FAILURE SAFETY VALVE UNIT, ELECTRONICALLY CONTROLLED PNEUMATIC BRAKE SYSTEM, VEHICLE, PROCEDURE

Description

[0001] The invention relates to a fail-safe valve unit according to the preamble of claim 1. The invention also relates to an electronically controllable pneumatic braking system having a fail-safe valve unit according to the aforementioned type. The invention also relates to a vehicle having an electronically controllable pneumatic braking system according to the aforementioned type. The invention also relates to a method for operating a braking system of the aforementioned type.

[0002] In modern electronically controllable pneumatic braking systems, which are used in particular in commercial vehicles intended for autonomous driving, it is important to provide measures that still allow the commercial vehicle to decelerate safely in the event of a fault in the braking system.

[0003] In particular, providing redundancy is a proven measure for increasing safety. There are approaches to this, including fully redundant braking systems, partially redundant braking systems, or simply different levels within a braking system, so that in the event of a failure at a first level, the braking system at a second level can continue to operate, at least to a limited extent.

[0004] One approach is to provide a fail-safe braking function in the event of a fault by activating the parking brake. The problem here is the delay in fail-safe braking, which is due to a dead time in the response behavior due to the inverse chain of action compared to a service brake, including the pressure offset that must be overcome for the parking brake to apply.

[0005] There are therefore advantageous approaches that are based on the control of a brake pressure to the service brake in the event of a fault.

[0006] A system that provides electronically pneumatically controlled redundancy is disclosed in DE 10 2016 005 318 A1. The system disclosed therein uses a bypass valve to forward control pressures depending on the failure of a subsystem, thus at least pneumatically supplying the circuit that has failed electrically. This also generally advantageously increases residual availability. Similar systems are disclosed in DE 10 2016 010 462 A1 and DE 10 2016 010 464 A1.

[0007] DE102017002718A1 describes an electronically controllable braking system for a vehicle, comprising at least one service brake circuit with service brakes and a service brake control module, wherein a service brake pressure can be supplied to the service brakes and the service brake control module is designed to generate a service brake control signal depending on a braking command, wherein the service brake pressure can be generated depending on the service brake control signal and can be specified to the service brakes for the electrically controlled implementation of the braking command via the at least one service brake circuit by the service brake control module, and comprising a parking brake circuit with spring-loaded brakes, wherein a parking brake pressure can be supplied to the spring-loaded brakes, wherein the parking brake pressure can be generated depending on the braking command and can be specified to the spring-loaded brakes for the implementation of the braking command via the parking brake circuit,and further comprising an inverter control valve with an inverter output and / or a redundancy output, wherein the inverter control valve is designed to generate an inverter control pressure and to output it via the inverter output and / or the redundancy output, wherein the inverter control pressure is inversely proportional to the parking brake pressure and / or a parking brake control pressure specifying the parking brake pressure, which are to be controlled in order to implement the braking command in the parking brake circuit via the spring-loaded brakes, wherein a switching valve is further arranged in the braking system, wherein the switching valve has two switching valve switching positions, wherein, when a service brake command manually requested by a driver via a service brake valve is present, a first switching valve switching position of the switching valve can be set,in which the service brake pressure can be specified as a function of the service brake pressure specified via the service brake valve and otherwise a second switching valve switching position can be set in which the service brake pressure can be specified as a function of the inverter control pressure specified by the inverter control valve.

[0008] EP2055541B1 discloses a driver assistance system for a motor vehicle and a motor vehicle, comprising at least one operating data sensor for detecting operating data characterizing the current or future state of movement of the motor vehicle and an electrical control which is designed to trigger an autonomous emergency braking of the motor vehicle when predetermined operating data are present, wherein an emergency braking is understood to mean a braking of the motor vehicle which takes place with the greatest possible deceleration, wherein the electrical control is set up to bring a parking brake of the motor vehicle into an activation position immediately before, during or after an emergency braking, in which position a power failure passively brings the parking brake into a braking position.

[0009] The concept still requires improvement, particularly with regard to reliably providing fail-safe braking in the event of a fault and continuously ensuring the braked state. It is therefore desirable to improve the function of the fail-safe valve unit. This is where the invention comes in, the object of which is to provide an improved fail-safe valve unit. In particular, a fail-safe valve unit is to be provided that reliably provides fail-safe braking in the event of a fault and continuously ensures the braked state of the vehicle.The invention is based on a fail-safe valve unit for a fail-safe braking function of an electronically controllable pneumatic braking system for a vehicle, in particular a commercial vehicle, wherein the braking system has a control unit, and the fail-safe valve unit has: a main connection providing a first pressure and a fail-safe braking connection, a fail-safe braking valve designed as a monostable valve, which is controllable by the control unit or an external control unit, and is designed to pneumatically connect the main connection and the fail-safe braking connection in an open position for controlling a fail-safe braking pressure at the fail-safe braking connection.

[0010] According to the invention, the fail-safe valve unit according to the first aspect of the invention is provided that in the event of a fault and / or power failure and / or diagnostic case of the control unit, the failure brake valve is in the open position, and that a failure braking of the vehicle is triggered by the provision of the failure brake pressure at the failure brake connection by the braking system, wherein the main connection for receiving a controlled parking brake pressure or a pressure derived therefrom is pneumatically connected to a parking brake function as the first pressure.

[0011] The electronically controllable pneumatic braking system comprises, in particular, a service brake system and a parking brake system. The parking brake function is designed for pneumatically actuating at least one parking brake cylinder.

[0012] The concept of the invention is based on the idea of ​​keeping a braking system, in particular a service braking system of the braking system, controllable via a separate control branch for the purpose of triggering a failover braking in the event of a fault. In particular, by providing a failover braking pressure in the event of a fault, safe deceleration of the vehicle through a failover braking is to be ensured.

[0013] The invention incorporates the recognition that maintaining the braked state of the vehicle is important for vehicle safety. Following a fail-safe braking operation by the fail-safe valve unit, a leak may occur in the service brake circuit performing the fail-safe braking, particularly in a control line of a pneumatic front-axle brake circuit, or at a front-axle modulator, or at another location in a separate control branch in which the fail-safe valve unit is located. Such a leak may, if the connected pressure reservoir progressively empties, lead to a drop in the fail-safe braking pressure, thus diminishing the effectiveness of the fail-safe braking.

[0014] The fact that, according to the invention, the main connection for receiving a controlled parking brake pressure is pneumatically connected to a parking brake function as the first pressure, advantageously ensures that, in the event of a leak following a failure braking operation by the fail-safe valve unit, the at least one parking brake cylinder is also pneumatically connected to the leaking part. A leak, due to the fail-safe valve unit according to the invention, thus leads to the parking brake being applied, thereby safely maintaining the braked state of the vehicle. The parking brake is applied by venting the parking brake cylinder and the action of a compression spring, which relaxes in the process, on a wheel brake.

[0015] The fail-safe valve unit according to the invention therefore specifically utilizes the pneumatic connection between a service brake circuit (which performs the fail-safe braking), in particular a front-axle brake circuit of the service brake, and the controlled parking brake pressure to compensate for the diminishing effectiveness of the service brake circuit (which performs the fail-safe braking) by the initiating action of the parking brake in the event of a pressure loss. This process can occur relatively slowly, in the range of hours or even days, depending particularly on the size of the leak.

[0016] Advantageous further developments of the invention can be found in the dependent claims and specify in detail advantageous possibilities for realizing the concept explained above within the scope of the task and with regard to further advantages.

[0017] In particular, the parking brake system and / or the parking brake function comprises a parking brake module. The parking brake function is preferably designed to control a parking brake pressure for ventilating parking brake cylinders. The parking brake function is preferably provided by a parking brake module. In further developments, the parking brake function can be provided by another pneumatic or electropneumatic device, for example, an axle modulator, a trailer control module, or similar pneumatic or electropneumatic device.

[0018] In particular, the main connection is pneumatically connected to a parking brake cylinder, preferably to two parking brake cylinders, each arranged on a side of the vehicle. In particular, the main connection is pneumatically connected to at least one parking brake chamber of the parking brake cylinder.

[0019] The invention is further developed by a selection valve having a first connection which is pneumatically connected to the parking brake function, in particular a parking brake system and / or the parking brake module, for receiving the first pressure, with a second port which is pneumatically connected to a further compressed air supply for receiving a further supply pressure as a second pressure, and with a third port which is pneumatically connected to the failure brake valve, wherein the selection valve is designed to pneumatically connect that of the first and second ports to which the higher pressure is applied to the third port and in particular to block the respective other port.

[0020] A further development with a selector valve includes the realization that a redundant supply of compressed air to the fail-safe valve unit advantageously increases vehicle safety. By means of a selector valve with a first port that is pneumatically connected to a parking brake system for receiving the first pressure, the availability of a first compressed air source for providing a fail-safe brake pressure can be advantageously provided, which is in particular independent of the compressed air source of the brake circuit used during normal operation, in particular a service brake circuit to which the fail-safe brake pressure is supplied. Thus, redundancy is advantageously achieved by using a separate brake circuit.

[0021] By means of a second port of the selector valve, which is pneumatically connected to a further compressed air supply for receiving a further supply pressure as a second pressure, an additional compressed air source, independent of the parking brake system, is advantageously provided as yet another redundancy. The additional compressed air supply can, in particular, also be a compressed air supply of the service brake system.

[0022] Because the failure brake valve has a third connection which is pneumatically connected to the failure brake valve, and the failure brake valve is designed to pneumatically connect that of the first and second connections to which the higher pressure is applied to the third connection, the other available compressed air source is advantageously automatically connected to the failure brake valve even in the event of a failure of one compressed air source at one of the first and second connections.

[0023] The selection valve thus further increases the availability of the fail-safe brake function and thus the safety of the vehicle.

[0024] In particular, the fail-safe valve is designed to be in the open position when not actuated, in particular when de-energized. In particular, the fail-safe valve is designed to be monostable.

[0025] The selection valve is preferably designed as a shuttle valve, particularly preferably as a select-high shuttle valve.

[0026] The parking brake pressure is, in particular, controlled or provided by a parking brake module. The parking brake circuit supply pressure is, in particular, provided by a compressed air supply of the parking brake system. If the parking brake circuit supply pressure is provided by a compressed air supply of the parking brake system, the parking brake system, in particular the parking brake module, is advantageously designed to automatically engage in an electrically passive state without supply pressure. An electrically passive state exists, in particular, when the control unit and / or another control unit and / or the parking brake module are not supplied with power or fail due to a fault.

[0027] It is preferably provided that the failure brake pressure is provided as control pressure for an axle modulator, in particular for a front axle modulator, or the failure brake pressure is provided as brake pressure for a brake cylinder. If the failure brake pressure is provided as brake pressure for a brake cylinder, a complete supply of the compressed air required for the failure braking can advantageously be achieved by means of the fail-safe valve unit, in particular if the brake cylinder is fully activated by means of the compressed air provided by the fail-safe valve unit with the failure brake pressure. If the failure brake pressure is provided as brake pressure for a modulator, the failure brake pressure acts in particular on a control connection of the modulator, wherein the modulator in particular has an air quantity-enhancing effect and is in particular supplied from a further compressed air source or compressed air supply.The control terminal of the modulator is in particular a redundancy terminal of the modulator.

[0028] Preferably, a further failure brake valve is provided, which is pneumatically connected in series with the failure brake valve and can be controlled by a control unit, in particular a further control unit. The further failure brake valve is preferably open in an open position in the non-activated, in particular de-energized, state such that the first pressure present at the main connection is provided as failure brake pressure at the failure brake connection. In particular, the further failure brake valve can be controlled via a further control signal. In particular, the control unit is assigned to a primary system. In particular, the further control unit and / or the further failure brake valve is assigned to a first fallback level.In further developments with an additional control unit, a further fail-over brake valve can advantageously ensure fail-over braking even when a double fault occurs, i.e., when both the control unit and the additional control unit exhibit a fault. A fault can be caused, in particular, by an exception error and / or a power failure. The additional fail-over brake valve is, in particular, monostable. The fail-over brake valve and / or the additional fail-over brake valve are arranged, in particular, in a main valve line.

[0029] The invention is further developed in that the additional fail-over brake valve is designed as a 2 / 2-way valve, in particular as a 2 / 2-way solenoid valve. By means of an additional fail-over brake valve designed as a 2 / 2-way valve, the output fail-over brake pressure can advantageously be modulated, in particular by a time-controlled opening and closing of the 2 / 2-way valve. In particular, stepped braking can be ensured in the event of partial failures or when the control unit is still available, for example, when a power supply is still available. By modulating the fail-over brake pressure, less abrupt fail-over braking can be achieved.

[0030] Preferably, the fail-over brake valve and / or the additional fail-over brake valve are designed as a 3 / 2-way valve, in particular as a 3 / 2-way solenoid valve. In particular, the fail-over brake valve and the additional fail-over brake valve are structurally identical. In particular, the fail-over brake valve and / or the additional fail-over brake valve have a vent connection that is pneumatically connected to the fail-over brake connection when the fail-over brake valve or the additional fail-over brake valve is in a blocked position. This enables venting of the fail-over brake connection in the blocked position.

[0031] A pressure relief valve is preferably provided. A pressure relief valve can advantageously be used to set a predefined fail-safe braking pressure in order to achieve suitable braking performance in the event of a fail-safe braking operation. A pressure relief valve is preferably arranged at the main connection of the fail-safe valve unit or between the main connection and the first downstream valve of the fail-safe valve unit.

[0032] Preferably, a bistable valve is provided, which is designed to switch between a first deactivation position, which blocks the main valve line or connects it to a vent, and a second activation position, which connects the main valve line. The bistable valve is pneumatically connected in series with the at least one fail-safe brake valve. By means of a bistable valve, the fail-safe valve unit can advantageously be operated both in a mode suitable for automatic operation of the vehicle and in a mode suitable for manual operation of the vehicle.In particular, the bistable valve is designed such that, in the first position blocking the valve main line, the valve main line is pneumatically connected to a vent of the bistable valve at a first bistable valve connection, while the valve main line is blocked at a second bistable valve connection. In a second position pneumatically connecting the valve main line, the valve main line is pneumatically connected between the first and second bistable valve connections, while the vent of the bistable valve is blocked. The bistable valve is preferably arranged in a valve main line.

[0033] When the bistable valve is in a first position blocking the main valve line, the provision of fail-safe brake pressure at the fail-safe brake port of the fail-safe valve unit is prevented per se, regardless of the position of the fail-safe brake valves. In this first position, fail-safe braking that would be caused by a double fault is therefore prevented. This can be particularly advantageous when the vehicle is operated manually, especially when a human driver is to retain control of the vehicle. In contrast, the bistable valve can be switched to a second position pneumatically connecting the main valve line so that - when the at least one fail-safe brake valve of the fail-safe valve unit is in an open position - the fail-safe brake pressure can be provided at the fail-safe brake port to trigger fail-safe braking of the vehicle.According to the concept of a bistable valve, it remains in its switching position, even when de-energized and, in particular, regardless of any faults in the braking system. The bistable valve is controlled, in particular, via the control unit or a valve control unit. A valve control unit is connected, in particular, to the control unit of the braking system and / or to a vehicle bus for signal and / or power transmission.

[0034] Preferably, a further selection valve is provided with a first further connection which is pneumatically connected to a brake value sensor, in particular to a pneumatic front axle modulator control line, for receiving the brake value sensor pressure, a second further connection which is pneumatically connected to the failure brake connection for receiving the failure brake pressure, and a third further connection which is pneumatically connected to a service brake cylinder or an axle modulator, wherein the further selection valve is designed to pneumatically connect the one of the first and second further connections to which the higher pressure is applied to the third further connection and, in particular, to block the other connection. By means of a further selection valve, the failure brake pressure can advantageously be controlled into the service brake circuit in addition to the brake value sensor.

[0035] Preferably, a pressure sensor is provided, which is arranged at the fail-safe brake connection 22 or is pneumatically connected thereto. Using a pressure sensor, the pressure response and thus the functioning of the fail-safe valve unit can be advantageously verified and / or tested.

[0036] Preferably, a fail-safe relay valve is provided. The fail-safe relay valve is arranged, in particular, between the at least one fail-safe brake valve and any bistable valve on one side, and the fail-safe brake connection on the other side. A fail-safe relay valve can advantageously have an air flow-enhancing effect, whereby the remaining valves of the fail-safe valve unit can advantageously be designed with smaller nominal diameters.

[0037] In optional further developments, the additional selection valve can be arranged at a different location in the service brake system, in particular in a pneumatic front axle brake circuit for the direct supply of one or more service brake cylinders.

[0038] In a preferred development, an external control unit is provided which is connected in a signal- and / or power-conducting manner to one or more of the valves of the fail-safe valve unit, in particular to the at least one fail-safe brake valve. In particular, the external control unit is connected to the fail-safe valve unit via an alternative control line and / or an alternative further control line. The external control unit is connected to the control unit in a signal-conducting manner, in particular via a monitoring line, in particular for monitoring the control unit. The external control unit can particularly advantageously be formed by another electronic control unit of the vehicle or as part of such another electronic control unit.Such another electronic control unit is, in particular, a virtual driver, for example in the form of an automatic operation control unit, or an electronic control unit of a steering system, a parking brake system, or an air treatment system. The function of the control unit, i.e., the control unit of the braking system, in particular the service braking system, can advantageously be monitored by means of an external control unit. In the event of a fault in the control unit, this is detected by the external control unit. In the event of a fault, the external control unit can interrupt the control of the valves of the fail-safe valve unit, in particular of the at least one fail-safe brake valve, and, in particular, trigger a fail-safe braking action.

[0039] In In a second aspect, the invention further provides an electronically controllable pneumatic braking system for a vehicle, in particular a commercial vehicle, comprising a control unit to achieve the object.

[0040] In the electronically controllable pneumatic braking system, a fail-safe valve unit according to at least one of the above-described preferred embodiments of a fail-safe valve unit according to the first aspect of the invention is provided, wherein the fail-safe valve unit is arranged in a separate control branch and is pneumatically connectable to at least one service brake cylinder and / or a service brake chamber and / or an axle modulator via a fail-safe brake connection in order to provide a fail-safe brake pressure for an axle modulator for triggering a fail-safe braking of the vehicle.

[0041] The braking system takes advantage of the benefits of the fail-safe valve unit. "Separate control branch" here means that the fail-safe valve unit is arranged in an additional pneumatic control branch, which is separate from a primary pneumatic control branch, in particular one with a brake signal transmitter.

[0042] In a further development of the electronically controllable pneumatic braking system, an axle modulator is provided with a throttle, in particular a jet bore, which pneumatically connects a part of the axle modulator carrying a control pressure to a part of the axle modulator carrying a working pressure. The part of the axle modulator carrying a control pressure is formed in particular by a control line of the axle modulator, in particular by a relay valve of the axle modulator. The part of the axle modulator carrying the working pressure is formed in particular by a working line of the axle modulator, in particular by a relay valve of the axle modulator. In particular, the throttle is provided in a relay piston of the relay valve of the axle modulator. By means of such a throttle, the application of the parking brake can advantageously be ensured even in the event of a leak in a working line or a part pneumatically connected to the working line.

[0043] In a further development of the electronically controllable pneumatic brake system, it is provided that the control unit is assigned to a primary system of the electronically controllable pneumatic brake system, and the electronically controllable pneumatic brake system further comprises: a further control unit for a first fallback level, wherein the failure brake valve can be controlled by the control unit and the further failure brake valve can be controlled by the further control unit, and the first control unit and the second control unit are supplied with energy independently of one another and / or can at least partially replace one another in their function.

[0044] In a third aspect, the invention further achieves the object by providing a vehicle, in particular a commercial vehicle, with a braking system according to the concept of the invention. The advantages of the fail-safe valve unit are advantageously utilized in the vehicle. In a further development of the vehicle, an external control unit is provided.

[0045] In a fourth aspect, the invention further provides a method for operating a braking system having a fail-safe valve unit for a fail-safe braking function of an electronically controllable pneumatic braking system, in particular according to the second aspect of the invention, for a vehicle or a commercial vehicle, in particular according to the third aspect of the invention, wherein the fail-safe valve unit is preferably designed according to one of the above-described preferred embodiments of a fail-safe valve unit according to the first aspect of the invention.

[0046] The method according to the fourth aspect of the invention comprises the steps of: Providing a signal for locking out a fail-safe brake pressure effective for a fail-safe braking by a control unit, interrupting the provision of the signal in the event of a fault and / or a power failure and / or a diagnostic case of the control unit, thereby automatically terminating the locking out of the fail-safe brake pressure to trigger a fail-safe braking of the vehicle, wherein the fail-safe brake pressure is a parking brake pressure controlled by a parking brake function of the braking system for ventilating parking brake cylinders or a pressure derived therefrom.

[0047] Preferably, ending the blocking of the emergency brake pressure involves switching the emergency brake valve to an open position. Preferably, the signal for blocking an emergency brake pressure effective for emergency braking is provided for a emergency brake valve. Preferably, the emergency brake valve is a monostable emergency brake valve that opens when not activated. Preferably, the signal is provided by a control unit. Preferably, the signal is an electrical or electronic signal. In other developments, it is conceivable for the signal to be a different signal, for example a pneumatic signal. Preferably, the interruption of the provision of the signal is due to a fault and / or power failure of the control unit.

[0048] Preferably, the automatic termination of the locking out of the failover brake pressure comprises an automatic switching of the failover brake valve to its open position. Preferably, the activation of the failover brake valve involves energizing a magnetic part and / or electromagnet of the failover brake valve. Preferably, the failover brake valve is a monostable, normally open failover brake valve. Preferably, the failover brake pressure is provided to an axle modulator or a service brake cylinder. Preferably, the controlled parking brake pressure is provided by a parking brake module.

[0049] In a further development of the method according to the fourth aspect of the invention, a diagnostic procedure is provided, comprising the step: Determining the failure brake pressure, preferably by means of a pressure sensor at the failure brake connection, wherein before interrupting the provision of the signal, preferably in a diagnostic case of the control unit, a pressure control in the service brake system, preferably a brake request to an axle modulator, is requested.

[0050] In contrast to a fault situation and a power failure, the diagnostic case represents a deliberately introduced state of a control unit for diagnostic purposes, in which the state of the signal(s) for blocking a fail-over brake pressure effective for a fail-over braking preferably corresponds to the state in the event of a fault situation and / or a power failure. Preferably, in a diagnostic case, the provision of the signal for blocking a fail-over brake pressure effective for a fail-over braking is interrupted.

[0051] Preferably, the applied failover brake pressure is determined to verify the correct functioning of the failover brake valve. The correct functioning of the failover brake valve preferably lies in the fact that interrupting the activation of the failover brake valve triggers a pressure reaction in the form of an adjustment of the failover brake pressure. The pressure reaction can advantageously be verified for plausibility using the diagnostic procedure.

[0052] Preferably, the braking request is provided by a brake signal transmitter. In particular, the braking request is provided via a vehicle data bus. Preferably, the braking request and / or the request for pressure control in the service brake system is provided in the form of an XBR signal or similar signal from a vehicle data bus.

[0053] By requesting a pressure control in the service brake system, in particular a braking request to an axle modulator, before interrupting the signal provision, a possible plausibility error in the braking system, in particular in the control unit, is advantageously avoided. Such a plausibility error would be detected, in particular by the control unit, if a pressure is applied to the service brake system by the fail-safe valve unit without a corresponding braking request, such as a deflection of the brake signal sensor, in particular a brake pedal, occurring. The pressure applied to the service brake system can be measured, in particular, via an axle modulator pressure sensor.

[0054] The diagnostic sequence can be used to advantageously test or ensure the correct functioning of the fail-safe valve unit. The diagnostic sequence can be initiated in various ways. Firstly, the diagnostic sequence can be performed during braking initiated by a braking request during vehicle operation. This is the case, for example, when a driver sends an electronic braking request to an axle modulator via the brake signal transmitter—or the control unit in automatic driving mode.

[0055] In particular, the pressure control is requested electrically or electronically via the control unit and an electrical axle modulator control line, in particular an electrical front axle modulator control line or electrical rear axle modulator control line. In particular, the braking request is an electrical or electronic braking request.

[0056] In the method according to the fourth aspect of the invention, the advantages of the fail-safe valve unit are advantageously utilized.

[0057] In a fifth aspect, the invention further provides a method for operating a braking system having a fail-safe valve unit for a fail-safe braking function of an electronically controllable pneumatic braking system, in particular according to the second aspect of the invention, for a vehicle or a commercial vehicle, in particular according to the third aspect of the invention, wherein the fail-safe valve unit is preferably designed according to one of the above-described preferred embodiments of a fail-safe valve unit according to the first aspect of the invention.

[0058] The method according to the fifth aspect of the invention comprises the steps of: Providing a signal for locking out a fail-safe brake pressure effective for a fail-safe braking by a control unit, interrupting the provision of the signal in the event of a fault and / or a power failure and / or a diagnostic case of the control unit, thereby automatically ending the locking out of the fail-safe brake pressure to trigger a fail-safe braking of the vehicle, comprising a diagnostic sequence with the step: determining the fail-safe brake pressure, preferably by means of a pressure sensor, at the fail-safe brake connection, wherein before interrupting the provision of the signal, preferably in a diagnostic case of the control unit, a pressure control in the service brake system, preferably a braking request to an axle modulator, is requested.

[0059] It is preferably provided that the failure brake pressure is a parking brake pressure controlled by a parking brake function for ventilating parking brake cylinders or a pressure derived therefrom.

[0060] Preferably, the fail-safe valve unit is pneumatically supplied by a brake circuit that is independent of the service brake system's brake circuit that performs the fail-safe braking. "Pneumatically supplied" means the provision of compressed air, in particular a first pressure, which is provided as the fail-safe braking pressure when the at least one fail-safe brake valve is opened.

[0061] Preferably, the fail-safe valve unit is pneumatically supplied from a pressure supply that is independent of the pressure supply of the brake circuit of the service brake system that performs the fail-safe braking. In particular, the fail-safe brake pressure is provided by a pressure supply of the parking brake system or another pressure supply.

[0062] Preferably, the diagnostic sequence is performed during service braking of the service braking system, in particular during an existing braking request. During service braking, a braking request is sent to the axle modulator performing the braking. Such a braking request is in particular electrical or electronic and can be provided by a brake value transmitter or a control unit, for example an external control unit and / or an automatic operation control unit. In this case, the failure brake pressure can advantageously be provided, since pressure application and a correspondingly increasing pressure, measured by the axle modulator pressure sensor, are expected anyway.The effect of a failure braking by providing the failure brake pressure would also advantageously not be noticeable or only to a small extent during a service braking, since a requested braking of the vehicle takes place anyway.

[0063] In other developments of the method, the diagnostic sequence is alternatively or additionally performed while the vehicle is stationary, wherein, in particular, a braking request is generated, in particular by an external control unit and / or an automatic operation control unit. During a standstill, an actuation of the service brake, which is triggered by the provision of the fail-safe brake pressure, would not be noticed because the vehicle is stationary. However, a braking request is advantageously generated even in this case to avoid a plausibility error in the control unit of the braking system.

[0064] Preferably, it is provided that The braking request is provided by a braking signal transmitter and / or an external control unit and / or an automatic operation control unit. In particular, the braking request is provided via a vehicle data bus. In particular, the braking request is in the form of a CAN signal, in particular an XBR signal.

[0065] If the procedure is further developed, the following steps are planned: Providing a signal for an individual valve, in particular for a single fail-over brake valve or a single bistable valve, determining the fail-over brake pressure, in particular verifying the plausibility of the pressure response for the individual valve. In a further development, the method can additionally comprise the step of verifying the plausibility of the pressure response for a pressure relief valve.

[0066] Plausibility checking involves checking whether a determined pressure value matches an expected pressure value. A pressure response for a valve is, in particular, the pressure change or the expected pressure change that accompanies actuation of the valve. Plausibility checking can, in particular, include checking whether no pressure is present, i.e., whether the pressure is equal to or close to zero, because the valves are supposed to close (= not pressurize) when actuated or when the signal is provided. In this way, the diagnosis can be advantageously differentiated because the reaction of individual valves can be tested. Advantageously, all valves are initially left in the non-actuated state and / or - especially in the case of a bistable valve - in their pressurized position. In this case, the output brake pressure should be measured at the pressure sensor. If this is not the case, an error is output.The individual valves of the fail-safe valve unit can then be activated one after the other to check their response. For example, the fail-safe valve is switched to its closed position by activation, which should cause the measured pressure to drop. If this is not the case, a fault related to the fail-safe valve can be concluded, which could be in the valve's mechanics, the solenoid, or the control line. Such an individual test can be performed analogously for the remaining valves, in particular another fail-safe valve and / or a bistable valve.

[0067] A diagnostic sequence or diagnostic case can advantageously be carried out automatically at regular intervals in order to check and ensure the function of the fail-safe valve unit and, in particular, to detect dormant errors in the fail-safe valve unit at an early stage. For example, a diagnostic sequence can be carried out each time the vehicle is started, or when the vehicle is started after a specified number of starts. In particular, the diagnostic sequence can be carried out as part of a higher-level self-diagnosis of the vehicle. In particular, the diagnostic sequence can be carried out during service braking after a specified number of service braking applications or during service braking at specified intervals (for example, once a day, once a week, or once a month).

[0068] In the method according to the fifth aspect of the invention, a first pressure can advantageously be provided at the main connection of the fail-safe valve unit to test or ensure the correct functioning of the fail-safe valve unit. This first pressure preferably originates from another pressure source, preferably a brake circuit or brake system that is independent of the brake circuit performing the fail-safe braking. For example, for the diagnostic sequence, the first pressure at the main connection can be a controlled pressure from a parking brake module or from a trailer control module or from a front axle modulator or from a rear axle modulator or similar axle modulator.

[0069] In the method according to the fifth aspect of the invention, the advantages of the fail-safe valve unit are advantageously utilized.

[0070] It should be understood that the fail-safe valve unit according to the first aspect of the invention, the electronically controllable pneumatic braking system according to the second aspect of the invention, the vehicle according to the third aspect of the invention, the method according to the fourth aspect of the invention, and the method according to the fifth aspect of the invention have the same and similar sub-aspects, as particularly set forth in the dependent claims. Therefore, for the development of one aspect of the invention, reference is also made to the developments of the other aspects of the invention.

[0071] Embodiments of the invention will now be described below with reference to the drawings. These are not necessarily intended to represent the embodiments to scale; rather, the drawings are schematic and / or slightly distorted where this is useful for explanation. With regard to additions to the teachings immediately apparent from the drawings, reference is made to the relevant prior art. It should be noted that numerous modifications and changes to the form and detail of an embodiment can be made without deviating from the general idea of ​​the invention. The features of the invention disclosed in the description, in the drawings and in the claims can be essential for the further development of the invention, both individually and in any combination.Furthermore, all combinations of at least two of the features disclosed in the description, the drawings and / or the claims fall within the scope of the invention. The general idea of ​​the invention is not limited to the exact form or detail of the preferred embodiments shown and described below, or to an object that would be more limited than the object claimed in the claims. Where dimensioning ranges are specified, values ​​within the stated limits are also intended to be disclosed as limit values ​​and to be used and claimed as desired. For the sake of simplicity, the same reference numerals are used below for identical or similar parts or parts with identical or similar functions. The invention is only limited by the scope of the appended claims.

[0072] Further advantages, features and details of the invention will become apparent from the following description of the preferred embodiments and from the drawings, which show: Fig. 1a fail-safe valve unit according to the invention, Fig. 2Awhich in Fig. 1 shown fail-safe valve unit in detail, Fig. 2B, Fig. 2C, Fig. 2D, Fig. 2E each show a further preferred embodiment of a fail-safe valve unit according to the invention, Fig. 3 shows an electronically controllable pneumatic braking system with a fail-safe valve unit according to the invention, and in Fig. 4 a pneumatic circuit diagram of an axle modulator for an electronically controllable pneumatic braking system.

[0073] Fig. 1 shows a fail-safe valve unit 1 according to the invention for an electronically controllable pneumatic braking system 204. The fail-safe valve unit 1 has a main valve line 30 that pneumatically connects a main connection 20 and a fail-safe brake connection 22. The fail-safe valve unit 1 has at least one fail-safe brake valve 40, which is controllable by a control unit 410 and, in the non-activated, in particular de-energized, state, is open in an open position 40A such that a first pressure p1 applied to the main connection 20 is provided as a fail-safe brake pressure pN at a fail-safe brake connection 22.By providing the failure brake pressure pN at the failure brake connection 22 in the open position 40A of the failure brake valve 40, a failure braking BA of the vehicle 200 can advantageously be triggered in the event of a fault FF, in particular in the event of an exception fault FA and / or power failure FS, of the control unit 410 by the braking system 204, in particular by the service braking system 510.

[0074] The fail-safe valve unit 1 is advantageously arranged in a separate control branch 430 such that the first pressure p1 is provided in particular by a different compressed air supply than the compressed air supply that supplies the front axle modulator 434 during normal operation.

[0075] Advantageously, the main connection 20 is pneumatically connected to the parking brake system 520. In particular, the main connection 20 is pneumatically connected to a pneumatic parking brake line 496 of the parking brake system 520 for receiving a parking brake pressure pFS. Alternatively or additionally, the main connection 20 can be configured to receive a pressure pFS' derived from the parking brake pressure pFS.

[0076] The fail-safe valve unit 1 can preferably have a selector valve 50, which is designed in particular as a shuttle valve 52. The selector valve 50 is designed to pneumatically connect the connection of a first selector valve connection 50.1 and a second selector valve connection 50.2 to a third selector valve connection 50.3 at which the higher pressure is applied.

[0077] In particular, in embodiments with a selector valve 50, a further supply pressure pWV from a further compressed air source, in particular a further compressed air supply 452 or a still further compressed air supply 450, can be provided as a second pressure p2 via a further main connection 20'. The selector valve 50 can advantageously ensure that either the first pressure p1 applied to the main connection 20 from the parking brake system 520 or the second pressure p2 applied to the further main connection 20' is passed on to the main valve line 30, depending on which selector valve connection 50.1, 50.2 has the higher pressure. This advantageously achieves redundancy in the event that no compressed air is available at one of the two selector valve connections, for example due to a leak or a system failure.

[0078] The failure brake connection 22 is pneumatically connected to a pneumatic front axle modulator control line 492, preferably via a further selection valve 56, which is designed in particular as a shuttle valve 58.

[0079] The additional selection valve 56 is pneumatically connected to the brake value transmitter 436 at a first additional selection valve connection 56.1 via the pneumatic front axle modulator control line 492. The additional selection valve 56 is pneumatically connected to the at least one fail-over brake valve 40, in particular to the fail-over brake connection 22, at a second additional selection valve connection 56.2. The additional selection valve 56 is designed to connect the selection valve connection 56.1, 56.2 to a third selection valve connection 56.3 at which the higher pressure is applied. The third selection valve connection 56.3 is pneumatically connected to the service brake system 510 via the fail-over brake valve 40 to provide the fail-over brake pressure pN. In particular, the third selection valve connection 56.3 is pneumatically connected to the front axle modulator 434 of the service brake system 510 via a control connection 434.1. The control connection 434.1 can be formed, in particular, by a redundancy port 618 of the front axle modulator 434. In embodiments, the third selection valve port 56.3 can alternatively or additionally be pneumatically connected to a brake cylinder 440 of the service brake system 510. In embodiments without a further selection valve 56, the backup brake port 22 is connected directly to the service brake system 510.

[0080] Instead of the front axle modulator 434 or a brake cylinder 440 of the front axle 210, the fail-safe valve unit 1 can, within the scope of the invention, be pneumatically connected to other elements of the pneumatic braking system 204 for the purpose of control, for example, a rear axle modulator 438 and / or a service brake chamber 444 of a parking brake cylinder 442 or similar brake cylinder. The parking brake cylinder 442 is preferably designed as a spring-loaded brake cylinder. In optional embodiments, the braking system 204 and / or the control unit 410 can have a further control unit 420. In particular, the further control unit 420 can be electrically connected to a further power supply 426 for the purpose of supplying electrical power.

[0081] In optional embodiments, the braking system 204 and / or the vehicle 200 can have an external control unit 418, which is connected in a signal- and / or energy-conducting manner to one or more of the valves 40, 60, 70 of the fail-safe valve unit 1, in particular via an alternative control line 412' and an alternative further control line 422'. The external control unit 418 is connected to the control unit 410 in a signal-conducting manner, in particular for monitoring the control unit 410, in particular via a monitoring line 419. The external control unit 418 can particularly advantageously be formed by another electronic control unit of the vehicle or as part of such another electronic control unit.Such another electronic control unit, in particular the external control unit 418, can be, in particular, an automatic operation control unit 464, or an electronic control unit of a steering system, or an electronic control unit of a parking brake system, or an electronic control unit of an air treatment system. An automatic operation control unit 464 can, in particular, be a so-called virtual driver, which generates driving commands based on sensor data, operating data, route data, target data, and the like and provides them to the vehicle. Driving commands can include steering commands, acceleration commands, and braking commands, in particular a braking request AB.

[0082] A diagnostic procedure AD for testing the functioning of the fail-safe valve unit 1 can advantageously be carried out in a diagnostic case FT by an electronic control unit, in particular the control unit 410 or an external control unit 418.

[0083] In all embodiments, the fail-safe valve unit 1 can optionally have a pressure sensor 84, which is arranged in particular at the fail-safe brake connection 22 or pneumatically connected thereto for measuring the fail-safe brake pressure pN. Using a pressure sensor 84, the pressure response and thus the functioning of the fail-safe valve unit 1 can advantageously be verified and / or tested.

[0084] Fig. 2A shows the Fig. 1 The fail-safe valve unit 1 shown in detail. The fail-safe valve unit 1 has a monostable fail-safe valve 40. The fail-safe valve 40 is connected to the control unit 410 via a control line 412, carrying signals and energy.

[0085] The fail-safe valve 40 is shown here in a non-activated and de-energized state, in which it is in an open position 40A. In the open position 40A, a pneumatic connection is established between a first valve port 40.1 and a second valve port 40.2 of the fail-safe valve 40. When the fail-safe valve 40 is in the open position 40A, a compressed air flow can flow in a flow direction SR from the main port 20 to the fail-safe port 22 for the purpose of providing a fail-safe pressure pN.

[0086] By providing a control signal S1 via the control line 412, the fail-safe brake valve 40 can be switched from the open position 40A to a blocking position 40B against the resistance of a return spring 41. In the blocking position 40B, a pneumatic connection is established between the first valve port 40.1 and a vent port 40.3. During normal operation of the vehicle 200, it is particularly provided that the fail-safe brake valve 40 is in its blocking position 40B. In this state, there is therefore no pneumatic connection between the main port 20 and the fail-safe brake port 22, since the pneumatic connection at the fail-safe brake valve 40 is interrupted.

[0087] In the event of an FF fault, in particular if a control signal S1 is missing - and a magnetic part 40.4 of the failure brake valve 40 is therefore without current - the failure brake valve 40 automatically returns to its open position 40A due to the restoring force generated by the return spring 41.

[0088] Such a fault FF can occur, for example, due to a power failure FS when the control unit 410 is without power. In such a power failure, no control signal S1 is sent to the fail-safe brake valve 40.

[0089] Furthermore, an error case FF can also manifest itself in the fact that an exception error FA occurs in the control unit 410, and a zero signal is switched by the control unit 410 as an error measure (particularly in the absence of other program alternatives), and thus - in order to switch the failure brake valve 40 into the open position 40A - the control signal S1 is intentionally set to 0.

[0090] A diagnostic case (FT) can be initiated, preferably by the control unit, to check the functionality of the fail-safe valve unit. The diagnostic case (FT) can be initiated as part of a diagnostic sequence. In a diagnostic case (FT), in particular, the activation of the fail-safe valves is interrupted by terminating the provision of signals S1, S2.

[0091] Fig. 2B shows a further preferred embodiment of a fail-safe valve unit 1' according to the invention. In contrast to the Fig. 2A In the embodiments shown, the fail-safe valve unit 1' shown here has a further fail-safe valve 60, which is arranged in the main valve line 30 and is pneumatically connected in series with the fail-safe valve 40. The further fail-safe valve 60 is designed here as a 2 / 2-way valve 62, in particular as a 2 / 2-way solenoid valve 64.

[0092] In other preferred embodiments, the further failure brake valve 60 can also be designed as a 3 / 2-way valve 66, in particular as a 3 / 2-way solenoid valve 68, as for example in Fig. 2C shown. The further failure brake valve 60 is designed, in particular, to be monostable such that, in the non-activated, in particular de-energized, state, it is in a further open position 60A. In particular, the further failure brake valve 60 has a further return spring 61, which moves the further failure brake valve 60 into the further open position 60A in the non-activated state. In the further open position 60A, a first further valve connection 60.1 of the further failure brake valve 60 is pneumatically connected to a second further valve connection 60.2 of the further failure brake valve 60. The further failure brake valve 60 is controlled, in particular, via a further control signal S2 via a further control line 422, in particular by the control unit 410 or a further control unit 420.

[0093] An embodiment with a further failure valve 60 is particularly advantageous in an optional braking system 204 that has a further control unit 420 or similar redundant control device. In such a braking system 204, in particular, the control unit 410 is assigned to a primary system B1 and the further control unit 420 to a first fallback level B2. In the event of a fault FF in the primary system B1, in particular in the control unit 410, the fail-safe valve unit 1' can thus continue to be controlled via the still intact fallback level B2, in particular, the provision of the fail-safe brake pressure pN can be retained by continuously controlling the further fail-safe brake valve 60 in the further blocking position 60B. By means of a further fail-safe brake valve 60 designed as a 2 / 2-way solenoid valve 64, in particular, the fail-safe brake pressure pN can be modulated.This advantageously enables stepped braking, in particular via a redundancy connection 618, even in the event of a partial failure, in particular if a primary system B1 has failed, and braking functionality is ensured via the separate control branch by the fail-safe valve unit 1.

[0094] In the event of a double fault FD, i.e. when an error FF, in particular in the form of an exception error FA and / or a power failure FS, occurs in both the control unit 410 and the further control unit 420, both the failure brake valve 40 and the further failure brake valve 60 fall into their open position 40A, 60A due to their monostable behavior in order to provide a failure brake pressure pN at the failure brake connection 22.

[0095] In Fig. 2C A further preferred embodiment of a fail-safe valve unit 1" is shown. In contrast to the one shown in Fig. 2B In the embodiment shown, the additional fail-safe valve 60 is designed as a 3 / 2-way valve 66, in particular as a 3 / 2-way solenoid valve 68. In particular, the fail-safe valve 40 and the additional fail-safe valve 60 are advantageously constructed identically. In particular, the additional fail-safe valve 60, designed as a 3 / 2-way valve 66, has an additional vent port 60.3, which is connected to the first additional valve port 60.1 in the blocked position 60B. The fail-safe port 22 can advantageously be vented via the additional vent port 60.3 when the additional fail-safe valve 60 is switched to its blocked position 60B.

[0096] Advantageously, in all embodiments, a pressure relief valve 34 arranged in the valve main line 30 may be present, as in Fig. 2C shown. By means of a pressure relief valve 34, a predefined air pressure can be set, with which the failure brake pressure pN is provided at the failure brake connection 22 in order to achieve a suitable braking effect for the vehicle during failure braking.

[0097] In embodiments, the additional fail-safe brake valve 60 is also controlled, in particular, via the control signal S1 together with the fail-safe brake valve 40. In particular, the additional fail-safe brake valve 60 is controlled together with the fail-safe brake valve 40 via the control line 412, in particular together with the fail-safe brake valve 40 by the control unit 410. A multiple arrangement of fail-safe brake valves 40, 60, in particular an arrangement with a fail-safe brake valve 40 and an additional fail-safe brake valve 60, has the advantage of redundancy in the event of a valve failure, in particular a mechanical or electrical valve failure, in one of the fail-safe brake valves 40, 60.If, for example, one of the fail-safe brake valves 40, 60 can no longer be controlled due to jamming or a defective magnetic part and can no longer be moved from the open position 40A, 60A to the locked position 40B, 60B, the vehicle would inadvertently be in a state of fail-safe braking BA caused by the fail-safe valve unit 1". This inadvertent state can be remedied and / or prevented by the additional, still functioning fail-safe brake valve.

[0098] In Fig. 2D A further preferred embodiment of a fail-safe valve unit 1‴ with a bistable valve 72 is shown. Advantageously, in all embodiments, a bistable valve 72 arranged in the valve main line 30 can be present, as in Fig. 2C shown.

[0099] The bistable valve 72 is connected, in particular via a further control line 460, in a signal- and / or power-carrying manner to a controller, in particular the control unit 410 or a further control unit 420 or a still further control unit not shown here, and is controllable via a third control signal S3. The bistable valve 72 has the property that it is not directly affected by a fault FF because, due to its bistable nature, it remains in a previously switched position.

[0100] In contrast, the fail-safe brake valve 40 and the further fail-safe brake valve 60, due to their monostable behavior, have the property of falling back into a position in a de-energized state, in this case the open position 40A, 60A. In this way, according to the invention, in a case in which no control signal S1, S2 or the control signal S1, S2 is present as a zero signal at the fail-safe brake valve 40, in particular also at the further fail-safe brake valve 60, an automatic switching of the fail-safe brake valves 40, 60 to their open position 40A, 60A can be achieved. Such a case of a missing control signal S1, S2 or zero signal occurs in particular in the event of an exception error FA or power failure FS in the control units 410, 420.

[0101] When the bistable valve 72 is in its second position 72B, this is particularly suitable for automatic, in particular autonomous, driving operation of the vehicle 200, because in this case, a pneumatic connection is established between a first and second bistable valve connection 72.1, 72.2, and in this way—in the event of the fail-safe brake valves 40, 60 falling back into their open position 40A, 60A—a fail-safe brake pressure pN is provided at the fail-safe brake connection 22 for the purpose of braking the vehicle 200. In automatic, in particular autonomous, driving operation, the vehicle 200 can be controlled, for example, by an automatic operation control unit 464, which is signal-conductingly connected to the vehicle data bus 462.

[0102] When the bistable valve 72 is in its first position 72A, this is particularly suitable for manual driving of the vehicle 200. In this case, blocking the valve main line 30 prevents a failure braking from being carried out in the event of a fault FF, in particular in the event of a double fault FD, by providing a failure braking pressure pN at the failure braking connection 22.

[0103] In Fig. 2E A further preferred embodiment of a fail-safe valve unit 1"" with a pressure sensor 84 is shown. The pressure sensor 84 is arranged at the fail-safe brake connection 22 and is designed to measure the provided fail-safe brake pressure pN. Using a pressure sensor 84, the pressure response and thus the functioning of the fail-safe valve unit 1 can advantageously be checked for plausibility and / or verified.

[0104] In all embodiments, a fail-safe relay valve 80 can also be provided. The fail-safe relay valve 80 has a fail-safe control port 80.1, a fail-safe supply port 80.2, a fail-safe working port 80.3, and a fail-safe vent port 80.4. The fail-safe supply port 80.2 is pneumatically connected to the main port 20. The fail-safe control port 80.1 is connected to the main valve line 30 such that the main valve line, including all fail-safe brake valves 40, 60, and any bistable valves 72, form the control line of the fail-safe relay valve 80. The fail-safe working port 80.3 is pneumatically connected to the fail-safe brake port 22. The fail-safe relay valve 80 increases the air flow, which is why the air volumes to be switched by the fail-safe brake valves and, if applicable, by the bistable valve are advantageously lower, and consequently these valves can be smaller and / or are subject to less stress.

[0105] Fig. 3 shows an electronically controllable pneumatic braking system 204 with a fail-safe valve unit 1 for a fail-safe braking function FN according to the invention. The electronically controllable pneumatic braking system 204 is used in a vehicle 200 designed as a commercial vehicle 202, which is shown highly schematically here, in particular with an indicated front axle 210 and an indicated rear axle 220.

[0106] The electronically controllable pneumatic braking system 204 is controlled by a control unit 410. The control unit 410 is electrically connected to a power supply 416 via a supply line 414. The control unit 410 is electrically connected to a brake value sensor 436 for receiving brake signals via a brake value sensor control line 484. The control unit 410 is further configured to control a front axle modulator 434 via an electrically signal-carrying front axle modulator control line 486 as a function of the brake signals or as a function of any driving programs of an automatic mode control unit 464 in an automatic driving mode. In particular, an electrical or electronic brake request AB to the axle modulator 432 can be triggered via the front axle modulator control line 486. An electronic brake request AB can be formed, in particular, by a CAN and / or XBR command.The front axle modulator 434 is configured, depending on this actuation, to supply a pneumatic front axle brake circuit 512 of a service brake system 510 of the electronically controllable pneumatic brake system 204 with compressed air from a further compressed air reservoir 452 in order to actuate at least one service brake cylinder 440 assigned to a front wheel 212 to execute a service brake BB. The control unit 410 is further configured to actuate a service brake chamber 444 of at least one parking brake cylinder 442 assigned to a rear wheel 222 via a pneumatic rear axle brake circuit 514 via a pneumatic actuation. The control unit 410 is electrically connected to a rear axle modulator 438 via a rear axle modulator control line 488.The compressed air for the pneumatic rear axle brake circuit 514 is provided by a further compressed air supply 450 and is directed to the service brake chambers 444 via the rear axle modulator 438 when controlled by the control unit 410. The control unit 410 is thus configured to brake both the front wheels 212 and the rear wheels 222 of the vehicle 204. The front axle modulator control line 486 and / or the rear axle modulator control line 488 are configured, in particular, as vehicle data bus lines, in particular CAN lines.

[0107] The braking system 204 has a parking brake function FFS with a parking brake module 480. The parking brake function FFS is preferably implemented by means of a parking brake system 520 and / or the parking brake module 480. A parking brake function FFS can be used to control a parking brake pressure pFS for ventilating parking brake cylinders 442. Accordingly, the parking brake function FFS preferably comprises a parking brake module 480. The parking brake module 480 of the braking system 204 is designed to actuate a parking brake chamber 446 of one of the two parking brake cylinders 442, each assigned to the rear wheel 222, via a pneumatic rear axle brake circuit 522 of the parking brake system 520, in particular via a pneumatic parking brake line 496, by means of a controlled parking brake pressure pFS. The parking brake module 480 is electrically connected to a parking brake control element 482.The pneumatic rear axle brake circuit 522 of the parking brake system 520 can thus be activated and deactivated via the parking brake control element 482. The parking brake module 480 is pneumatically connected to the compressed air supply 454 via a supply line 448 for the purpose of supplying compressed air.

[0108] The rear axle modulator 438 is connected to the control unit 410 via the rear axle modulator control line 488. The compressed air for the parking brake system 520 is provided by a compressed air supply 454.

[0109] The brake signal transmitter 436 is pneumatically connected to a pneumatic control port 434.1, in particular a redundancy port 618, of the front axle modulator 434 via a pneumatic front axle modulator control line 492 in order to control the pneumatic front axle brake circuit 512. The front axle modulator 434 is particularly designed to control a brake pressure to the service brake cylinders 440 when pneumatic pressure is applied via the front axle modulator control line 492. The brake signal transmitter 436 is pneumatically connected to the rear axle modulator 438 via a pneumatic rear axle modulator control line 494—in a manner analogous to the front axle modulator 434—in order to control the pneumatic rear axle brake circuit 514. The rear axle modulator 438 is particularly designed to control a brake pressure to the service brake chambers 444 when pneumatic pressure is applied via the pneumatic rear axle modulator control line 494.In particular, the front axle modulator 434 and / or the rear axle modulator 438 have a relay valve 602 for controlling a brake pressure.

[0110] The main connection 20 of the fail-safe valve unit 1 is pneumatically connected to the parking brake module 480 and the pneumatic rear axle brake circuit 522 of the parking brake system 520 via the pneumatic parking brake line 496. A further selection valve 56 is advantageously arranged in the pneumatic front axle modulator control line 492 for pneumatically connecting the fail-safe brake connection 22 to a control input of the front axle modulator 434.

[0111] The fail-safe brake valve 40 is connected to the control unit 410 via a control line 412 for signal and power transmission. The vehicle 200 can have a further pressure control device 489, here in the form of a trailer control module 490 for pneumatically supplying a trailer of the vehicle 200 (not shown here).

[0112] When a fail-safe brake pressure pN is provided at the fail-safe brake connection 22, the fail-safe brake pressure pN is applied to the front axle modulator 434, causing the front axle modulator 434 to pneumatically actuate two service brake cylinders 440, each assigned to the front axle 210. The service brake cylinders 440 are thus actuated by applying the fail-safe brake pressure pN to the front axle modulator 434, thereby achieving a fail-safe braking BA of the front axle 210 and thus of the vehicle 200. The fail-safe valve unit 1 is arranged in a separate control branch 430 of the electronically controllable pneumatic brake system 204, which is provided independently of the regular control of the service brake cylinders 440, in particular via a brake value transmitter 436.Nevertheless, within the scope of the invention, it is also possible to provide a fail-safe brake pressure pN directly to at least one service brake cylinder 440, or for another brake cylinder, for example, to the service brake chamber 444 of the parking brake cylinder 442 assigned to the rear wheels 222. In particular, the compressed air supply 454, which supplies the parking brake module 480, is separate from another compressed air supply 452, which, during normal operation, provides compressed air for the service brake cylinder 440 in order to increase the independence of the fail-safe valve unit 1 and thus advantageously provide a redundant fail-safe brake functionality.

[0113] Fig. 4shows a pneumatic circuit diagram of an axle modulator 432, in particular a front axle modulator 434. The axle modulator 432 has a relay valve 602, which can be pressurized with a control pressure via a control line 604 and a valve control connection 602.1 in order to control a working pressure at a working connection 602.3. Compressed air is supplied to the relay valve 602 via a supply connection 602.2, in particular from another compressed air supply 452. The working connection 602.3 is connected, in particular pneumatically, via a working line 606 to the service brake cylinders 440 of the front axle 210. The control line 604 has an electrical control branch 614 with a first control valve 620 and a second control valve 622, which is designed to ventilate and / or vent the valve control connection 602.1.The electrical control branch 614 with the control valves 620, 622 can be controlled in particular by the control unit 410 and / or the primary system B1, in particular via the front axle modulator control line 486. The control line 604 has a pneumatic control branch 616 with a backup valve 630. The valve control connection 602.1 is pneumatically connected to a control connection 434.1 via the pneumatic control branch 616. The control connection 434.1 is designed in particular as a redundancy connection 618 of the front axle modulator 434. The backup valve 630 is designed in particular as a 2 / 2-way valve and monostable, normally opening, in order to open FF in the event of a fault if there is no control, and to enable pneumatic control via the pneumatic control branch 616. The control valves 620, 622 of the electrical control branch 614 are designed in particular as 2 / 2-way valves and monostable normally closing.The axle modulator 432 has an axle modulator pressure sensor 82, which is arranged here in the working line 606 for measuring the working pressure pA.

[0114] Advantageously, the front axle modulator 434 has a throttle 610, in particular a jet bore 612, which pneumatically connects the working line 606 to the control line 604. The throttle 610 has a reduced nominal diameter compared to the control line 604 and / or the working line 606.

[0115] The throttle 610 is arranged in particular in a relay piston of the relay valve 602, in particular as a vent hole 612 in the relay piston. By means of a throttle, it can advantageously be ensured that—regardless of a possibly available bleed-back function and / or leaks or a pressure loss in the front axle brake circuit—the parking brake is automatically vented, thus permanently ensuring a safe condition of the vehicle even when the vehicle is stationary. By means of such a throttle, the engagement of the parking brake cylinders 442 can advantageously be ensured even in the event of a leak in a working line 606 or a part pneumatically connected to the working line 606.By means of such a throttle, a pneumatic connection is created between the working pressure-carrying part of the axle modulator 432, in particular the working line 606, and the control pressure-carrying part of the axle modulator 432, in particular the control line 604. A leak in a part 605 carrying a working pressure pA thus leads to a pressure drop in a part 603 carrying a control pressure pS, and in this case, due to the pneumatic connection of the control pressure-carrying part to the fail-safe valve unit according to the invention, to the engagement of the parking brake. In particular, the throttle is provided in a relay piston of the relay valve 602 of the axle modulator 432.

[0116] The information provided here for the front axle modulator 434 may equally apply to another axle modulator 432, for example a rear axle modulator 438, in other embodiments of the invention. List of reference symbols (part of the description)

[0117] 1, 1', 1", 1‴, 1""Fail-safe valve unit 20Main connection 22Fail-safe brake connection 30Valve main line 34Pressure relief valve 40Monostable fail-safe brake valve 40.1First valve connection of the fail-safe brake valve 40.2Second valve connection of the fail-safe brake valve 40.3Vent connection of the fail-safe brake valve 40.4First solenoid, solenoid of the fail-safe brake valve 40AOpen position of the fail-safe brake valve, open position 40BBlocking position of the fail-safe brake valve, blocking position 41Return spring, return spring of the fail-safe brake valve 50Selector valve 50.1First connection of the selector valve 50.2Second connection of the selector valve 50.3Third connection of the selector valve 52Shuttle valve, Select-High shuttle valve 56Further selector valve 56.1First connection of the further selection valve 56.2second connection of the further selection valve 56.3third connection of the further selection valve 58further shuttle valve, further Select-High shuttle valve 60further monostableFailure brake valve 60.1 First valve connection of the additional failure brake valve 60.2 Second valve connection of the additional failure brake valve 60.3 Vent connection of the additional failure brake valve 60.4 Additional solenoid, solenoid of the additional failure brake valve 60A Open position of the additional failure brake valve, additional open position 60B Blocked position of the additional failure brake valve, additional blocking position 61 Additional return spring, return spring of the additional failure brake valve 70 Bistable valve unit 72 Bistable valve 72.1 First bistable valve connection 72.2 Second bistable valve connection 72.3 Vent of the bistable valve 72A First position of the bistable valve 72B Second position of the bistable valve 80 Failure relay valve 80.1 Failure control connection 80.2 Failure supply connection 80.3 Failure working connection 80.4Failure vent connection 82Axle modulator pressure sensor 84Pressure sensor 200Vehicle 202Commercial vehicle 204Brake system, electronically controllable pneumatic brake system210 Front axle 220 Rear axle 410 Control unit 412 Control line 412 Alternative control line 414 Supply line 416 Power supply 418 External control unit 419 Monitoring line 420 Additional control unit 422 Additional control line 422 Alternative additional control line 426 Additional power supply 430 Separate control branch 432 Axle modulator 434 Front axle modulator 436 Brake value sensor 438 Rear axle modulator 440 Service brake cylinder 442 Parking brake cylinder 444 Service brake chamber of the parking brake cylinder 446 Parking brake chamber of the parking brake cylinder 448 Supply line, parking brake system supply line 450 Additional compressed air supply 452 Additional compressed air supply 454 Compressed air supply 460Another control line, vehicle data bus line 462Vehicle data bus 464Automatic operation control unit 480Parking brake module 482Parking brake control element 484Electrical brake signal transmitter control line 486Electrical front axle modulator control line 488ElectricalRear axle modulator control line 489 Pressure control device 490 Trailer control module 492 Pneumatic front axle modulator control line 494 Pneumatic rear axle modulator control line 496 Pneumatic parking brake line 510 Service brake system 512 Pneumatic front axle brake circuit of the service brake system 514 Pneumatic rear axle brake circuit of the service brake system 516 Redundancy circuit of the service brake system 520 Parking brake system 522 Pneumatic rear axle brake circuit of the parking brake system 524 Bypass supply branch of the parking brake system 602 Relay valve 602.1 Valve control connection of the relay valve 602.2 Supply connection of the relay valve 602.3 Working connection of the relay valve 603 Control pressure carrying part 604 Control line 605 Working pressure carrying part 606 Working line 610 Throttle 612 Nozzle hole 614 Electrical control branch 616 Pneumatic control branch 618 Redundancy connection 620 First control valve 622 Second control valve 630 Backup valve ABBraking request ADDiagnostic sequence B1Primary system B2First fallback level BAFailure braking BBService braking FAException error FDDouble fault FFError case FFSParking brake function FNFailure braking function FSPower failure FTDiagnostic case p1First pressure p2Second pressure pAWorking pressure pBBelimiting pressure pESetting pressure pFSParking brake pressure pFS'Pressure derived from the parking brake pressure pNFailure brake pressure pSControl pressure pWVFurther supply pressure S1First control signal S2Second control signal S3Third control signal SRFlow direction

Claims

1. Failure safety valve unit (1) for a failure brake function (FN) of an electronically controllable pneumatic brake system (204) for a vehicle (200), in particular a commercial vehicle (202), the brake system (204) comprising at least one control unit (410), and the failure safety valve unit (1) comprising: - a main connection (20) which provides a first pressure (p1), and a failure brake connection (22), - a failure brake valve (40) designed as a monostable valve, which is controllable by the control unit (410) or by an external control unit (418), and is designed - to pneumatically connect the main connection (20) and the failure brake connection (22) in an open position (40A) in order to control a failure brake pressure (pN) at the failure brake connection (22), characterized in that - in the event of a fault (FF) and / or a power failure (FS) and / or a diagnostic case (FT) of the control unit (410), the failure brake valve (40) is in the open position (40A), and in that - failure braking (BA) of the vehicle (200) is triggered via the provision of the failure brake pressure (pN) at the failure brake connection (22) by the brake system (204), - the main connection (20) being pneumatically connected to a parking brake function (FFS) in order to receive a controlled parking brake pressure (pFS) as the first pressure (p1).

2. Failure safety valve unit (1) according to claim 1, characterized in that - the failure safety valve unit (1) comprises a selection valve (50) having a first connection (50.1), which is pneumatically connected to the parking brake function (FFS) in order to receive the first pressure (p1), - having a second connection (50.2), which is pneumatically connected to a further compressed air supply (450, 452) in order to receive a further supply pressure (pWV) as a second pressure (p2), and - having a third connection (50.3), which is pneumatically connected to the failure brake valve (40), - the selection valve (50) being designed to pneumatically connect whichever of the first and the second connection (50.1, 50.2) at which the higher pressure (p1, p2) is present to the third connection (50.3).

3. Failure safety valve unit (1) according to either of the preceding claims, characterized in that - the failure brake pressure (pN) is provided as a control pressure (pS) for an axle modulator (432, 434, 438), or - the failure brake pressure (pN) is provided as a brake pressure (pA) for a brake cylinder (440).

4. Failure safety valve unit (1) according to any of the preceding claims, characterized by - a further failure brake valve (60) which is pneumatically connected in series to the failure brake valve (40) and is controllable by a control unit (410, 420), in particular by a further control unit (420) or an external control unit (418), and - the further failure brake valve (60) being open in an open position (60A) in the non-actuated state, in particular in the currentless state, such that the first pressure (p1) present at the main connection (20) is provided as a failure brake pressure (pN) at the failure brake connection (22).

5. Failure safety valve unit (1) according to claim 4, characterized in that - the further failure brake valve (60) is designed as a 2 / 2-way valve (62), in particular as a 2 / 2-way solenoid valve (64).

6. Failure safety valve unit (1) according to any of the preceding claims, characterized in that - the failure brake valve (40) and / or the further failure brake valve (60) is designed as a 3 / 2-way valve (42, 66), in particular as a 3 / 2-way solenoid valve (44, 68).

7. Failure safety valve unit (1) according to any of the preceding claims, characterized by a pressure-limiting valve (34).

8. Failure safety valve unit (1) according to any of the preceding claims, characterized by - a bistable valve (72) designed to switch between a first deactivation position (72A), which blocks the valve main line (30) or connects it to a vent (72.3), and a second activation position (72B), which connects the valve main line (30), the bistable valve (72) being pneumatically connected in series to the at least one failure brake valve (40, 60).

9. Failure safety valve unit (1) according to any of the preceding claims, characterized by - a further selection valve (56) comprising a first further connection (56.1) which is pneumatically connected to a brake value transmitter (436), in particular to a pneumatic front axle modulator control line (492), in order to receive the brake value transmitter pressure (pGB), - comprising a second further connection (56.2) which is pneumatically connected to the failure brake connection (22) in order to receive the failure brake pressure (pN), and - comprising a third further connection (56.3) which is pneumatically connected to a service brake cylinder (440) or to an axle modulator (432), - the further selection valve (56) being designed to pneumatically connect whichever of the first and the second further connection (56.1, 56.2) at which the higher pressure (pGB, pN) is present to the third further connection (56.3).

10. Electronically controllable pneumatic brake system (204) for a vehicle (200), in particular a commercial vehicle (202), which brake system comprises a control unit (410), characterized by - a failure safety valve unit (1) according to any of the preceding claims, - the failure safety valve unit (1) being arranged in a separate actuation branch (430) and - being pneumatically connectable via a failure brake connection (22) to at least one service brake cylinder (440) and / or a service brake chamber (444) and / or an axle modulator (434, 438) in order to provide a failure brake pressure (pN) for an axle modulator (434) to trigger failure braking (BA) of the vehicle (200).

11. Electronically controllable pneumatic brake system (204) according to claim 10, characterized by - an axle modulator (434, 438) comprising a throttle (610), in particular a jet bore (612), which pneumatically connects a part (603) of the axle modulator (434) that carries a control pressure (pS) to a part (605) of the axle modulator (434) that carries a working pressure (pA).

12. Electronically controllable pneumatic brake system (204) according to claim 10 or claim 11, characterized in that - the control unit (410) is assigned to a primary system (B1) of the electronically controllable pneumatic brake system (204), and the electronically controllable pneumatic brake system (204) further comprises: - a further control unit (420) for a first fallback level (B2), - the failure brake valve (40) being actuatable by the control unit (410) and the further failure brake valve (60) being actuatable by the further control unit (420), and - the first control unit (410) and the second control unit (420) supplied with energy independently of one another and / or being able to at least partially replace one another in function.

13. Vehicle (200), in particular a commercial vehicle (202), comprising a brake system (204) according to any of claims 10 to 12.

14. Method for operating a brake system (204) comprising a failure safety valve unit (1), in particular according to any of claims 1 to 9, for a failure brake function (FN) of an electronically controllable pneumatic brake system (204), in particular according to any of claims 10 to 12, for a vehicle (200), or a commercial vehicle (202), in particular according to claim 13, characterized by the steps of: - providing, via a control unit (410, 420) or an external control unit (418), a signal (S1, S2) for locking out a failure brake pressure (pN) which is effective for failure braking (BA), - interrupting the provision of the signal (S1, S2) in the event of a fault (FF) and / or a power failure (FS) and / or a diagnostic case (FT) of the control unit (410, 420), thereby automatically ending the locking out of the failure brake pressure (pN) in order to trigger failure braking (BA) of the vehicle (200), - the failure brake pressure (pN) being a parking brake pressure (pFS) controlled by a parking brake function (FFS) for ventilating parking brake cylinders (442).

15. Method according to claim 14, characterized by a diagnostic sequence (AD) comprising the step of: - determining the failure brake pressure (pN), in particular by means of a pressure sensor (84), at the failure brake connection (22), - pressure control in the service brake system (510), in particular a braking request (AB) to an axle modulator (432), being requested prior to the interruption of the provision of the signal (S1, S2).

16. Method according to claim 15, characterized in that - the failure safety valve unit (1) is supplied with energy pneumatically by a brake circuit (514, 522) which is independent of the brake circuit (512) of the service brake system (510) that carries out the failure braking (BA).

17. Method according to claim 15 or claim 16, characterized in that - the failure safety valve unit (1) is supplied with energy pneumatically by a pressure supply (450, 452) which is independent of a pressure supply (454) of the brake circuit (512) of the service brake system (510) that carries out the failure braking (BA).

18. Method according to any of claims 15 to 17, characterized in that - the diagnostic sequence (AD) is carried out during service braking (BB) of the service brake system (510), in particular during an existing braking request (AB), or - the diagnostic sequence (AD) is carried out during a standstill of the vehicle (200), in particular a braking request (AB), in particular from an external control unit (418) and / or an automatic operating control unit (464), being generated.

19. Method according to any of claims 15 to 18, characterized in that - the braking request (AB) is provided by a brake value transmitter (436) and / or an external control unit (418) and / or an automatic operating control unit (464), in particular the braking request (AB) being provided via a vehicle data bus (462) and / or the braking request (AB) being in the form of a CAN signal, in particular in the form of an XBR signal.

20. Method according to any of claims 15 to 19, characterized by the steps of: - providing a signal (S1, S2, S3) for an individual valve (40, 60, 70, 72), in particular for an individual failure brake valve (40, 60) or an individual bistable valve (72), - determining the failure brake pressure (pN), in particular plausibility checking the pressure reaction for the individual valve (40, 60, 70).