP1) or as in Fig. 1b They can be connected in series by two bypass valves (BP1, BP2) and other valves. This allows brake pressure to be built up either in the first brake circuit (BK1) or in both brake circuits (BK1, BK2) during a forward stroke of the piston in the pressure supply unit (DV). Similarly, brake pressure can be built up either in the second brake circuit (BK2) or in both brake circuits (BK1, BK2) during a return stroke of the piston in the pressure supply unit (DV).

[0102] In comparison to a single-stroke piston pump, which is also common in brake systems but not shown, which can only deliver volume into the brake system in one stroke direction (pre-stroke), the brake system according to the invention can be equipped with a double-stroke piston pump and an exemplary connection as in Fig. 4a This can prove advantageous in that the time required for a single-stroke piston pump can be saved when the piston has to be fully or partially retracted with the hydraulic outlet of the pressure chamber closed before the additionally required brake fluid volume can be supplied. During such an idle return stroke, the brake system cannot be pressurized by the pressure supply unit (DV). In the brake system according to the invention, however, the double-stroke piston pump can be used in Fig. 4a By alternating forward and reverse strokes, continuous brake pressure can be provided in the brake circuits (BK1, BK2). This allows, in particular, the overall length of the double-acting piston pump to be reduced.

[0103] The brake system according to the invention with a double-stroke piston pump and an exemplary connection as in Fig. 4acan, on the other hand, prove advantageous in that the different sized piston effective surfaces during the forward and return stroke of the piston can be used in the design of the gearbox and the electric motor drive for what is known as downsizing. With regard to the two pressure ranges typically found in braking systems - on the one hand a normal pressure range of pressures up to the so-called blocking pressure with a high coefficient of friction in the wheel / ground system of, for example, approx. 100-120 bar, and on the other hand a higher pressure range of pressures up to, for example, approx. 200 bar - the piston effective surfaces of the piston, the gearbox and the electric motor of the double-acting piston pump can preferably be designed in such a way that pressures in the normal pressure range can still be adequately supported during the forward stroke, while pressures in the higher pressure range can only be supported by the smaller rear side of the piston.Pre-strokes with the larger piston backside can prove particularly advantageous when, when filling the wheel cylinders, the brake clearance must be overcome as quickly as possible, during which the brake pressure increases relatively slowly. Return strokes with the smaller piston backside can prove particularly advantageous when the pressure increases significantly after overcoming the brake clearance, and less brake fluid volume needs to be pumped when the pressure increases sharply.

[0104] In a design with downsizing, an idle pre-stroke may be necessary when building up the pressure P to after a return stroke in the higher pressure range. This means that, for example, with closed switching valves (e.g. SV3, SV4) and inlet valves (e.g. EV1, EV2), a closed feed switching valve (FV), if present, a preferably closed second bypass valve (BP2), an open first bypass valve (BP1) and an open central outlet valve (ZAV), brake fluid can be pumped from the pressure chamber with the larger piston effective area into the reservoir (VB). Such an idle pre-stroke can last up to approx. 100ms, but only needs to be used very rarely. The pressure build-up P to in the higher pressure range can then be continued via another return stroke.

[0105] As in the case of rotary pumps in Fig. 1a and Fig. 1b the pressure reduction P ab in the brake circuits (BK1, BK2) can normally take place via a central outlet valve (ZAV) or additional (central) outlet valves (ZAV2) or, in the event of a fault, via the feed switching valve (FV) and the individual master cylinder. In contrast to a pressure reduction P ab, such as an ABS intervention via outlet valves (e.g. AV1, AV2) for each brake cylinder (e.g. RZ1, RZ2), a pressure reduction P ab via the switching valves (e.g. SV3, SV4) and a central outlet valve (ZAV), whereby the switching valves and / or the bypass valves (BP1, BP2) can be controlled via pulse width modulation (PWM), is considered advantageous with regard to the accuracy of the pressure differences between the individual wheel cylinders (RZ1, RZ2, RZ3, RZ4) and / or brake circuits (BK1, BK2). This also allows noise levels to be reduced to a certain minimum.The piston of the double-acting piston pump can be brought back to its starting position via a return stroke via its electric motor drive when the pressure P ab is completely reduced, whereby brake fluid volume from the pressure chamber with the smaller piston effective area is also pumped into the reservoir (VB) via at least one of the bypass valves (BP1, BP2) and the central outlet valve (ZAV).

[0106] Due to the check valves (RV5, RV6) closing towards the reservoir (VB) in the connection of the double-acting piston pump to the reservoir (VB), in particular the (partial) emptying and venting of both pressure chambers of the double-acting piston pump in this embodiment can only take place via the hydraulic outputs of the pump, the respective check valves (RV3, RV4) and the respective brake circuits (BK1, BK2).

[0107] Fig. 4b shows a further embodiment in which, compared to Fig. 4a Preferably, the check valve (RV3) at the pump outlet of the pressure chamber with the larger effective area is replaced by a switchable solenoid valve (PD1). As in Fig. 4a The brake circuits (BK1, BK2) can be connected via a bypass valve (BP1) or by connecting two bypass valves (BP1, BP2) in series. In addition, an additional switchable isolation valve (TV) can be used in the first brake circuit (BK1).

[0108] During a forward stroke of the piston, the switchable solenoid valve PD1 can be opened and pressure can be applied as in Fig. 4a in the brake circuits (BK1, BK2). On the other hand, the switchable solenoid valve PD1 can be closed during a return stroke of the piston, so that when pressure builds up P to , no brake fluid volume needs to be pumped back from the brake circuits (BK1, BK2) into the pressure chamber with the larger piston effective area.

[0109] In contrast to the embodiment in Fig. 4a can be used in the embodiment in Fig. 4b After a preliminary stroke, the switchable solenoid valve PD1 is opened to reduce the pressure P ab, whereby, for example, brake fluid volume can flow back from the brake circuits (BK1, BK2) into the pressure chamber of the double-acting piston pump with the larger effective piston area via open switching valves (SV1, SV2, SV3, SV4), open bypass valves (BP1, BP2) and, if present, an open isolating valve (TV) in the first brake circuit (BK1) as well as with the central outlet valve (ZAV) and the feed switching valve (FV) closed. Since brake fluid is simultaneously pumped from the pressure chamber with the smaller effective piston area into the second brake circuit, such a pressure reduction P ab can be incomplete.

[0110] In the hydraulic connection of the double-acting piston pump in Fig. 4a Additional check valves (RV3, RV4, RV5, RV6) at the pump inlets and outlets can be replaced by switchable solenoid valves (PD1, PD2, PD3, PD4). For example, Fig. 4c another embodiment in which all check valves (RV3, RV4, RV5, RV6) are replaced by solenoid valves. As in Fig. 4a The brake circuits can be connected by a bypass valve (BP1) or by a series connection of two bypass valves (BP1, BP2). In the embodiment in Fig. 4c The single master cylinder, which can also have a force travel sensor (KWS) in the piston for pedal force measurement, can also be connected directly to the first brake circuit (BK1) via the feed switching valve (FV). In the embodiment according to Fig. 4a a redundant central outlet valve (ZAV2) can be used, which is connected, for example, to the first brake circuit (BK1).

[0111] Different operating states of the double-acting piston pump can be set using various combinations of open and closed solenoid valves (PD1, PD2, PD3, PD4). As shown in Fig. 4b When pressure P decreases, brake fluid can be returned from the brake circuits (BK1, BK2), e.g., via PD1, to the double-acting piston pump. Furthermore, by opening a pump inlet (e.g., PD3) and closing the corresponding pump outlet (e.g., PD1), brake fluid can be pumped from the respective pressure chamber into the reservoir (VB).

[0112] Fig. 5a shows a further embodiment, which in comparison to the Fig. 4a instead of a single master cylinder (SHZ), a tandem cylinder (THZ). The piston (3) of the brake pedal device can be coupled via a first pressure chamber and a first return spring (RF) to a second, so-called floating piston (SK), which in turn can be moved in a further pressure chamber against a second return spring (RF3). As in Fig. 4a For example, a first pressure chamber between the piston (3) and the floating piston (SK) of the tandem master cylinder (THZ) can be connected to the hydraulic line between the first bypass valve (BP1) and the central outlet valve (ZAV) via a hydraulic output and a first feed switching valve (FV). The travel simulator (WS) can be connected to the tandem master cylinder (THZ) via, for example, a further hydraulic output of the first pressure chamber and, if present, the travel simulator isolating valve (14). According to the invention, the second pressure chamber of the tandem master cylinder (THZ) can also be connected to the second brake circuit (BK2) via a further hydraulic output and a second feed switching valve (FV2) as well as possible further valves, wherein the second feed switching valve (FV2) can preferably be designed as a normally open solenoid valve for a fallback level.Both pressure chambers of the tandem master cylinder (THZ) can each have a sniffer opening or opening, which can be sealed, for example, by at least one primary (D2, D5) and secondary seal (D1, D4) and each, for example, as in . Fig. 1a can be connected to the reservoir (VB) via a parallel connection of a throttle and a check valve closing towards the reservoir (VB). Alternatively, the hydraulic connections between the pressure chambers of the tandem master cylinder and the reservoir (VB) can also be arranged as shown in Fig. 1b , Fig. 3b via diagnostic valves (VD ) or as in Fig. 3c via the reservoir shut-off valve (17) or, if a redundant primary seal (D2, D5) is present, via a hydraulic line.

[0113] In the normal case, the first feed valve (FV) and the second feed switching valve (FV2) can be closed during braking, whereby the pressure supply unit (DV) can then build up brake pressure in the brake circuits (BK1, BK2) via "brake-by-wire" and corresponding valve circuits in the hydraulic control unit (HCU).

[0114] Compared to a single master cylinder (SHZ), the use of a tandem master cylinder (THZ) can reduce the probability of a total failure of the master cylinder even without additional redundant primary or secondary seals.

[0115] Fig. 5b shows a further embodiment, which in comparison to the Fig. 5a a tandem master cylinder (THZ) with a tappet. The piston (3) of the brake pedal device can be moved in a first pressure chamber between the piston (3) and the floating piston (SK) and coupled with a further tappet and a further piston, which in turn can be moved into a second pressure chamber against a return spring. The hydraulic connection and function of this tandem master cylinder (THZ) is as in Fig. 5a . The check valve RV3 is connected to the rear chamber of the floating piston (SK) via another hydraulic line and another opening in the tandem master cylinder. Bezugszeichenliste

[0116] RB1-4 Wheel brake RZ1-4 Wheel cylinder SV1-4 Switching valves EV1-4 Inlet valves AV1-4 Outlet valves BK1, BK2 Brake circuit DG, DG2 Pressure sensor SHZ Single master cylinder unit THZ, DHZ Tandem master cylinder unit or synonymously double master cylinder KWS Force travel sensor GWSG Yaw angle sensor Sp1, Sp2 Pedal travel sensor Sp Pedal travel Fp Pedal force BP1, BP2 Bypass valve ZAV, ZAV2 (central) outlet valve FV, FV2 Feed switching valve TV Isolating valve RV1-6 Check valve DVD Pressure supply unit HCU Hydraulic control unit ECU Electronic control unit VB Reservoir WS Travel simulator SK Floating piston of the tandem master cylinder D1 Secondary seal of the master cylinder D2 Primary seal of the master cylinder D3 Primary seal of the travel simulator D4 Secondary seal of the floating piston D5Primary seal of the floating piston D1rRedundant secondary seal of the master cylinder D2rRedundant primary seal of the master cylinder D3rRedundant primary seal of the travel simulator Dr1,Dr4 Throttle in the connection between master cylinder and reservoir Dr2 Throttle in the connection between master cylinder and travel simulator Dr3 Throttle in travel simulator Dr5 Throttle in the back pressure valve 19 VD Diagnostic valve RF, RF1-3 Return spring PD1-4 Solenoid valves in the connection of the dual-circuit double-acting piston pump F Spring 1 Brake pedal 2 Pedal tappet 3 Master cylinder piston 3a Part of the master cylinder piston 4 Master cylinder housing 5 PCB 6 Fill level sensor element 7 Sensor target 8 Float in reservoir 9 Electronic elements for travel simulator for force characteristics 10 Redundant electrical connection of the feed switching valve 11 Double-acting piston with spindle drive 12 Redundant connection to motor for 2 x 3 phase winding 13 Electrical connector for the vehicle electrical system connection 14 Travel simulator isolation valve 15 Detent ball 16 Sensor rod 17 Reservoir shut-off valve 18Ball valve 19Back pressure valve 20Valve plate 21Force-displacement characteristic for the brake pedal,

Claims

1. Brake system for a vehicle, comprising the following components: - at least two hydraulic brake circuits (BK1, BK2), each with at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4); - at least one pressure supply device (DV), which is connected via a hydraulic line to a brake circuit (BK1, BK2); - a switching valve (SV1, SV2, SV3, SV4) for each hydraulically acting wheel brake (RB1, RB2, RB3, RB4), which switching valve switchably connects in each case one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2); - at least one hydraulic connection, which is switchable by means of at least one outlet switching valve (ZAV), between at least one of the brake circuits (BK1, BK2) and a reservoir (VB); - and a hydraulic brake pedal system, a hydraulic output of which is switchably coupled by means of an infeed switching valve (FV) to at least one brake circuit (BK1, BK2); wherein the brake system comprises at least one hydraulic connection, which is switchable by means of at least one bypass switching valve (BP1), between the two brake circuits (BK1 and BK2), characterized in that the at least one bypass switching valve (BP1) is a solenoid valve.

2. Brake system according to Claim 1, wherein the pressure in the at least one hydraulically acting wheel brake (RB1, RB2, RB3, RB4) is reduced by opening the outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV4).

3. Brake system according to Claim 1 or 2, wherein the at least one pressure supply device (DV) comprises a rotary pump; optionally, wherein the rotary pump is designed as a gear pump or as a multi-piston pump, in particular a three-piston pump.

4. Brake system according to one of the preceding claims, wherein the pressure supply device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that closes towards the pressure supply device (DV) or via a solenoid valve.

5. Brake system according to Claim 3, wherein the multi-piston pump is connected directly to at least one of the brake circuits (BK1, BK2), wherein directly connected means that no valve or no pressure-influencing device is present between the multi-piston pump and the at least one brake circuit (BK1, BK2), and optionally one or more check valves may be integrated in the multi-piston pump.

6. Brake system according to one of the preceding claims, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that are open when electrically deenergized, and the bypass switching valve (BP1) is a bypass switching valve that is open when electrically deenergized, and the outlet switching valve (ZAV) is an outlet switching valve that is closed when electrically deenergized, and the infeed switching valve (FV) is an infeed switching valve that is open when electrically deenergized.

7. Brake system according to one of the preceding claims, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected in such a manner that a residual pressure in a wheel brake (RB1, RB2, RB3, RB4) opens the respective switching valve (SV1, SV2, SV3, SV4) in the electrically deenergized state.

8. Brake system according to one of the preceding claims, wherein ABS and / or ESP control can be performed by means of at least one switching valve (SV1, SV2, SV3, SV4) and the outlet switching valve (ZAV).

9. Brake system according to one of the preceding claims, wherein no valve is present between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK2).

10. Brake system according to one of the preceding claims, wherein no valve is present between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV4).

11. Brake system according to one of the preceding claims, wherein only specifically the outlet switching valve (ZAV) switchably connects the brake circuits (BK1, BK2) to the reservoir (VB).

12. Brake system according to one of the preceding claims, wherein each wheel brake (RB1, RB2, RB3, RB4) has only specifically the associated switching valve (SV1, SV2, SV3, SV4).

13. Brake system according to one of Claims 1 to 10 or 12, wherein a second outlet switching valve (ZAV2) is present, which is connected directly to the output of the pressure supply device (DV) or to an associated check valve (RV3) and switchably connects to the reservoir (VB), in particular wherein only specifically the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuits (BK1, BK2) to the reservoir (VB).

14. Brake system according to one of Claims 1 to 8 or 11 to 13, wherein the two hydraulic brake circuits (BK1, BK2) are connected to one another via the bypass switching valve (BP1) and a further bypass switching valve (BP2), which are connected in series, wherein the outlet switching valve (ZAV) is connected to a line section between the two bypass switching valves (BP1, BP2).

15. Brake system according to one of the preceding claims, wherein an isolating switching valve (TV) is additionally present, which is connected directly to the output of the pressure supply device (DV) or to an associated check valve (RV3) and is connected directly to at least one of the switching valves (SV1, SV2).