ELECTROPNEUMATIC UNIT WITH INTEGRATED FAIL-SAFE VALVE ARRANGEMENT FOR MULTIPLE FAULTS, ELECTRONICALLY CONTROLLED PNEUMATIC BRAKE SYSTEM, AND METHOD FOR OPERATING A BRAKE SYSTEM

Description

[0001] The invention relates to an electropneumatic unit for an electronically controllable pneumatic braking system for a vehicle, in particular a commercial vehicle, comprising a supply connection for receiving a supply pressure from at least one first compressed air supply and at least one first redundant brake pressure connection for providing a first redundant brake pressure for a first axle of the vehicle and / or a trailer of the vehicle. The invention further relates to an electronically controllable pneumatic braking system for a vehicle, in particular a commercial vehicle, comprising such an electropneumatic unit and a method for operating an electronically controllable pneumatic braking system.

[0002] In electronically controllable pneumatic braking systems used in semi-autonomous or autonomous vehicles (particularly SAE Levels 2 to 5), fallback systems must be implemented in the event of a fault to prevent an unsafe vehicle condition. Especially with higher levels of automation, a driver cannot intervene immediately or a driver is not even present in the vehicle. In this case, it must be ensured that an unsafe vehicle condition can be avoided even in the event of serious single or double faults, and that either a fail-operational or fail-safe condition can be achieved.

[0003] A system specifically aimed at achieving high residual availability is known, for example, from DE 10 2014 013 756 B3. This discloses an electrical system for a vehicle with an at least partially electric braking and steering device, which comprises: an electric or electromechanical steering device connected to a steering gear and comprising an electronic steering control device and an electric steering actuator, and a service brake device.DE 10 2014 013 756 B3 proposes an electropneumatic service brake device as a service brake device, which comprises an electropneumatic service brake valve device, an electronic brake control device, electropneumatic modulators, and pneumatic wheel brake actuators. The electronic brake control device electrically controls the electropneumatic modulators to generate pneumatic brake pressures or brake control pressures for the pneumatic wheel brake actuators on a wheel-by-wheel, axle-by-axle, or side-by-side basis. The electropneumatic service brake valve device has a service brake actuating element and, within an electrical service brake circuit, an electrical channel with an electrical brake value transmitter actuated by the service brake actuating element.Furthermore, an electronic evaluation device is provided which receives the actuation signals and feeds brake request signals into the electronic brake control device depending on the actuation signals, and comprises at least one pneumatic channel within at least one pneumatic service brake circuit, in which at least one control piston of the service brake valve device is loaded with a first actuation force by actuating the service brake actuating member due to a driver brake request, and the control piston, in response thereto, allows pneumatic brake pressures or brake control pressures to be generated for the pneumatic wheel brake actuators.The electronic evaluation device of the electropneumatic service brake valve device further comprises electronic control means for generating a second actuating force, independent of a driver brake request, which, when a brake request is present that is independent of the driver's intention, acts on the control piston in the same direction or opposite to the first actuating force. The electropneumatic service brake device is powered by an electrical energy source that is independent of a second electrical energy source that supplies the electropneumatic service brake valve device with electrical energy. This ensures that at least one of the two systems functions as always as possible. The electric or electropneumatic steering device is supplied with energy from the second electrical energy source. This is intended to achieve a high residual availability.However, the system is complex and cannot be easily implemented in every commercial vehicle.

[0004] A system that provides electronically pneumatically controlled redundancy is disclosed in DE 10 2016 005 318 A1. The system disclosed therein uses a bypass valve to forward control pressures depending on the failure of a subsystem, thus at least pneumatically supplying the circuit that has failed electrically. This also increases the residual availability. Similar systems are disclosed in DE 10 2016 010 462 A1 and DE 10 2016 010 464 A1.

[0005] Furthermore, DE 10 2016 010 463 A1 discloses a system and method in which pilot valves are electronically controlled via a redundancy signal if a failure or defect is detected in the electronic control of wheel brakes of the braking system. The system attempts to prevent wheels from locking.

[0006] DE 10 2017 002 716, DE 10 2017 002 718, DE 10 2017 002 719, and DE 10 2017 002 721 disclose systems in which pneumatic redundancy is generated. Various controlled brake pressures, such as front axle, rear axle, or trailer brake pressures, are used to provide these as redundancy pressure to failed systems, such as the front axle brake circuit, rear axle brake circuit, parking brake circuit, or trailer brake circuit. This creates a subordinate pneumatic redundancy level, thus also achieving a high level of residual availability.

[0007] In addition, there are also systems that include the trailer, as disclosed, for example, in DE 10 2016 010 461 A1.

[0008] DE 10 2019 106 274 A1 further discloses an electronically controllable braking system with two fallback levels. The electronically controllable braking system of the embodiment disclosed therein comprises a service braking system with a front axle brake circuit having a front axle modulator, a rear axle brake circuit, and a central control module. In this case, the central control module simultaneously acts as a rear axle modulator and directly controls rear axle brake pressures on at least one rear axle of the commercial vehicle. The central control module also provides signals to the front axle modulator to cause it to control corresponding front axle service brake pressures on the front axle.The braking system also includes a parking brake circuit with a parking brake module designed to process a braking command in the event of a defect in the central control module and to apply a rear axle redundancy brake pressure to spring-loaded components on the rear axle for redundant implementation of the braking command. In this first redundancy level, the front axle is pneumatically controlled via a redundancy brake pressure, which is controlled by the parking brake module. This pneumatic control pressure is then implemented at the front axle modulator, thus allowing the front axle brake pressure to be applied to the front axle. The redundancy pressure is fed into a pressure path into which a pneumatic brake value sensor (foot brake pedal) can also feed pneumatic brake pressure.In the event that the parking brake module also develops a defect, the second fallback level is defined as the front axle modulator being able to implement the braking command and accordingly providing a backup pressure to the parking brake module, thus enabling pneumatic implementation of the backup pressure at the rear axle. The braking system disclosed here thus has an operating level as well as a first and second fallback level. This is intended to enable fail-operational operation.

[0009] Another system is known from DE 10 2019 106 591 A1. The system disclosed therein also has two fallback levels. The braking system disclosed therein comprises a further duplication of elements and, in particular, in addition to a front axle modulator, also has a redundant front axle modulator active in the fallback level, as well as a redundant rear axle modulator active in the fallback level. These are controlled by a redundant brake control module, which can partially or completely replace the service brake control module. A further fallback level can then be reached via the parking brake. Such a system enables largely fail-safe operation, but uses a large number of components and therefore requires increased assembly and space.

[0010] Other electropneumatic units are known from CN111867905A, US2015 / 239441A1.

[0011] In addition to systems with two functional fallback levels that allow fail-operational operation in both a first and a second fallback level, there is also a need for systems that, in addition to a first fallback level, only allow fail-safe operation in a second (or further) fallback level, thus enabling unbraked coasting in the event of a double fault in which both a service brake system and a redundant brake system are not functioning or are not functioning properly.

[0012] One object of the present invention is therefore to provide an electropneumatic unit of the type mentioned above that enables safe braking and stopping of the vehicle in a cost- and space-optimized manner, even if redundant systems, subsystems, or levels of the braking system have failed. For example, if a braking system is supplied via multiple voltage sources, in the worst case scenario, all voltage sources may fail. Even in this case, the aim is to ensure in a simple manner that the vehicle can be decelerated safely.

[0013] The invention solves the problem with an electropneumatic assembly of the type mentioned at the outset in that the assembly has a failure supply connection for receiving a failure supply pressure which is limited with respect to the supply pressure and lower than the latter, and by a fail-safe valve arrangement connected to the failure supply connection and the redundancy brake pressure connection or at least one first redundancy control connection, which fail-safe valve arrangement has at least one first failure brake valve designed as a monostable valve which can be switched in the event of a fault in order to control the first redundancy brake pressure at the first redundancy brake pressure connection or at least one first redundancy control pressure at the first redundancy control connection based on the failure supply pressure.The invention is based on the finding that safe braking and stopping of the vehicle can be achieved by using a backup supply pressure, which is limited compared to and lower than the reservoir pressure, to directly or indirectly control a redundancy brake pressure at the first redundancy brake pressure connection. A permanent pressure is therefore present at the backup supply connection, in particular a pressure that is available when the vehicle is moving or in a moving vehicle state. The backup supply pressure can preferably originate from the first compressed air supply, a further compressed air supply of the electronically controllable pneumatic brake system, or from a spring-loaded brake cylinder present on one or more axles.

[0014] On the one hand, the fail-safe valve arrangement can be connected directly to the redundancy connection, optionally with the interposition of one or more valves, so that the pressure controlled by the fail-safe valve arrangement is provided as the first redundancy brake pressure at the first redundancy brake pressure connection. Alternatively, the fail-safe valve arrangement can also provide only a first redundancy control pressure, which is then controlled at another, preferably volume-boosting, valve, such as a relay valve or pneumatically switchable valve. In this case, the first redundancy control pressure then causes the first redundancy brake pressure to be controlled by the other valve, such as the relay valve.

[0015] In one embodiment, however, the fail-safe valve arrangement may also comprise such a volume-enhancing valve, preferably a relay valve.

[0016] The electropneumatic assembly can be an electropneumatic module of the electronically controllable pneumatic braking system that is already present, such as a central module of the operating level and / or the redundancy level, a front and / or rear axle modulator, a parking brake modulator, or a trailer control valve. However, the electropneumatic assembly can also be part of such a modulator or be partially or fully integrated with it. In this case, it may be sufficient to provide an existing electropneumatic module with a fail-safe supply connection and a fail-safe valve arrangement to implement the electropneumatic assembly according to the present invention. The electropneumatic assembly is supplied with supply pressure via the supply connection in order to control pressures during operation and / or a first fallback level.The backup supply pressure provided at the backup supply connection is then preferably used only in a second or further fallback level, in order to then control the redundancy brake pressure at the first redundancy brake pressure connection in this fallback level and thus brake the vehicle. It can be provided that a redundancy pressure is controlled at the redundancy brake pressure connection in the first fallback level of the electronically controllable pneumatic braking system, which redundancy pressure is controlled using the supply pressure received from the supply connection.

[0017] In a preferred development, the first fail-over brake valve is a 3 / 2-way valve with a first fail-over brake valve connection receiving the fail-over supply pressure, a second fail-over brake valve connection controlling the first redundancy brake pressure or an associated redundancy control pressure, and a third fail-over brake valve connection connected to a vent. In a non-activated switching position, the first fail-over brake valve connection is connected to the second fail-over brake valve connection, and in an activated switching position, the second fail-over brake valve connection is connected to the third fail-over brake valve connection. The first fail-over brake valve connection can be connected to the fail-over supply connection, or one or more further valves can be arranged between it and the fail-over supply connection.The second failover brake valve connection is preferably connected directly or indirectly to the first redundancy brake pressure connection. The pressure delivered by the second failover brake valve connection can be provided directly as redundancy brake pressure or initially as redundancy control pressure, which is then volume-amplified by another valve unit and delivered to the redundancy brake pressure connection. The third failover brake valve connection is connected to a vent, which is in particular a central vent of the electropneumatic unit or the electropneumatic module of which the electropneumatic unit is a part. As long as the first failover brake valve is energized, the second failover brake valve connection is connected to the third failover brake valve connection, so that the second failover brake valve connection is always vented and therefore no pressure is delivered to it.Only when the first fail-over brake valve is switched to a non-activated state because it is no longer supplied with power, for example because a fault has occurred in a control unit controlling it, is the first fail-over brake valve connection connected to the second fail-over brake valve connection so that the fail-over supply pressure can be controlled and output as redundancy pressure or redundancy control pressure.

[0018] Preferably, a pressure limiter is connected upstream of the backup supply connection, or the electropneumatic assembly comprises a pressure limiter for limiting the pressure received at the backup supply connection. The backup supply pressure should be limited and lower than the reservoir pressure. For example, the reservoir pressure in typical brake systems can be between 8 bar and 12 bar. The backup supply pressure is preferably limited to a range between approximately 2 bar and 8 bar. The precise limitation of the backup supply pressure may depend on certain permissible friction values, for example, the vehicle weight, the type of brake actuators, or the vehicle's loading condition. The axle load may also play a role.Since the backup supply pressure is used directly to control the redundant brake pressure, it should be limited so as to prevent immediate locking of one or more axles of the vehicle. Nevertheless, it should be sufficiently high to enable safe braking. For example, it is conceivable that a higher backup supply pressure is permitted at low vehicle speeds, since at low speeds the locking of one or more axles does not immediately lead to vehicle instability. At higher speeds, however, the backup supply pressure could be further limited to reliably prevent one or more axles from locking. The pressure limiter serves precisely this purpose. However, a pressure limiter can also be omitted if the source from which the backup supply pressure originates is already pressure-limited.For example, if the backup supply pressure is provided by a spring brake cylinder, the pressure may already be limited. This is the case, for example, if the pressure of a spring brake cylinder is limited to approximately 8 bar, but the brake system's reservoir pressure is 12 bar. In this case, it may be advantageous not to provide an additional pressure limiter.

[0019] Integrating the pressure limiter into the electropneumatic unit has the advantage of reducing assembly effort. However, it can also be advantageous to position the pressure limiter in close proximity to the pressure source that provides the backup supply pressure. This allows for simpler piping.

[0020] In a preferred development, the fail-safe valve arrangement comprises an electromagnetic bistable valve which is pneumatically connected in series with the first fail-safe brake valve. Such a bistable valve is an electromagnetic solenoid valve with at least one first permanent magnet. The permanent magnet holds the bistable valve in a detent position even when deenergized. The bistable valve preferably further comprises a first coil. By energizing the first coil, an armature of the bistable valve, which preferably carries the permanent magnet, can be brought into the first detent position. By energizing the first coil in the opposite direction, the armature of the bistable valve can then be brought into a second magnetic detent position.The bistable valve preferably further comprises a second permanent magnet and / or a second coil, which are particularly preferably configured analogously to the first permanent magnet and / or the first coil. Thus, the bistable valve can preferably magnetically lock into two locking positions. If no other force acts on the armature or if the armature can be mechanically and / or magnetically locked in the locking position, the respective switching position is stable, as it can be maintained without further energization of the first and / or second coil.

[0021] The bistable valve preferably has a bistable valve port receiving the backup supply pressure, a second bistable valve port connected to the backup brake valve, and a third bistable valve port connected to a vent. The bistable valve is preferably connected in series with the first backup brake valve such that, in a first switching position of the bistable valve, control of the redundancy pressure or the redundancy control pressure is enabled by the first backup brake valve, and, in a second switching position of the bistable valve, control of the redundancy pressure or the redundancy control pressure is not possible by the first backup brake valve, regardless of its switching position. In In this second switching position of the bistable valve, the bistable valve preferably connects at least one connection to a vent. In This second switching position can be the bistable valve if the vehicle is in manual operation. If the vehicle is in manual operation, in which a driver can specify a brake pressure using a foot brake valve, a fallback level as described here with the control of the backup supply pressure is not desirable. The driver can always intervene and brake the vehicle purely pneumatically to a standstill. However, if the vehicle is in automated or partially automated operation, it is preferable to switch the bistable valve to the first switching position so that the redundancy pressure or redundancy control pressure can be controlled depending on the switching position of the first backup brake valve based on the received backup supply pressure.In this case, if a serious single or double fault occurs, the vehicle is immediately braked and brought to a safe standstill.

[0022] The electropneumatic unit preferably has a working valve arrangement that is connected to the supply connection and receives supply pressure therefrom. It is switchable to control the first redundancy brake pressure at the first redundancy brake pressure connection or to control a working pressure at a working connection of the electropneumatic unit. It also has an electronic control unit for controlling the working valve arrangement. The electronic control unit is part of the electropneumatic unit and is preferably designed as a module therewith. The working valve arrangement can be any working valve arrangement such as those used in electropneumatic modules in electropneumatic braking systems. For example, the working valve arrangement can be designed after an axle modulator.If the working valve arrangement controls the first redundant brake pressure at the first redundant brake pressure connection, the electropneumatic unit can be referred to as a redundant modulator and can be provided, for example, as a redundant front axle modulator, redundant rear axle modulator, or as a redundant module for providing redundant brake pressures for a front and / or rear axle and / or trailer control valve and / or parking brake unit. However, the working valve arrangement can also control a working pressure at a dedicated working connection of the electropneumatic unit. For example, the working valve arrangement can also be a valve arrangement for actuating a parking brake. In this case, the working connection could then be connected to a spring-loaded brake cylinder of a parking brake arrangement in order to ventilate it for driving the vehicle.

[0023] The electronic control unit of the electropneumatic assembly is preferably connected via a vehicle bus or other electrical wiring to preferably a central module of the electronically controllable pneumatic braking system and / or to a unit for autonomous driving. It can also be additionally or alternatively connected to an electronic steering system or other systems of the vehicle that can provide braking request signals.

[0024] In a preferred development, it is provided that the electronic control unit controls the first fail-safe brake valve. This is particularly preferred if the electronic control unit simultaneously controls a first or other upstream fallback level of the electronically controllable pneumatic brake system. If, for example, the electropneumatic unit forms a redundancy modulator or a redundancy unit that takes over operation of the electronically controllable pneumatic brake system in the event of a service brake system failing completely or partially, it is preferred that, in the event of this electronic control unit failing, the first fail-safe brake valve is de-energized and thus receives the fail-safe supply pressure and, based on this, controls the redundancy pressure or redundancy control pressure. It can also preferably be provided that the electronic control unit controls the bistable valve.However, the bistable valve can also be controlled by any other electronic control unit that has information about whether the vehicle is in autonomous or manual mode.

[0025] According to a further preferred development, the fail-safe valve arrangement comprises a second fail-safe valve designed as a monostable valve, which is pneumatically connected in series with the first fail-safe valve. The order of the first fail-safe valve, second fail-safe valve, and bistable valve is functionally irrelevant and can be chosen arbitrarily to ensure the simplest possible design.

[0026] The second failure brake valve is preferably controlled by a further electronic control unit. The further electronic control unit is different from the electronic control unit that controls the first failure brake valve and / or from the electronic control unit that controls the bistable valve and / or from the electronic control unit that controls the working valve arrangement. The further electronic control unit is preferably supplied by a further voltage source that is independent of the voltage source that supplies the electronic control unit. In this way, a further level of safety can be introduced. One of the failure brake valves is assigned to a control unit, namely the first failure brake valve of the electronic control unit and the second failure brake valve of the further electronic control unit.The first and second fail-over brake valves are thus each held in a locked state by different, mutually independent electronic control units when activated by a control signal, or in a state in which no redundant brake pressure can be applied. Preferably, the electronic control unit and the additional electronic control unit can at least partially replace each other's functions. This means that the additional electronic control unit can provide functions of the electronic control unit in a redundant manner, as a fallback level, or vice versa, should the first of the two fail.In the event of a multiple fault, i.e., a fault affecting multiple control units, and in particular, the electronic control unit and the additional electronic control unit, both the first failover brake valve and the second failover brake valve are de-energized, allowing the failover supply pressure to be controlled through them, provided any bistable valve also clears this path. The failover supply pressure can then be provided via the first and second failover brake valves as redundancy pressure or redundancy control pressure, respectively, to subsequently initiate vehicle braking.If both the electronic control unit and the additional electronic control unit fail and, as a result, a corresponding control signal is not provided or is not provided correctly to the first and second failover brake valves, these will each switch to their stable state and, as a result, the redundancy pressure or the redundancy control pressure will be released, allowing the vehicle to be braked. This aspect is based on the realization that in multiple subsystems of a braking system, each with independent electronic control units, a fault can advantageously manifest itself in the absence of a control signal for the respective failover brake valve assigned to the electronic control unit. This can be the case, for example, in the event of a power failure, i.e., if the power supply to the electronic control unit has failed.The electronic control unit can also be configured such that, in the event of an exception error, particularly a case in which the control logic can no longer ensure the safety of the vehicle, a zero signal is output as the control signal for the fail-safe brake valve, thus simulating the absence of the control signal. If this is the case, i.e., if an error occurs in both subsystems, particularly in the form of an exception error or power failure, the fail-safe valve arrangement according to this exemplary embodiment ensures safe deceleration of the vehicle by providing the redundancy pressure or redundancy control pressure.

[0027] In addition to the second fail-safe valve, third and further fail-safe valves of this type can also be connected in series. The described advantages and designs then apply equally.

[0028] The working valve arrangement preferably has at least a first electromagnetic pilot control unit and a first main valve unit, wherein the first pilot control unit is connected to the supply connection and, depending on first switching signals from the electronic control unit, controls a first working control pressure at the first main valve unit, wherein the first main valve unit is connected to the supply connection and, depending on the received first working control pressure, controls a first working brake pressure. The pilot control unit can, in a fundamentally known manner, have inlet and outlet valves, each of which can be designed as a 2 / 2-way valve. The pilot control unit can also have a 3 / 2-way valve or other combinations of 2 / 2-way and 3 / 2-way valves as the inlet-outlet valve unit.The main valve unit can comprise, in a known manner, a relay valve or a pneumatically switchable main valve or other valve combinations. The electromagnetic pilot control unit provides the first working control pressure, which the first main valve unit amplifies and then outputs as the working brake pressure.

[0029] In a preferred development, the working valve arrangement has a second electromagnetic pilot control unit and a second main valve unit, wherein the second pilot control unit is connected to the supply connection and, depending on second switching signals from the electronic control unit, controls a second working control pressure at the second main valve unit, wherein the second main valve unit is connected to the supply connection and, depending on the received second working control pressure, controls a second working brake pressure. The electropneumatic unit according to this exemplary embodiment can be referred to as a so-called two-channel modulator, since the electropneumatic unit according to this exemplary embodiment can control two independently generated working pressures, namely the first working brake pressure and the second working brake pressure.Such an electropneumatic unit, designed as a dual-channel modulator, can be used, for example, as a dual-channel axle modulator to provide brake pressure to the left and right wheels of an axle in a wheel-specific manner. However, it can also be installed longitudinally to control pressure for a first and a second axle, which is then modulated at the axle in a wheel-specific manner, for example, using ABS valves. In this respect, for example, the first working brake pressure can be provided to a front axle and the second working brake pressure to a rear axle. It can also preferably be provided that the first working brake pressure to a front axle and the second working brake pressure to a trailer control valve.Furthermore, what has already been described with reference to the first electromagnetic pilot control unit and the first main valve unit applies to the design of the second electromagnetic pilot control unit and the second main valve unit.

[0030] In a second aspect, the invention solves the problem mentioned at the outset in an electronically controllable pneumatic braking system of the type mentioned at the outset, which comprises a front axle modulator for providing a front axle service brake pressure to a first front axle service brake actuator and a second front axle service brake actuator on a front axle of the vehicle;and a rear axle modulator for providing a rear axle service brake pressure to at least a first rear axle service brake actuator and a second rear axle service brake actuator on a rear axle of the vehicle by an electropneumatic assembly according to one of the above-described preferred embodiments of an electropneumatic assembly according to the first aspect of the invention, wherein the first redundancy brake pressure connection is further connected to a front axle redundancy connection of the front axle modulator and / or a rear axle redundancy connection of the rear axle modulator in order to initiate redundant control of the front axle service brake pressure and / or rear axle service brake pressure.

[0031] It should be understood that the electronically controllable pneumatic braking system according to the second aspect of the invention and the electropneumatic assembly according to the first aspect of the invention have identical and similar sub-aspects as set forth in particular in the dependent claims. For preferred embodiments, advantages, and further technical features, reference is made to the above description of the first aspect of the invention.

[0032] In a preferred embodiment, the electronically controllable pneumatic braking system comprises a central control unit that provides front axle brake signals to the front axle modulator to initiate electronic control of the front axle service brake pressure, and provides rear axle brake signals to the rear axle modulator to initiate electronic control of the rear axle service brake pressure, wherein the central control unit controls the first fail-safe brake valve. The central control unit is preferably integrated with the rear axle modulator, so that the rear axle modulator is only a functional part of the central control unit. The central control unit is preferably the central control unit of a service brake system of the electronically controllable pneumatic braking system and controls the electronically controllable pneumatic braking system during operation.The central control unit can be connected to the front axle modulator, for example, via a bus connection, or can control the front axle modulator's electromagnetic valves through direct electrical wiring. Provision can be made for the front axle modulator to be supplied with supply pressure from the first compressed air supply and the rear axle modulator to be supplied with supply pressure from a second compressed air supply, or vice versa. In this embodiment, the electropneumatic unit is preferably not part of the central control unit, although this may be provided in certain embodiments.It can be provided that the central control unit is the electronic control unit that controls the fail-safe valve arrangement, that is to say in particular the first fail-safe brake valve, the optionally provided bistable valve and optionally also the second fail-safe brake valve, even if this is preferably controlled by another, namely in particular the further electronic control unit.

[0033] In a preferred development, the electropneumatic unit is a secondary brake module of the electronically controllable pneumatic braking system and is designed to initiate redundant control of the front axle service brake pressure and / or rear axle service brake pressure in the event that the central control unit is prevented from electronically controlling the front axle service brake pressure and / or rear axle service brake pressure. In this case, the electropneumatic unit also comprises the electronic control unit, which is then preferably connected to a unit for autonomous driving via a vehicle bus and receives brake request signals from this. The electronic control unit of the electropneumatic unit is in this case preferably designed to implement the brake request signals and toTo control rear axle service brake pressure redundantly, in particular as first and / or second redundancy brake pressure.

[0034] Only if, for example, the electronic control unit of the electropneumatic assembly experiences another error and cannot, or cannot correctly, redundantly control the front-axle service brake pressure or rear-axle service brake pressure is the first failover brake valve de-energized, thus controlling the redundant pressure based on the failover supply pressure. This creates two fallback levels in the braking system.An operating level is preferably represented by the central control unit, a first fallback level by the electropneumatic unit which forms the secondary brake module, and a second fallback level also by the electropneumatic unit, namely when the electronic control unit of the electropneumatic unit is de-energized and the first failure brake valve is de-energized and in this way the first redundancy brake pressure is controlled at the first redundancy brake pressure connection.According to a further preferred embodiment, the electronically controllable pneumatic braking system comprises a parking brake unit for providing a parking brake pressure to a first spring brake cylinder and a second spring brake cylinder on the rear axle of the vehicle, wherein the fail-safe supply connection is connected to the first spring brake cylinder and the second spring brake cylinder in order to receive the parking brake pressure therefrom as a fail-safe supply pressure. The further development includes the recognition that continuously maintaining the braked state of the vehicle is advantageous for the safety of the vehicle. After a fail-safe braking operation using the fail-safe brake valve, a leak may occur in the brake circuit from which the fail-safe supply pressure originates.If, for example, the backup supply pressure comes from the first compressed air supply, it can happen over time that the first compressed air supply runs dry because of a leak. In this case, the backup supply pressure would then drop again and this would result in the redundancy brake pressure no longer being applied at full or sufficient level, so that service brake actuators that receive this pressure may be released again. However, if the backup supply pressure is provided by a spring brake cylinder, this pressure from the spring brake cylinder is first used up. This partially vents the spring brake cylinder, i.e. activates it towards application. If a leak then occurs, the spring brake cylinder is further emptied until it is completely empty and then also fully applied.The backup brake pressure drops, but the vehicle is held by the spring brake cylinder, maintaining a safe condition. The pressure of the spring brake cylinder is continuously controlled while the vehicle is in motion, making it particularly useful as a backup supply pressure.

[0035] In a preferred development, the electropneumatic unit is integrated with the parking brake unit to form a single unit. This can be achieved either by complete integration into a housing or by flanging the electropneumatic unit onto an existing parking brake unit. This is particularly advantageous when the parking brake pressure is used as the backup pressure, even if this is not absolutely necessary. Rather, the electropneumatic unit can also be integrated with the parking brake unit even if the backup pressure originates from a different source, such as, in particular, the first compressed air supply, the second compressed air supply, or another compressed air supply.

[0036] In a further preferred embodiment, a trailer control valve is provided for providing a trailer brake pressure at a trailer brake pressure connection, wherein the first redundancy brake pressure connection or a further redundancy brake pressure connection of the electropneumatic unit is connected to a trailer redundancy connection of the trailer control valve to initiate redundant control of the trailer brake pressure. The trailer control valve can, in turn, be controlled directly by the central control unit or can also have its own intelligence in the form of an electronic control unit, which is preferably connected to the central control unit and / or the vehicle bus via a bus to receive brake request signals.According to this embodiment, the trailer control valve also includes a trailer redundancy connection, from which the trailer control valve can receive a pneumatic control pressure for redundantly controlling the trailer brake pressure. According to this embodiment, the trailer can also be braked redundantly and brought to a standstill in the second or further fallback level using the electropneumatic unit.

[0037] In a third aspect, the invention achieves the object mentioned above by a method for controlling an electronically controllable pneumatic brake system according to one of the above-described preferred embodiments of an electronically controllable brake system according to the second aspect of the invention, which method comprises the steps of: providing a supply pressure at a supply connection of an electropneumatic assembly; providing a backup supply pressure that is limited relative to the supply pressure and lower than the latter at a backup supply connection of the electropneumatic assembly, at least while the vehicle is moving; and locking out the backup supply pressure in the fault-free state of the electronically controllable pneumatic brake system.

[0038] It should be understood that the method according to the third aspect of the invention, the electronically controllable pneumatic braking system according to the second aspect of the invention, and the electropneumatic assembly according to the first aspect of the invention have identical and similar sub-aspects, as particularly set forth in the dependent claims. In this respect, reference is made in full to the above description.

[0039] In a preferred embodiment, the method for the event of a fault in the electronically controllable braking system comprises the steps of: de-energizing a first fail-safe brake valve of the electropneumatic unit; and controlling the fail-safe supply pressure through the first fail-safe brake valve to trigger redundant braking of the vehicle by means of front-axle service brake actuators and / or rear-axle service brake actuators. The method may further comprise the step of limiting the level of the fail-safe supply pressure, preferably by means of a pressure limiter.

[0040] Embodiments of the invention will now be described below with reference to the drawings. These are not necessarily intended to represent the embodiments to scale; rather, the drawings are schematic and / or slightly distorted where this is useful for explanation. With regard to additions to the teachings immediately apparent from the drawings, reference is made to the relevant prior art. It should be noted that numerous modifications and changes to the form and detail of an embodiment can be made without deviating from the general idea of ​​the invention. The features of the invention disclosed in the description, in the drawings and in the claims can be essential for the further development of the invention, both individually and in any combination.Furthermore, all combinations of at least two of the features disclosed in the description, the drawings and / or the claims fall within the scope of the invention. The general idea of ​​the invention is not limited to the exact form or detail of the preferred embodiments shown and described below, or limited to an object that would be more limited than the object claimed in the claims. For specified dimensioning ranges, values ​​within the stated limits are also intended to be disclosed as limit values ​​and to be used and claimed as desired. For the sake of simplicity, the same reference numerals are used below for identical or similar parts or parts with identical or similar functions.

[0041] Further advantages, features and details of the invention will become apparent from the following description of the preferred embodiments and from the drawings, which show: Figure 1 shows a first embodiment of an electropneumatic unit; Figure 2 shows a commercial vehicle with an electronically controllable pneumatic braking system and an electropneumatic unit; Figure 3 shows a second embodiment of an electropneumatic unit; Figure 4 shows a third embodiment of the electropneumatic unit; Figure 5 shows a fourth embodiment of the electropneumatic unit; and Figure 6 shows a fifth embodiment of the electropneumatic unit.

[0042] Fig. 1 shows an electropneumatic assembly 1 according to the invention. The electropneumatic assembly 1 has a housing 2 into which several valves are integrated, as will be described below. The electropneumatic assembly 1 has a supply connection 4 on the housing, via which the electropneumatic assembly 1 receives supply pressure pV from at least one first compressed air supply 6. In addition, the electropneumatic assembly 1 has a first redundancy brake pressure connection 8 for providing a first redundancy brake pressure pR1 for a first axle A1, for example a front axle VA (cf. Fig. 2 ) of a vehicle 200, in particular a commercial vehicle 202. In addition, the electropneumatic assembly 1 has a backup supply connection 10 for receiving a backup supply pressure pAV, which is limited compared to the supply pressure pV and lower than this. The backup supply connection 10 is in the Fig. 1 In the embodiment shown, a pressure relief valve is provided inside the electropneumatic assembly 1, via which a backup supply pressure pAV can be provided to the electropneumatic assembly 1, which is limited compared to the supply pressure pV and lower than this. However, it is not absolutely necessary that the pressure already received at the backup supply connection 10 is limited, but rather, a pressure limitation can also be carried out inside the electropneumatic assembly 1, as in Fig. 1 There, a pressure limiter 12 is connected directly downstream of the backup supply connection 10, so that the pressure controlled by the pressure limiter 12 is the limited backup supply pressure pAV. The supply connection 4 is connected according to the Fig. 1 In the embodiment shown, the electropneumatic assembly 1 is connected to a working valve arrangement 15 inside the electropneumatic assembly 1, which receives the supply pressure pV and controls a working pressure pA at a first working connection 16. The working pressure pA can be, for example, a brake pressure for one or more axles of the vehicle 200, a trailer brake pressure, or a parking brake pressure. The working valve arrangement 15 can have one or more electrically switchable solenoid valves, as will be described in more detail below. In addition to the working valve arrangement 15, the electropneumatic assembly 1 can also have a Fig. 1 not shown electronic control unit which controls at least the working valve arrangement 15.

[0043] The electropneumatic unit 1 has a fail-safe valve arrangement 14, which is connected to both the fail-safe supply connection 10 and the redundant brake pressure connection 8. The fail-safe valve arrangement 14 serves to prevent a failure of the electronically controllable pneumatic brake system 204 (see Fig. 2 ) of the vehicle 200 to control the first redundancy brake pressure pR1 in order to enable safe deceleration of the vehicle 100, preferably to a standstill. In this way, a fail-safe control is to be implemented. For this purpose, the fail-safe supply pressure pAV is controlled by the fail-safe valve arrangement 14 or, if necessary, volume-amplified by it, and is controlled as the first redundancy brake pressure pR1 at the first redundancy brake pressure connection 8. This, in turn, is then connected or connectable to one or more corresponding redundancy connections of the electronically controllable pneumatic brake system 204, as will be described in more detail below.

[0044] In the Fig. 1 In the embodiment shown, the fail-safe valve arrangement 14 has a first monostable fail-safe valve 16 and an optional second monostable fail-safe valve 18.

[0045] The first failure brake valve 16 is connected to a first electronic control unit 300 via a first control line 20 for signal and power transmission. The first control unit 300 is assigned to a first redundancy level B2 (see Fig. 2 ) of the electronically controllable pneumatic brake system 204. The second failure brake valve 18 is connected via a second control line 22 to a second electronic control unit 302 for signal and energy transmission. The second electronic control unit 302 is assigned to a first operating level B1 of the Fig. 1 assigned to the electronically controllable pneumatic braking system 204, not shown in detail.

[0046] The first failover brake valve 16 and the second failover brake valve 18 are pneumatically connected in series in a main valve line 24 of the failover valve assembly 14. The main valve line 24 extends from the failover supply port 10 to the first redundancy brake pressure port 8.

[0047] The first fail-safe valve 16 and the second fail-safe valve 18 are shown here in a non-activated and de-energized state, in which they are each in an open position. In the open position, a pneumatic connection is established between a first fail-safe valve connection 16.1 and a second fail-safe valve connection 16.2 of the first fail-safe valve 16. In the activated Fig. 1 In a switching position not shown, the second failure brake valve connection 16.2 is connected to a third failure brake valve connection 16.3, which in turn is connected to a vent 3. In the open position of the second failure brake valve 18, a pneumatic connection is established between a fourth failure brake valve connection 18.1 and a fifth failure brake valve connection 18.2 of the second failure brake valve 18. A sixth failure brake valve connection 18.3 of the second failure brake valve 18 is in turn connected to a vent 3. In the de-energized stable switching position, the fifth failure brake valve connection 18.2 is connected to the sixth failure brake valve connection 18.3, so that the first redundancy brake pressure connection 8 is vented.

[0048] By providing a first switching signal S1 via the first control line 20, the first failure brake valve 16 can be switched from the open position against the resistance of a first return spring 17 into a venting position. In the venting position, a pneumatic connection is established between the first failure brake valve connection 16.1 and the third failure brake valve connection 16.3. By providing a second switching signal S2 via the second control line 22, the second failure brake valve 18 can be switched from the open position against the resistance of a second return spring 19 into a venting position. In the venting position, a pneumatic connection is established between the fourth failure brake valve connection 60.1 and the sixth failure brake valve connection 18.3.

[0049] During normal operation of the vehicle 200, it is particularly provided that the two failover brake valves 16, 18 are in their respective venting positions, so that the first redundancy brake pressure connection 8 is vented. In this state, there is therefore no pneumatic connection between the failover supply connection 10 and the first redundancy brake pressure connection 8, since the pneumatic connection is interrupted at at least two points, namely at the first failover brake valve 16 and at the second failover brake valve 18.

[0050] In the Fig. 1 In the embodiment shown, a bistable valve 26 is additionally arranged in the valve main line 24, which is pneumatically connected in series with the first failure brake valve 16 and also the second failure brake valve 18. Specifically, the bistable valve 26 in the embodiment shown here is connected between the first failure brake valve 16 and the pressure limiter 12. Viewed from the failure supply connection 10, the bistable valve 26 is therefore connected upstream of the first and second failure brake valves 16, 18. The bistable valve 26 has a first bistable valve connection 26.1, a second bistable valve connection 26.2 and a third bistable valve connection 26.3. The bistable valve 26 has a first and a second stable switching position, wherein it Fig. 1 in the second stable switching position is shown. In the first stable switching position, the first bistable valve connection 26.1 is connected to the second bistable valve connection 26.2 and a pneumatic connection between the backup supply connection 10 and the first redundancy pressure connection 8 is possible, even if the first and second backup brake valves 16, 18 are in the Fig. 1 However, if the bistable valve 26 is in the second position as shown in Fig. 1 In the switching position shown, the second bistable valve connection 26.2 is connected to the third bistable valve connection 26.3, which in turn is connected to a vent 3. In this way, the main valve line 24 is vented, and a first redundancy brake pressure pR1 cannot be controlled. The bistable valve 26 is connected via a bistable valve signal line 28 to the first electronic control unit 300, but could also be connected to the second electronic control unit 302 or another electronic control unit that is in Fig. 1 not shown. In response to a third switching signal S3, the bistable valve 26 can be switched back and forth between the two stable switching positions. In particular, the bistable valve 26 is switched depending on an autonomous operation of the vehicle 200. If the vehicle 200 is in manual operation, a control of the first redundancy brake pressure pR1 is usually not necessary, since this is achieved by actuating a foot brake pedal 262, as will be explained later with reference to Fig. 2 described in more detail, can be braked pneumatically. The control of the first redundancy brake pressure pR1 serves in particular to prevent an uncontrolled roll-out of the vehicle 200 during autonomous operation of the vehicle 200. In this respect, the bistable valve 26 can be manually operated in the Fig. 1 shown second switching position, while in automated operation of the vehicle 200 it is preferably in the first in Fig. 1 not shown switching position, in order to then enable the failure supply pressure pAV to be controlled in the event of a fault and to be able to release the main line 24.

[0051] In manual driving mode, the switching position of the first and second fail-safe brake valves 16, 18 is irrelevant, since the valve main line 24 is vented anyway through the bistable valve 26. In this way, the first and second fail-safe brake valves 16, 18 can remain in their stable switching position, which can save electrical energy. However, if the bistable valve 26 is in the first, in Fig. 1 not shown switching position, so that this can basically release the valve main line 24, the first and second failure brake valves 16, 18 or at least one of both, in the activated in Fig. 1 not shown switching position in order to continue to vent the main valve line 24 and thus prevent the activation of the first redundancy brake pressure pR1. In automated operation, the first electronic control unit 300 and the second electronic control unit 302 provide the first and second switching signals S1, S2, so that the first and second backup brake valves 16, 18 are energized.

[0052] In the case of a multiple fault FM, in particular a double fault FD, ie when both the first switching signal S1 and the second switching signal S2 are missing and both the first failure brake valve 16 and the second failure brake valve 18 are therefore without current, both the first failure brake valve 16 and the second failure brake valve 18 automatically return to their positions by the restoring force generated by the respective return spring 17, 19. Fig. 1 shown opening position.

[0053] Such a double fault FD can occur, for example, due to a simultaneous power failure FS in both the operating level B1 and the first redundancy level B2, if both the first electronic control unit 300 and the second electronic control unit 302 are without power. In such a simultaneous power failure FS, no switching signal S1, S2 can be transmitted to the first and second fail-safe brake valves 16, 18.

[0054] Furthermore, a double error FD can also manifest itself in the fact that an exceptional error FA occurs in both the first electronic control unit 300 and the second electronic control unit 300, and a zero signal is switched by the respective electronic control unit 300, 302 as an error measure (particularly in the absence of other program alternatives), and thus the first and second switching signals S1, S2 are set to 0 to switch the first and second fail-safe brake valves 16, 18 to the open position. For a multiple error FM to occur, various types of errors can be present in the individual electronic control units 300, 302, for example, in the case of a double error FD, a power failure FA can occur in the first electronic control unit 300 and an exceptional error FA can occur in the second electronic control unit 302, or vice versa.

[0055] Fig. 2 now illustrates a vehicle 200, namely in particular commercial vehicle 202, with a first axle A1, which here is a front axle VA, a second axle A2, which here is a first rear axle HA1, and a third axle A3, which here is a second rear axle HA2. The vehicle 200 comprises an electronically controllable pneumatic braking system 204, which comprises an operating level B1 and a first redundancy level B2. In addition, it also comprises a second redundancy level B3, as described below, and an electropneumatic unit 1, which is designed to brake the vehicle 200 in the event that a double fault FD or a serious single fault occurs in the operating level B1 and the first and / or second redundancy level B2, B3.

[0056] At operating level B1, the electronically controllable pneumatic braking system 204 comprises a central control unit 400, also referred to as a central module, which is connected to an autonomous driving unit 208 via a vehicle bus 206 and receives braking request signals SBA from the autonomous driving unit 208. The central control unit 400 is supplied with electrical energy by a first voltage source 210.

[0057] On the front axle VA, the electronically controllable pneumatic braking system 204 comprises a front axle modulator 220, which is designed here as a single-channel modulator and receives supply pressure pV from a first compressed air supply 6. For this purpose, the front axle modulator 220 comprises, in a known manner, a front axle supply connection 222, which is piped to the first compressed air supply 6. The front axle modulator 220 is connected to the central control unit 400 via a front axle signal line 224 and receives front axle brake signals SBV from the central control unit 400, which cause one or more electromagnetic valves (not shown) of the front axle modulator 220 to switch, as a result of which the front axle modulator 220 controls a front axle brake pressure pBVA, which is controlled via first and second ABS valves 226, 227 in a wheel-appropriate manner at a first front axle service brake actuator 228a and a second front axle service brake actuator 228b.The front axle signal line 224 can be implemented as a direct wiring of the electromagnetic valves of the front axle modulator 220 to the central control unit 400, so that output stages for the electromagnetic valves of the front axle modulator 220 are preferably integrated into the central control unit 400. Alternatively, the front axle signal line 224 can also be designed as a BUS connection (CAN-BUS), particularly if the front axle modulator 220 has its own intelligence.

[0058] The electronically controllable pneumatic braking system 204 also includes a rear axle modulator 230, which is integrated here into the central control unit 400, together with the first electronic control unit 300. The rear axle modulator 230 receives supply pressure pV from a second compressed air supply 7. The first electronic control unit 300 converts the brake request signals SBA received via the vehicle bus 206 into rear axle brake signals SBH and switches one or more electromagnetic valves of the rear axle modulator 230 (not shown in detail here), so that a rear axle service brake pressure pBHA is generated, which is controlled at first and second rear axle service brake actuators 232a, 232b on the first rear axle HA1 and at third and fourth rear axle service brake actuators 232c, 232d on the second rear axle HA2.The rear axle service brake pressure pBHA is controlled laterally and in this respect the rear axle modulator 230 is a two-channel modulator.

[0059] In addition, the electronically controllable pneumatic brake system 204 shown here includes a parking brake unit 240, which is also connected to the vehicle bus 206 and the first voltage source 210 and receives electrical energy from it. The parking brake unit 240 is connected to both the first and second compressed air supply 6, 7 and receives supply pressure pV from both. Fig. 2 The layout shown relates to a design primarily found in North America, in which no separate parking brake supply is provided. It should be understood that instead of connecting the first and second compressed air supply 6, 7 to the parking brake unit 240, a third compressed air supply may also be provided, which separately supplies the parking brake unit 240 with supply pressure.

[0060] The parking brake unit is provided to control a parking brake pressure pBP via a spring-loaded connection 264 to first and second spring-loaded brake cylinders 242a, 242b on the first rear axle HA1 and to third and fourth spring-loaded brake cylinders 242c, 242d on the second rear axle HA2.

[0061] The electronically controllable pneumatic braking system 204 is also intended to supply a trailer and, for this purpose, has a trailer control unit 250, which also receives supply pressure pV from both the first compressed air supply 6 and the second compressed air supply 7. The trailer control unit 250 is connected to the central control unit 400 and receives trailer brake signals SBT from it via a trailer signal line 252. In this respect, the trailer control unit 250 is also supplied by the first voltage source 210. Depending on the received trailer brake signal SBT, the trailer control unit 250 controls a trailer brake pressure pBT at a trailer brake pressure connection 251. The trailer brake signal SBT can be used, for example, to transmit a normal service brake signal, an anti-theft brake signal for implementing an anti-theft brake function, or a trailer parking signal for parking the trailer.

[0062] To form a first redundancy level B2, which in this case is electrically implemented, the electronically controllable pneumatic brake system 204 comprises a secondary brake module 402, into which the second electronic control unit 302 is also integrated. The secondary brake module can be designed as an electropneumatic unit 1 or comprise this. The secondary brake module 402 is therefore also connected to the first compressed air supply 6 and receives supply pressure pV from it. The secondary brake module 402 is also connected to the vehicle BUS 206 and receives brake request signals SBA via this. It is supplied by a second voltage source 212, which is independent of the first voltage source 210. The second electronic control unit 302 is able to process the brake request signals SBA and control a working valve arrangement 15 in order to generate a first working pressure pA1, if necessary.as a first redundancy brake pressure pR1 at a first redundancy brake pressure connection 8 and to control a second working pressure pA2, possibly as a second redundancy brake pressure pR2 at a second redundancy brake pressure connection 9. The first redundancy brake pressure pR1 is provided here to the front axle VA and the second redundancy brake pressure pR2 is provided here to the rear axle HA1, HA2. More precisely, the first redundancy brake pressure pR1 is controlled in a basically known manner via a first shuttle valve 254 at a front axle redundancy connection 256 of the front axle modulator 220. The front axle modulator 220 then converts the first redundancy brake pressure received thereat and, based thereon, redundantly controls the front axle brake pressure pBVA.For this purpose, the front axle modulator 220 can, in a basically known manner, have a monostable redundancy valve and a relay piston or a pneumatically switchable main valve to control the first redundancy brake pressure pR1 provided at the front axle redundancy connection 256 with increased volume. The first redundancy brake pressure pR1 is also controlled at a trailer redundancy connection 253 to enable redundant braking of a trailer.

[0063] In a corresponding manner, the rear axle modulator 230 or the central control unit 400, into which the rear axle modulator 230 is integrated, has a rear axle redundancy connection 258, to which the second redundancy brake pressure pR2 can be provided via a second shuttle valve 260. The secondary brake module 402 thus controls the first and second redundancy brake pressures pR1, pR2 in a manner appropriate to the axles and can thus again be referred to as a dual-channel modulator. The central control unit 400 is then in turn designed to control the rear axle brake pressure pBHA based on the received second redundancy brake pressure pR2. For this purpose, the central control unit 400 can again have, in a basically known manner, a redundancy valve and a relay piston or a pneumatically switchable main valve in order to control the second redundancy brake pressure pR2 with volume amplified as rear axle brake pressure pBHA.In this way, an electronically controllable fallback level, in this case the first redundancy level B2, can be provided.

[0064] The Fig. 2 The electronically switchable pneumatic brake system 204 shown furthermore has a manually operable fallback level B3, which in the exemplary embodiment shown here comprises a foot brake pedal 262. A foot brake pressure pBF can be controlled via the foot brake pedal 262 at both the first shuttle valve 254 and the second shuttle valve 260. The first and second shuttle valves 254, 260 are each designed such that they control the higher of the applied foot brake pressure pBF and the first and second redundancy pressures pR1, pR2 to the front axle modulator 220 and the rear axle modulator 230, respectively. In this way, for example, the controlled first and second redundancy brake pressures pR1, pR2 can be overridden by actuating the foot brake pedal 262. Conversely, the secondary brake module 402 can also override the foot brake pressure pBF controlled by a driver.

[0065] A third redundancy level, which according to the invention is only designed as a fail-safe level, is formed by the electropneumatic unit 1. The parking brake pressure pBP is connected to the secondary brake module 402, more precisely to the failure supply connection 10. The parking brake pressure pBP is a pressure that is limited compared to the supply pressure pV, which is also reduced. Typical values ​​of supply pressures pV are in a range of 8 - 12 bar, while the level of the parking brake pressure pBP is typically limited to 8 bar. In the exemplary embodiment shown here, the level of the supply pressure pV is approximately 12 bar, while the parking brake pressure pBP is approximately 8 bar.

[0066] If the electropneumatic unit 1 is now as shown in Fig. 1 shown, if the vehicle 200 is in autonomous operation, the bistable valve 26 is first moved to the position shown in Fig. 1 not shown first switching position. Both the first and the second failure brake valve 16, 18 are energized, while the first electronic control unit 300 and the second electronic control unit 302 are functioning properly. If the first electronic control unit 300 fails, the first failure brake valve 16 is de-energized first. The second electronic control unit 302, as part of the secondary brake module 402, can then take over the control of the electronically controllable pneumatic brake system 204, as described above, by controlling the first and second redundancy brake pressures pR1, pR2. In the event that this also fails, for example due to the double fault FD, the second failure brake valve 18 is de-energized and moved by the second spring 19 into the Fig. 1 shown switching position. Subsequently, the parking brake pressure pBP, which is provided at the backup supply connection 10, is further limited by the pressure limiter 12, controlled by the bistable valve 26, the first backup brake valve 16, the second backup brake valve 18 and provided at the first redundancy brake connection 8 and output as the first redundancy brake pressure pR1, passes via the first shuttle valve 254 to the front axle redundancy connection 256, whereupon the front axle modulator 220 outputs the front axle brake pressure pBVA and brakes the front axle VA. Since the parking brake pressure pBP is a static pressure, i.e., is not further adjusted depending on the speed, the vehicle 200 is braked to a standstill in this way. Because the parking brake pressure pBP is a limited and reduced pressure, locking of the front axle VA is prevented.

[0067] Fig. 3 now shows the electropneumatic assembly 1 designed as a secondary brake module 402. The secondary brake module 402 has a supply connection 4, at which the electropneumatic assembly 1 receives supply pressure pV, the failure supply connection 10, which here is preceded by the pressure limiter 12 and is not integrated, as in the case with reference to Fig. 1 described embodiment, wherein the failure supply pressure pAV is provided at the failure supply connection 10, a first redundancy brake pressure connection 8, at which a first redundancy brake pressure pR1 can be controlled, and a second redundancy brake pressure connection 9, at which a second redundancy brake pressure pR2 can be controlled.

[0068] The electropneumatic assembly 1 comprises the first fail-safe valve 16 and the bistable valve 26. A second fail-safe valve 18, as described with reference to Fig. 1 described, in the embodiment according to Fig. 3 not provided. The bistable valve 26 is in turn pneumatically connected upstream of the first fail-safe brake valve 16, as seen from the fail-safe supply connection 10. The bistable valve 26 and the first fail-safe brake valve 16 are pneumatically connected in series in the valve main line 24. In addition to the fail-safe valve arrangement 14, the electropneumatic unit 1 in this embodiment also comprises a working valve arrangement 15, which has a structure similar to a basically known two-channel axis modulator. The working valve arrangement 15 comprises in the Fig. 3 In the embodiment shown, the first electromagnetic pilot control unit 32 and a first main valve unit 34 are provided. The first electromagnetic pilot control unit 32 comprises a first inlet valve 36, which is designed as a 2 / 2-way valve and is connected to the supply port 4 for receiving supply pressure pV. The first inlet valve 36 comprises a first inlet valve port 36.1 and a second inlet valve port 36.2, wherein the first inlet valve port 36.1 is connected to the supply port 4. In a first in Fig. 3 In the stable switching position shown, the first inlet valve 36 is closed and the first and second inlet valve connections 36.1, 36.2 are separated. In a second, activated in Fig. 3 In a switching position not shown, however, the first and second inlet valve ports 36.1, 36.2 are connected, so that the first inlet valve 36 outputs a first working control pressure pS1 into a first control line 38. The first main valve unit 34 here comprises a first relay valve 40. The first relay valve 40 has a first relay valve supply port 40.1, a first relay valve working port 40.2, a relay valve vent port (not shown here), and a first relay valve control port 40.3. The first working control pressure pS1 is received at the first relay valve control port 40.3. The first relay valve 40 volume-amplifies this first working control pressure pS1 and correspondingly outputs a first working brake pressure pA1 at the first relay valve working port 40.2. The first relay valve working port 40.In the embodiment shown here, 2 is connected to the first redundancy brake pressure port 8, so that the first working brake pressure pA1 is provided at the first redundancy brake pressure port 8 and thus also functions as the first redundancy brake pressure pR1. The first redundancy brake pressure port 8 is as shown in . Fig. 2 shown connected to the front axle modulator 22, so that the first redundancy level B2 can be implemented via the actuation of the first pilot control unit 32 and the first main valve unit 34.

[0069] For this purpose, the second electronic control unit 302 is also integrated into the electro-pneumatic assembly 1 to form the secondary brake module 402. In the embodiment shown here, the second electronic control unit 302 can provide first pilot control switching signals S4, S5 to the first pilot control unit 32, in particular to control the first inlet valve 36 to switch to the second in Fig. 3 not shown switching position. In order to vent the first working control pressure pS1, the first pilot control unit 32 also comprises a first outlet valve 42. The first outlet valve 42 is in turn designed as a monostable 2 / 2-way valve and comprises a first outlet valve connection 42.1 and a second outlet valve connection 42.2. In a first in Fig. 3 In the stable switching position shown, the first and second outlet valve ports 42.1, 42.2 are pneumatically connected, while they are pneumatically separated in the activated state of the first outlet valve 42. The first outlet valve port 42.1 is connected to the first control line 38 and the second outlet valve port 42.2 is connected to the main valve line 24, in which Fig. 3 shown case more precisely with the first failure brake valve 16, more precisely, the second failure brake valve connection 16.2. Since the valve main line 24 should typically be vented during normal operation of the vehicle 200, either as in Fig. 3 shown via the bistable valve 26, which connects the second bistable valve connection 26.2 with the third bistable valve connection 26.3 and thus with the vent 3, or when the first failure brake valve 16 is activated via this, the first control line 38 can also be vented via the first outlet valve 42.

[0070] At this point, the difference between the electropneumatic assembly 1 according to the present invention and a conventional two-channel axle modulator becomes apparent. In a conventional two-channel axle modulator, the second outlet valve connection 42.2 is typically connected either directly to a vent, or via the interposition of a backup valve or redundancy valve, which can be designed similarly to the first fail-safe brake valve 16, to a redundancy connection, via which, for example, a pneumatic redundancy pressure or an anti-compound pressure can be controlled and which also functions as a vent during normal operation. Fig. 3 However, in the embodiment of the electropneumatic unit 1 shown, the bistable valve 26 and the pressure limiter 12 are additionally provided, via which the backup supply pressure pAV is permanently applied to the backup supply connection 10. The venting of the first control line 38 therefore does not occur via the backup supply connection 10, but via the vent 3 of the first backup brake valve 16 and / or the bistable valve 26. The first relay valve 40 can have its own vent or can also be connected to one of the vents 3 of the first backup brake valve 16 and the bistable valve 26.

[0071] The working valve arrangement 15 further comprises a second electromagnetic pilot control unit 44 and a second main valve unit 45, which are configured analogously to the first pilot control unit 32 and the first main valve unit 34. In this respect, the second pilot control unit 44 also comprises a second inlet valve 46, a second outlet valve 52, and a second relay valve 50. The second inlet valve 44 is again connected to a third and a fourth inlet valve port 46.1, 46.2, with the third inlet valve port 46.1 being connected to the supply port 4, and the fourth inlet valve port 46.2 being connected to a second control line 48, into which the second inlet valve 46 delivers a second working control pressure pS2. The second relay valve receives the second working control pressure pS2 at a second relay valve control port 50.3 and receives supply pressure pV at a second relay valve supply port 50.1 and controls a second working brake pressure pA2 at a second relay valve working port 50.2, which is also connected here to the second redundancy brake pressure port 9, so that the second working brake pressure pA2 can also function as a second redundancy brake pressure pR2. The second redundancy brake pressure port 9 is (cf. . Fig. 2 ) is connected to the rear axle modulator 230, so that the first redundancy level B2 in the electronic control can be implemented via the second pilot control unit 44 and the second main valve unit 45. The second outlet valve 52 is in turn connected to the third outlet valve connection 52.1 with the second control line 48 and to the fourth outlet valve connection 52.2 with the main valve line 24, so that the second control line 48 can also be vented via the fail-safe valve arrangement 14. To move the second inlet valve 46 and the second outlet valve 52 into the activated switching positions (not shown), the second electronic control unit 302 can provide second pilot control switching signals S6, S7.

[0072] In automated operation, especially when there is no driver, the bistable valve 26 should be in the first Fig. 3 not shown switching position, in which the first bistable valve connection 26.1 is connected to the second bistable valve connection 26.2, so that basically the failure supply pressure pAV is controlled through the bistable valve 26 and then preferably applied to the second failure brake valve connection 16.2. The first failure brake valve 16 is then in the activated in Fig. 3 not shown switching position, so that the main valve line 24 is connected to the vent 3. If a double fault FD occurs and the second electronic control unit 302 also fails, it can no longer provide the first and second pilot control switching signals S4, S5, S6, S7, so that the first inlet valve 36, the first outlet valve 42, the second inlet valve 46, the second outlet valve 52 each in their monostable in Fig. 3 The first fail-safe valve 16 also falls back to the position shown in Fig. 3 shown stable switching position, in which the first failure brake valve connection 16.1 is connected to the second failure brake valve connection 16.2. Since the first and second outlet valves 42, 52 are also in their open switching positions, the failure supply pressure pAV controlled by the first failure brake valve 16 can be controlled through the main valve line 24 and fed into the first and second control lines 38, 48 via the first and second vent valves 42, 52 and is then applied to the first and second relay valve control connections 40.3, 50.3. The first and second relay valves 40, 50 then volume-amplify this pressure, namely in this case a first or second redundancy control pressure pRS1, pRS2, and control this respectively as the first and second redundancy brake pressure pR1, pR2 at the first and second redundancy brake pressure connections 8, 9. In this way, the vehicle 200 can be braked safely.

[0073] This means that, in contrast to the first embodiment ( Fig. 1 ) the fail-safe valve arrangement 14 in the embodiment shown here ( Fig. 3 ) is not directly connected to the first or second redundancy brake pressure connection 8, 9, but to the first relay valve control connection 40.3, which functions as the first redundancy control connection 40.4, and the second relay valve control connection 50.3, which functions as the second redundancy control connection 50.4.

[0074] However, it can also be provided that the first relay valve 40 and / or the second relay valve 50 are part of the fail-safe valve arrangement 40.

[0075] A third embodiment of the electropneumatic unit 1 is shown in Fig. 4 Identical and similar elements are designated by the same reference numerals as in the previous embodiments, so that reference is made in full to the above description. The third embodiment ( Fig. 4 ) is based on the second embodiment ( Fig. 3 ) and the differences are highlighted below.

[0076] In contrast to the second embodiment ( Fig. 3 ) is in the third embodiment ( Fig. 4 ) the second fail-safe valve 18, as described with reference to Fig. 1 as already described. It is pneumatically connected in series with the first fail-safe brake valve 16 and the bistable valve 26. It is arranged between the first fail-safe brake valve 16 and the bistable valve 26, although the order of these valves can also be configured differently, particularly to achieve the smallest possible installation space.

[0077] The second failure brake valve 18 is operated as described with reference to Fig. 1 As already described, it is controlled by the electronic control unit 300 of the central control unit 400. In this respect, safety is increased in the third embodiment compared to the second embodiment, since both the electronic control unit 300 and the electronic control unit 302 must fail in order to trigger the control of the first redundancy brake pressure pR1 based on the failure supply pressure pAV.

[0078] In the fourth embodiment ( Fig. 5 ) shows a variant of the electro-pneumatic unit, which is essentially based on the embodiment of the Fig. 1 Identical and similar elements are designated by the same reference numerals as in the previous embodiments, so reference is made to the above description in full. The differences are highlighted below.

[0079] In the fourth embodiment ( Fig. 5 ), the electropneumatic assembly 1 is integrated with a parking brake unit 240. The supply connection 4 thus also serves to supply the working valve unit 15, which here serves in a basically known manner to control the parking brake pressure pBP, with supply pressure pV. For this purpose, both the first compressed air supply 6 and the second compressed air supply 7 are connected to the supply connection 4, as also in Fig. 2 shown.

[0080] The parking brake unit has a spring-loaded connection 264 to which one or more spring-loaded brake cylinders can be connected. Fig. 2 In the embodiment of the electronically controllable pneumatic brake system 204 shown, all four spring brake cylinders 242a, 242b, 242c, 242d are connected to it. The backup supply connection 10 is also connected to the spring brake cylinders 242a, 242b, 242c, 242d and receives the parking brake pressure pBP. The backup supply connection 10 is connected downstream of the backup supply connection 10, although this is not absolutely necessary if the parking brake pressure pBP is already sufficiently limited compared to the reservoir pressure pV. The backup supply connection 10 is here outside the housing 2 with the spring brake cylinders 242a, 242b, 242c, 242d. In an integrated arrangement as in Fig. 5 As shown, it is also possible to transfer the parking brake pressure pBP internally. In this case, the backup supply connection 10 could be located directly downstream of the working valve unit 15.

[0081] Despite the integration with the parking brake unit 240, the first fail-safe brake valve 16 and the bistable valve 26 are controlled by the electronic control unit 300, and the second fail-safe brake valve 18 is controlled by the electronic control unit 302. If the parking brake unit 240 has its own intelligence, it is preferred that at least the bistable valve 26 and / or the first fail-safe brake valve 16 and / or the second fail-safe brake valve 18 be controlled by the intelligence (electronic control unit) of the parking brake unit 240.

[0082] In a fifth embodiment ( Fig. 6 ) are essentially the embodiments 2 and 4 according to the Fig. 3 and 5 The electropneumatic unit 1 includes both the parking brake unit 240 based on the model of the Fig. 5 and the secondary brake module 402 based on the Fig. 3 . The supply connection 4 can in turn be connected to the first compressed air supply 6 and the second compressed air supply 7, even if this is Fig. 6 is not shown. The supply pressure pV is then transferred within the electropneumatic assembly 1 and provided to the first pilot valve unit 32, the second pilot valve unit 44, the first main valve unit 34 and the second main valve unit 45. The parking brake pressure pBP can also preferably be adjusted as described with reference to Fig. 5 as already described, can also be transferred internally within the housing 2. In this way, a fully integrated module is created in which parts, especially valves, can be advantageously saved. LIST OF REFERENCE SYMBOLS (PART OF THE DESCRIPTION)

[0083] 1Electropneumatic unit 2Housing 4Supply connection 6First compressed air supply 8First redundancy brake pressure connection 9Second redundancy brake pressure connection 10Failure supply connection 12Pressure limiter 14Fail-safe valve arrangement 15Working valve arrangement 16First monostable failure brake valve 16.1First failure brake valve connection 16.2Second failure brake valve connection 16.3Third failure brake valve connection 17First return spring 18Second monostable failure brake valve 18.1Fourth failure brake valve connection 18.2Fifth failure brake valve connection 18.3Sixth failure brake valve connection 19Second return spring 20First control line 22Second control line 24Main valve line 26Bistable valve 26.1First bistable valve connection 26.2Second bistable valve connection 26.3Third Bistable valve connection 28 Bistable valve signal line 32 First electromagnetic pilot control unit 34 First main valve unit 36 ​​First inlet valve 36.1 First inlet valve connection 36.2 SecondInlet valve connection 38 First control line 40 First relay valve 40.1 First relay valve supply connection 40.2 First relay valve working connection 40.3 First relay valve control connection 40.4 First redundancy control connection 42 First exhaust valve 42.1 First exhaust valve connection 42.2 Second exhaust valve connection 44 Second electromagnetic pilot control unit 45 Second main valve unit 46 Second inlet valve 46.1 Third inlet valve connection 46.2 Fourth inlet valve connection 48 Second control line 50 Second relay valve 50.1 Second relay valve supply connection 50.2 Second relay valve working connection 50.3 Second relay valve control connection 50.4 Second redundancy control connection 52 Second exhaust valve 52.1 Third exhaust valve connection 52.2 Fourth exhaust valve connection 200Vehicle 202Commercial vehicle 204Electronically controllable pneumatic braking system 206Vehicle bus 208Autonomous driving unit 210First voltage source 212Second voltage source 220Front axle modulator222 Front axle supply connection 224 Front axle signal line 226 First ABS valve 227 Second ABS valve 228 a First front axle service brake actuator 228 b Second front axle service brake actuator 230 Rear axle modulator 232 a First rear axle service brake actuator 232 b Second rear axle service brake actuator 232 c Third rear axle service brake actuator 232 d Fourth rear axle service brake actuator 240 Parking brake unit 242 a First spring brake cylinder 242 b Second spring brake cylinder 242 c Third spring brake cylinder 242 d Fourth spring brake cylinder 250 Trailer control unit 251 Trailer brake pressure connection 252 Trailer signal line 253 Trailer redundancy connection 254 First shuttle valve 256 Front axle redundancy connection 258 Rear axle redundancy connection 260 Second shuttle valve 262 Foot brake pedal 264 Spring brake connection 300 First electronic control unit 302 Second electronic control unit 400 Central control unit 402 Secondary brake module A1 First axle A2 Second axle B1 Operating levelB2 first redundancy level B3 second redundancy level FD double fault FM multiple fault FS power failure FA exception error pA working pressure pBFFoot brake pressure pBHA rear axle service brake pressure pBP parking brake pressure pBT trailer brake pressure pBVA front axle service brake pressure pR1 first redundancy brake pressure pR2 second redundancy brake pressure pRS1 first redundancy control pressure pRS2 second redundancy control pressure pS1 first working control pressure pS2 second working control pressure pV supply pressure pAV failure supply pressure HA1 first rear axle HA2 second rear axle S1 first switching signal S2 second switching signal S3 third switching signal S4 first pilot control switching signal S5 second pilot control switching signal S6 third pilot control switching signal S7 fourth pilot control switching signal SBABrake request signal SBT trailer brake signal SBV front axle brake signals VA front axle

Claims

1. Electropneumatic assembly (1) for an electronically controllable pneumatic brake system (204) for a vehicle (200), in particular a commercial vehicle (202), comprising a supply connection (4) for receiving a supply pressure (pV) from at least one first compressed air supply (6); at least one first redundancy brake pressure connection (8) for providing a first redundancy brake pressure (pR1) for a first axle (A1) of the vehicle (200) and / or a trailer of the vehicle (200), characterized by a failure supply connection (10) for providing a failure supply pressure (pAV) which is limited with respect to and lower than the supply pressure (pV), and a fail-safe valve arrangement (14) which is connected to the failure supply connection (10) and the redundancy brake pressure connection (8) or at least one first redundancy control connection (40.4), which failure valve arrangement comprises at least one first failure brake valve (16) which is designed as a monostable valve and can be switched in the event of a fault in order to deliver the first redundancy brake pressure (pR1) at the first redundancy brake pressure connection (8) or at least one first redundancy control pressure (pRS1) at the first redundancy control connection (40.4) on the basis of the failure supply pressure (pAV).

2. Electropneumatic assembly (1) according to claim 1, wherein the failure supply pressure (pAV) originates from the first compressed air supply (6), a further compressed air supply (7) or a spring brake actuator (242a, 242b, 242c, 242d).

3. Electropneumatic assembly (1) according to any of the preceding claims, wherein the first failure brake valve (16) is a 3 / 2-way valve comprising a first failure brake valve connection (16.1) receiving the failure supply pressure (pAV), a second failure brake valve connection (16.2) setting the first redundancy brake pressure (pR1) or the first redundancy control pressure (pRS1), and a third failure brake valve connection (16.3) connected to a vent (3), wherein, in a non-activated switching position, the first failure brake valve connection (16.1) is connected to the second failure brake valve connection (16.2), and, in an activated switching position, the second failure brake valve connection (16.2) is connected to the third failure brake valve connection (16.3).

4. Electropneumatic assembly (1) according to any of the preceding claims, wherein a pressure limiter (12) is connected upstream of the failure supply connection (10), or the electropneumatic assembly (2) comprises a pressure limiter (12) for limiting the pressure received at the failure supply connection (10).

5. Electropneumatic assembly (1) according to any of the preceding claims, wherein the fail-safe valve arrangement (14) comprises an electromagnetic bistable valve (26) which is pneumatically connected in series to the first failure brake valve (16).

6. Electropneumatic assembly (1) according to claim 5, wherein the bistable valve (26) comprises a first bistable valve connection (26.1) receiving the failure supply pressure (pAV), a second bistable valve connection (26.2) connected to the first failure brake valve (16) and a third bistable valve connection (26.3) connected to a vent (3).

7. Electropneumatic assembly (1) according to any of the preceding claims, comprising a working valve arrangement (15) which is connected to the supply connection (4) and receives supply pressure (pV) therefrom and is switchable in order to control the first redundancy brake pressure (pR1) at the first redundancy brake pressure connection (8) or to control a working pressure (pA) at a working connection (16) of the electropneumatic assembly (1), and comprising an electronic control unit (302) for controlling the working valve arrangement (14).

8. Electropneumatic assembly (1) according to claim 7, wherein the electronic control unit (302) controls the first failure brake valve (16).

9. Electropneumatic assembly (1) according to claim 6 and 7, wherein the electronic control unit (302) controls the bistable valve (26).

10. Electropneumatic assembly (1) according to any of the preceding claims, wherein the fail-safe valve arrangement (14) comprises a second failure valve (18) designed as a monostable valve, which is pneumatically connected in series with the first failure valve (16)11. Electropneumatic assembly (1) according to claim 10, wherein the second failure brake valve (18) is controlled by a further electronic control unit (300).

12. Electropneumatic assembly (1) according to claim 7, wherein the working valve arrangement (15) comprises at least a first electromagnetic pilot control unit (32) and a first main valve unit (34), wherein the first pilot control unit (32) is connected to the supply connection (4) and, depending on first pilot control switching signals (S4, S5) from the electronic control unit (302), sets a first working control pressure (pS1) at the first main valve unit (34), wherein the first main valve unit (34) is connected to the supply connection (4) and, depending on the received first working control pressure (pS1), sets a first working brake pressure (pA1).

13. Electropneumatic assembly (1) according to claim 12, wherein the working valve arrangement (15) comprises a second electromagnetic pilot control unit (44) and a second main valve unit (45), wherein the second pilot control unit (44) is connected to the supply connection (4) and, depending on second pilot control switching signals (S6, S7) from the electronic control unit (302), sets a second working control pressure (pS2) at the second main valve unit (45), wherein the second main valve unit (45) is connected to the supply connection (4) and, depending on the received second working control pressure (pS2), sets a second working brake pressure (pA2).

14. Electronically controllable pneumatic brake system (204) for a vehicle (200), in particular a commercial vehicle (202), comprising a front axle modulator (220) for providing a front axle service brake pressure (pBVA) to a first front axle service brake actuator (228a) and a second front axle service brake actuator (228a) on a front axle (VA) of the vehicle (200); and a rear axle modulator (230) for providing a rear axle service brake pressure (pBHA) to at least a first rear axle service brake actuator (232a) and a second rear axle service brake actuator (232b) on a rear axle (HA1) of the vehicle (200); and an electropneumatic assembly (1) according to any of claims 1 to 13, wherein the first redundancy brake pressure connection (8) is connected to a front axle redundancy connection (256) of the front axle modulator (220) and / or to a rear axle redundancy connection (258) of the rear axle modulator (230) in order to initiate redundant setting of the front axle service brake pressure (pBVA) and / or rear axle service brake pressure (pBHA).

15. Electronically controllable pneumatic brake system (204) according to claim 14, comprising a central control unit (400) which provides front axle brake signals (SBV) to the front axle modulator (220) in order to initiate electronic setting of the front axle service brake pressure (pBVA), and which provides the rear axle brake signals (SBH) to the rear axle modulator (230) in order to initiate electronic setting of the rear axle service brake pressure (pBHA), wherein the central control unit (400) controls the first failure brake valve (16).

16. Electronically controllable pneumatic brake system (204) according to either claim 14 or claim 15, wherein the electropneumatic assembly (1) is a secondary brake module (402) of the electronically controllable pneumatic brake system (204) and is designed to initiate redundant setting of the front axle service brake pressure (pBVA) and / or rear axle service brake pressure (pBHA) in the event of the central control unit (400) being prevented from electronically delivering the front axle service brake pressure (pBVA) and / or rear axle service brake pressure (pBHA).

17. Electronically controllable pneumatic brake system (204) according to any of claims 14 to 16, comprising a parking brake unit (240) for providing a parking brake pressure (pBP) to a first spring brake actuator (242a) and a second spring brake actuator (242b) on the rear axle (HA1) of the vehicle (200), wherein the failure supply connection (10) is connected to the first spring brake actuator (242a) and / or the second spring brake actuator (242b) in order to receive the parking brake pressure (pBP) or a pressure derived therefrom as a failure supply pressure (pAV).

18. Electronically controllable pneumatic brake system (204) according to claim 17, wherein the electropneumatic assembly (1) is integrated with the parking brake unit (240) to form a single assembly.

19. Electronically controllable pneumatic brake system (204) according to any of claims 14 to 18, comprising a trailer control unit (250) for providing a trailer brake pressure (pBT) to a trailer brake pressure connection (251), wherein the first redundancy brake pressure connection (8) or a further redundancy brake pressure connection (9) of the electropneumatic assembly (1) is connected to a trailer redundancy connection (253) of the trailer control valve (250) in order to initiate redundant setting of the trailer brake pressure (pBT).

20. Method for controlling an electronically controllable pneumatic brake system (204) according to any of claims 14 to 19, comprising the steps of: - providing a supply pressure (pV) at a supply connection (4) of an electropneumatic assembly (1); - providing a failure supply pressure (pAV), which is limited to and lower than the supply pressure (pV), at a failure supply connection (10) of the electropneumatic assembly (1), at least while the vehicle (200) is traveling; and - locking out the failure supply pressure (pAV) in the fault-free state of the electronically controllable pneumatic brake system (200).

21. Method according to claim 20, comprising the steps of: in case of a fault (FM, FD, FS, FA) of the electronically controllable brake system (204): - de-energizing a first failure brake valve (16) of the electropneumatic assembly (1); and - passing the failure supply pressure (pAV) through the first failure brake valve (16) to trigger redundant braking of the vehicle (200) by means of front axle service brake actuators (228a, 228b) and / or rear axle service brake actuators (232a, 232b, 232c, 232d).

22. Vehicle (200), in particular a commercial vehicle (202) comprising a front axle (VA), at least one first rear axle (HA1), and an electronically controllable pneumatic brake system (204) according to any of claims 14 to 19, which is preferably designed to carry out a method according to any of claims 20 to 21.