Failsafe brake system

Abstract

To provide a brake system having two brake circuits.SOLUTION: A brake system for a vehicle includes: at least two hydraulic brake circuits, each with at least one hydraulically acting wheel brake; and a switching valve provided on each hydraulically acting wheel brake, which switching valve connects in each case one hydraulically acting wheel brake to one of the two brake circuits. The brake system also includes a central outlet switching valve which brings about a switchable hydraulic connection between at least one of the brake circuits and a reservoir vessel, in which reduction in pressure in the at least one hydraulically acting wheel brake is effected by opening the central outlet switching valve and the associated switching valve.SELECTED DRAWING: Figure 1a

Description

Technical Field

[0001] The present invention relates to a hydraulic braking system having at least two brake circuits and at least one pressure supply unit.

[0002] Background Requirements that have a major impact on the design of braking systems, especially safety requirements (e.g., for a two-line braking system), become more stringent depending on the degree of vehicle automation (levels 0 to 5 of the SAE J3016 standard). For example, in the case of autonomous driving at level 1 or higher (e.g., an adaptive cruise control system), the braking force must be guaranteed even without the driver's brake pedal operation. This requires at least one pressure supply unit in the hydraulic braking system, as well as appropriately configured electronic sensors and a control unit. Fault tolerance also depends on the level of automation. At level 2, individual faults are tolerated if braking operation is possible at least at about 0.3g, whereas at level 3, in the event of an individual fault, braking operation must be guaranteed up to at least about 0.5g. At level 3 and above, in the event of an individual fault, the ABS / ESP function must likewise be guaranteed. Generally, double faults are tolerated if the probability of failure based on ppm and FIT data is low.

[0003] Summary of the Invention The present invention relates to a braking system having two brake circuits. Preferably, at least the requirements of level 2 based on the SAE J3016 standard are met. In this case, furthermore, double faults leading to a failure of the entire braking system are avoided, and so-called potential individual faults can be timely identified by redundant means and diagnosis.

[0004] In a first aspect, the present invention is the following components, namely: - at least two hydraulic brake circuits (BK1, BK2), each having at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4); - At least one pressure supply device (DV) connected to one of the brake circuits (BK1, BK2) via a hydraulic line; - Switching valves (SV1, SV2, SV3, SV4) for each hydraulically actuated wheel brake (RB1, RB2, RB3, RB4), which switchably connect each hydraulically actuated wheel brake (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2); - At least one hydraulic connection section that can be switched by at least one bypass switching valve (BP1) between the two brake circuits (BK1 and BK2); - At least one hydraulic connection section that can be switched between at least one of the brake circuits (BK1, BK2) and a reservoir (VB) via at least one outlet switching valve (ZAV); - A hydraulic brake pedal system whose hydraulic outlet is switchably connected to at least one brake circuit (BK1, BK2) via a supply switching valve (FV); It has, The pressure reduction in at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4) is carried out by opening the outlet switching valve (ZAV) and the associated switching valves (SV1, SV2, SV3, SV4). It relates to a vehicle brake system.

[0005] Aspect 2: A brake system according to Aspect 1, wherein at least one pressure supply device (DV) has a rotary pump. Rotary pumps are usually less expensive than, for example, plunger pumps.

[0006] Aspect 3: A brake system according to Aspect 2, wherein the rotary pump is designed as a gear pump or as a multi-piston pump, in particular a three-piston pump.

[0007] Aspect 4: A braking system based on Aspect 3, wherein the pressure supply device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that closes towards the pressure supply device (DV) or via a solenoid valve.

[0008] Aspect 5: A braking system based on Aspect 3, wherein the multi-piston pump is directly connected to at least one of the brake circuits (BK1, BK2), where being directly connected means that there is no valve or device affecting pressure between the multi-piston pump and at least one brake circuit (BK1, BK2). By appropriately designing the multi-piston pump, backflow of the brake fluid can be prevented by the operation of the pump itself, thereby eliminating the need for a valve to prevent backflow.

[0009] Aspect 6: A braking system based on any one of the preceding aspects, wherein the pressure supply device (DV) has a motor, and the motor is preferably a brushless DC motor, particularly having redundant windings and / or connections to a 2 x 3-phase control device.

[0010] Aspect 7: A braking system based on any one of the preceding aspects, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that open when electrically interrupted, the bypass switching valve (BP1) is a bypass switching valve that opens when electrically interrupted, the outlet switching valve (ZAV) is an outlet switching valve that closes when electrically interrupted, and the supply switching valve (FV) is a supply switching valve that opens when electrically interrupted.

[0011] Aspect 8: A braking system based on any one of the preceding aspects, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected such that each switching valve (SV1, SV2, SV3, SV4) is opened by the residual pressure in the wheel brakes (RB1, RB2, RB3, RB4) when the switching valve is electrically interrupted. Thereby, the residual pressure in the braking system that is not desirable in case of a defect can be avoided.

[0012] Aspect 9: A braking system based on any one of the preceding aspects, wherein the two hydraulic braking circuits (BK1, BK2) have strictly one or more pressure sensors (DG). A single pressure sensor for both braking circuits (BK1, BK2) is sufficient for pressure detection. For enhanced safety, one pressure sensor can be used in each braking circuit. Another redundant sensor can also be used additionally.

[0013] Aspect 10: A braking system based on any one of the preceding aspects, wherein the ABS / ESP control can be implemented via at least one switching valve (SV1, SV2, SV3, SV4) and an outlet switching valve (ZAV).

[0014] Aspect 11: A braking system based on any one of the preceding aspects, wherein there is no valve between the outlet switching valve (ZAV) and at least one switching valve (SV3, SV4) of one of the braking circuits (BK2). Preferably, the two switching valves (SV3, SV4) are directly connected to the central outlet switching valve (ZAV). In this way, valves can be omitted.

[0015] Aspect 12: A braking system based on any one of the preceding aspects, wherein there is no valve between the bypass switching valve (BP1) and the two, preferably all four, switching valves (SV1, SV2, SV3, SV4).

[0016] Aspect 13: A braking system based on any one of the preceding aspects, wherein strictly only the outlet switching valve (ZAV) switchably connects the braking circuits (BK1, BK2) to the reservoir (VB).

[0017] Aspect 14: A braking system based on any one of the preceding aspects, wherein each wheel brake (RB1, RB2, RB3, RB4) has strictly only the associated switching valve (SV1, SV2, SV3, SV4).

[0018] Aspect 15: A braking system according to any one of Aspects 1 to 12 or Aspect 14, having a second outlet switching valve (ZAV2) that is directly connected to the outlet of the pressure supply device (DV) or the associated check valve (RV3) and is switchably connected to the reservoir (VB). In particular, strictly speaking, only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuits (BK1, BK2) to the reservoir (VB). The second outlet switching valve (ZAV2) is another means for enhancing safety.

[0019] Aspect 16: A braking system according to any one of Aspects 1 to 10 or Aspects 13 to 15, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via a bypass switching valve (BP1) and another bypass switching valve (BP2) connected in series, and an outlet switching valve (ZAV) is connected to the pipeline section between the two bypass switching valves (BP1, BP2).

[0020] Aspect 17: A braking system according to any one of the preceding aspects, additionally having a shut-off switching valve (TV) that is directly connected to the outlet of the pressure supply device (DV) or the associated check valve (RV3) and is directly connected to at least one of the switching valves (SV1, SV2).

[0021] Aspect 18: A braking system according to any one of the preceding aspects, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ). The system described herein can meet at least the requirements of Level 2 according to SAE J3016 even when equipped with a single master cylinder designed to be fail-safe.

[0022] Aspect 19: A braking system according to any one of the preceding aspects, wherein the braking system further has a stroke simulator (WS).

[0023] Aspect 20: A braking system according to Aspect 19, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the double master cylinder (DHZ) via an arbitrarily switchable stroke simulator shut-off valve (14).

[0024] Aspect 21: A braking system according to any one of the preceding aspects, wherein the single master cylinder (SHZ) or the double master cylinder (DHZ) has a force-stroke sensor (KWS), or the single master cylinder (SHZ) or the double master cylinder (DHZ) does not have a force-stroke sensor (KWS).

[0025] Aspect 22: A braking system according to any one of the preceding aspects, wherein the braking system is designed as a brake-by-wire system.

[0026] Aspect 23: A braking system according to any one of the preceding aspects, wherein the hydraulic brake pedal system has a vent opening connected to the reservoir (VB) via a parallel circuit of a throttle (Dr1) and a check valve (RV1) that closes towards the reservoir (VB). The throttle (Dr1) and the check valve (RV1) are used as redundant means for the primary seal (D2).

[0027] Aspect 24: A braking system according to any one of the preceding aspects, wherein the braking system further has an open-loop / closed-loop control unit (ECU) for performing open-loop and / or closed-loop control of the braking system.

[0028] Aspect 25: A vehicle braking system having the following components, namely: - at least two hydraulic brake circuits (BK1, BK2), each having at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4); - at least one pressure supply device (DV) connected to one of the brake circuits (BK1, BK2) via a hydraulic line; - One hydraulic wheel brake (RB1, RB2, RB3, RB4) each is switchably connected to one of two brake circuits (BK1, BK2), and switching valves (SV1, SV2, SV3, SV4) for each hydraulic wheel brake (RB1, RB2, RB3, RB4); - At least one hydraulic connection section that is switchable by at least one bypass switching valve (BP1) between two brake circuits (BK1 and BK2); - At least one hydraulic connection section that is switchable between at least one of the brake circuits (BK1, BK2) and a reservoir (VB) via at least one outlet switching valve (ZAV); - A hydraulic brake pedal system whose hydraulic outlet is switchably connected to at least one brake circuit (BK1, BK2) via a supply switching valve (FV); and has At least one pressure supply device (DV) has a rotary pump.

[0029] Aspect 26: A brake system according to Aspect 25, wherein the rotary pump is designed as a gear pump or as a multi-piston pump, in particular a three-piston pump.

[0030] Aspect 27: A brake system according to Aspect 26, wherein the pressure supply device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) that closes towards the pressure supply device (DV).

[0031] Aspect 28: A brake system according to Aspect 26, wherein the multi-piston pump is directly connected to at least one of the brake circuits (BK1, BK2), where being directly connected means that there is no valve or device affecting pressure between the multi-piston pump and at least one brake circuit (BK1, BK2), and optionally, one or more check valves may be incorporated into the multi-piston pump.

[0032] Aspect 29: A braking system based on any one of Aspects 25 to 28, wherein the pressure supply device (DV) has a motor, the motor is a brushless DC motor, and in particular has redundant windings and / or connections to a 2 x 3-phase control device.

[0033] Aspect 30: A braking system based on any one of Aspects 25 to 29, wherein the pressure supply device (DV) is part of a hydraulic control unit (HCU), and the hydraulic control unit (HCU) has only a single pressure supply means.

[0034] Aspect 31: A braking system based on any one of Aspects 25 to 30, wherein the pressure reduction in at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4) is effected by opening an outlet switching valve (ZAV) and an associated switching valve (SV1, SV2, SV3, SV4).

[0035] Aspect 32: A braking system based on any one of Aspects 25 to 31, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that open when electrically de-energized, the bypass switching valve (BP1) is a bypass switching valve that opens when electrically de-energized, the outlet switching valve (ZAV) is an outlet switching valve that closes when electrically de-energized, and the supply switching valve (FV) is a supply switching valve that opens when electrically de-energized.

[0036] Aspect 33: A braking system based on any one of Aspects 25 to 32, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected such that each switching valve (SV1, SV2, SV3, SV4) is opened by the residual pressure in the wheel brake (RB1, RB2, RB3, RB4) when the switching valve is electrically de-energized.

[0037] Aspect 34: A braking system based on any one of Aspects 25 to 33, wherein the two hydraulic brake circuits (BK1, BK2) have strictly one or more pressure sensors (DG).

[0038] Aspect 35: A braking system based on any one of Aspects 25 to 34, wherein the ABS and / or ESP control can be implemented via at least one switching valve (SV1, SV2, SV3, SV4) and an outlet switching valve (ZAV).

[0039] Aspect 36: A braking system based on any one of Aspects 25 to 35, wherein there is no valve between the outlet switching valve (ZAV) and at least one switching valve (SV3, SV4) of one of the brake circuits (BK2).

[0040] Aspect 37: A braking system based on any one of Aspects 25 to 36, wherein there is no valve between the bypass switching valve (BP1) and two, preferably all four, switching valves (SV1, SV2, SV3, SV4).

[0041] Aspect 38: A braking system based on any one of Aspects 25 to 37, wherein strictly only the outlet switching valve (ZAV) can switchably connect the brake circuits (BK1, BK2) to the reservoir (VB).

[0042] Aspect 39: A braking system based on any one of Aspects 25 to 38, wherein each wheel brake (RB1, RB2, RB3, RB4) has strictly only the associated switching valve (SV1, SV2, SV3, SV4).

[0043] Aspect 40: A braking system based on any one of Aspects 25 to 37 or on Aspect 39, wherein there is a second outlet switching valve (ZAV2) that is directly connected to the outlet of the pressure supply device (DV) or to the associated check valve (RV3) and is switchably connected to the reservoir (VB), and in particular strictly only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) can switchably connect the brake circuits (BK1, BK2) to the reservoir (VB).

[0044] Aspect 41: A braking system based on any one of Aspects 25 to 35 or Aspects 38 to 40, wherein two hydraulic brake circuits (BK1, BK2) are connected to each other via a bypass switching valve (BP1) connected in series and another bypass switching valve (BP2), and an outlet switching valve (ZAV) is connected to a pipeline section between the two bypass switching valves (BP1, BP2).

[0045] Aspect 42: A braking system based on any one of Aspects 25 to 41, further comprising a shut-off switching valve (TV) directly connected to an outlet of a pressure supply device (DV) or an associated check valve (RV3) and directly connected to at least one of switching valves (SV1, SV2).

[0046] Aspect 43: A braking system based on any one of Aspects 25 to 42, wherein the hydraulic brake pedal system has a single master cylinder (SHZ) or a double master cylinder (DHZ).

[0047] Aspect 44: A braking system based on any one of Aspects 25 to 43, wherein the braking system further has a stroke simulator (WS).

[0048] Aspect 45: A braking system based on Aspect 44, wherein the stroke simulator (WS) is connected to a single master cylinder (SHZ) or a double master cylinder (DHZ) via an optional switchable stroke simulator shut-off valve (14).

[0049] Aspect 46: A braking system based on any one of the preceding aspects, wherein the single master cylinder (SHZ) or the double master cylinder (DHZ) has a force-stroke sensor (KWS), or the single master cylinder (SHZ) or the double master cylinder (DHZ) does not have a force-stroke sensor (KWS).

[0050] Aspect 47: A braking system based on any one of Aspects 25 to 46, wherein the braking system is designed as a brake-by-wire system.

[0051] Aspect 48: A braking system based on any one of Aspects 25 to 47, wherein the hydraulic brake pedal system has a vent opening connected to a reservoir (VB) via a parallel circuit of a throttle (Dr1) and a check valve (RV1) that closes towards the reservoir (VB).

[0052] Aspect 49: A braking system based on any one of Aspects 25 to 48, wherein the braking system further has an open-loop / closed-loop control unit (ECU) for performing open-loop and / or closed-loop control of the braking system.

Brief Description of the Drawings

[0053]

Fig. 1a

Fig. 1b

Fig. 2

Fig. 3a

Fig. 3b

Fig. 3c

Fig. 3d

Fig. 4a

Fig. 4b

Fig. 4c

Fig. 5a

Fig. 5b

[0054] DETAILED DESCRIPTION Figure 1a shows the elements of a hydraulic brake system having a single master cylinder unit (SHZ) with a brake pedal (1), a single master cylinder and a reservoir (VB), having a pressure supply unit (DV), having an electronic control unit (ECU) and having one wheel brake (RB1, RB2, RB3, RB4) (not shown) with one wheel cylinder (RZ1, RZ2, RZ3, RZ4) per wheel. The pressure supply unit (DV) and the pressure supply unit are used synonymously here. Two wheel cylinders (RZ1, RZ2) are connected to a first brake circuit (BK1) via switching valves (SV1, SV2) respectively, and another two wheel cylinders (RZ3, RZ4) are connected to a second brake circuit (BK2) via switching valves (SV3, SV4) respectively. Instead of one switching valve per wheel cylinder, it is also possible to provide two or more switching valves per wheel cylinder. The pressure supply unit (DV) includes a pump and a brushless DC motor, and the brushless DC motor optionally has redundant windings and / or is connected to the electronic control unit (ECU) via 2×3 phases. The pump may be a plunger pump (not shown) with a spindle drive or a rotary pump, and the rotary pump may also be designed as a multi-piston pump (e.g., as a three-piston pump) or as a gear pump. In the case of a bidirectionally rotatable gear pump, the pressure supply unit (DV) can be connected to the first brake circuit (BK1) via a check valve (RV3) that closes towards the pressure supply unit (DV). In the case of a multi-piston pump that can only pump volume in one direction, the pressure supply unit (DV) can be connected directly (without RV3) to the first brake circuit (BK1). One or more check valves may be incorporated into the multi-piston pump. In the case of a plunger pump, a solenoid valve (not shown) is required instead of the check valve RV3. Furthermore, the plunger pump or the rotary pump can be connected to the reservoir (VB). The two brake circuits (BK1 and BK2) are connected to each other via a switchable bypass valve (BP1).The second brake circuit (BK2) is connected to the reservoir (VB) via a switchable central outlet valve (ZAV) and, via a switchable supply switching valve (FV), to the hydraulic outlet of the pressure chamber of the single master cylinder. As an alternative to the single master cylinder, a double master cylinder with corresponding connections as illustrated in FIGS. 5a or 5b may additionally be used to enhance safety. The pressure in one of the two brake circuits (e.g., BK2) can be measured by a pressure sensor (e.g., DG) provided in said brake circuit (e.g., BK2) and transmitted to the ECU. Optionally, another pressure in a brake circuit (e.g., BK1) can also be measured by another pressure sensor (e.g., DG2) and transmitted to the ECU. The hydraulic unit comprising the wheel cylinders (RZ1, RZ2, RZ3, RZ4), the switching valves (SV1, SV2, SV3, SV4), the two brake circuits (BK1, BK2), the pressure sensors (DG1, DG2), the bypass valve (BP1), the central outlet valve (ZAV), the pressure supply unit (DV), and, if present, the check valve (RV3) may be grouped into one so-called hydraulic control unit (HCU). In one preferred embodiment, the hydraulic control unit (HCU) has only one hydraulic supply means (DV).

[0055] Additionally, in the single master cylinder unit (SHZ), a stroke simulator (WS) can be connected to another hydraulic outlet of the single master cylinder (or the hydraulic line between the supply switching valve (FV) and the single master cylinder), with or without the switchable stroke simulator shut-off valve (14). The stroke simulator can transmit a predetermined pedal stroke-force characteristic to the brake pedal (1) via a slave piston, which can be displaced in a direction opposite to the arrangement of the return spring, for example, as a result of the operation of a foot-operated brake pedal (1). The hydraulic connection of the stroke simulator (WS) to the single master cylinder may be made, for example, by connecting a throttle (Dr2) and a check valve (RV2) in parallel, as shown in Fig. 1a, or in some other way. The movement of the pedal may be reduced when the pressure rises via the throttle Dr2, and during the exhaust of the stroke simulator (WS), it can bypass the throttle Dr2 via the check valve RV2.

[0056] In the normal state, especially when there are power supply means and a functional pressure supply means DV, the braking operation is performed by the driver's brake pedal movement. In this case, the supply switching valve (FV) is closed during the brake pedal movement and remains closed while the brake pedal (1) is depressed. Thus, the pedal system is hydraulically disconnected from the hydraulic control unit (HCU). Instead, the connection is made in a "brake-by-wire" format by a redundantly configured pedal travel sensor, an ECU, and a pressure supply unit DV. The pressure supply unit DV can send the brake fluid volume from the reservoir (VB) to the wheel cylinders (RZ1, RZ2, RZ3, RZ4) of both brake circuits (BK1, BK2) when the switching valves (SV1, SV2, SV3, SV4) are open, the bypass valve (BP1) is open, and the central outlet valve (ZAV) is closed, thereby increasing the brake pressure. If braking is to be performed only by the wheel cylinders (RZ1, RZ2) of the first brake circuit (BK1), the bypass valve (BP1) may be closed during normal braking operation according to the desired braking force and other peripheral conditions. The target pressure can be set by closed-loop control according to the pedal travel via at least one pressure sensor (DG) in one of the brake circuits (BK1, BK2) and / or via pulse-width modulation of the switching valves (SV1, SV2, SV3, SV4) and / or the bypass valve (BP1). A predetermined pedal travel-force characteristic is provided to the driver via a travel simulator (WS) and a return spring (RF) in the single master cylinder. This pedal travel-force characteristic is preferably always as constant as possible and does not depend on the brake pressure in the brake circuits (BK1, BK2). In particular, the combination of the travel simulator (WS) and the return spring (RF) in the "brake-by-wire" system prevents the brake pedal from dropping and returns the pedal to a predetermined starting position after the foot-transmitted operation. Thus, especially in the case of an electric vehicle or a hybrid vehicle, the recovery (regeneration) of braking energy in the electric traction motor can be disconnected from the brake pedal (1). In particular, the pedal travel-force characteristic is not affected even in an abnormal state, for example, when a failure occurs in the brake circuit.

[0057] When the brake pedal force is released, particularly when a rotary pump is used, the central outlet valve (ZAV) may be opened. Further, the switching valves (SV1, SV2, SV3, SV4) and / or the bypass valves (BP1, BP2) are opened completely or in accordance with a desired pressure reduction gradient by pulse width modulation (PWM) or a temporary stop (e.g., after a time Δt or after a differential pressure Δp) or in some other way. As a result, the brake fluid volume may be returned to the reservoir (VB) and the brake pressure may be reduced. When the piston (3) of the single master cylinder returns to a predetermined starting position after the operation of the foot-transmitted brake pedal (1) ends, the exchange of brake fluid between the pressure chamber of the single master cylinder and the reservoir (VB) may be performed, for example, by hydraulically connecting through the piston (3) and the radial leakage openings of the single master cylinder. This hydraulic connection may be performed by connecting a throttle (Dr1) and a check valve (RV1) in parallel, as shown in FIG. 1a, or in some other way. The seal of the pressure chamber in the single master cylinder may be realized by a primary seal (D2), a secondary seal (D1), and another redundant seal (not shown), in which case, particularly the primary seal (D2) may be attached to the inside of the single master cylinder or to the piston (3) of the single master cylinder.

[0058] In the normal state, the individual brake pressures for driving dynamics intervention means such as ABS or ESP can be set for each wheel by closed-loop control. For example, the closed-loop control function for ABS is as follows: pressure increase P build-up In which the closed-loop controller sends a signal that a brake cylinder of one wheel (e.g., RZ1) meets the criterion of, for example, excessive brake pressure, and then, in order to monitor this wheel, the pressure increase P build-up can be stopped or the pressure reduction P reductionThe brake pressure can be reduced thereby. In this case, the supply switching valve (FV) remains closed, and according to this embodiment, since the pump in the pressure supply unit (DV) cannot receive any volume from the brake circuit, the opening of the central outlet valve (ZAV) is, in one possible configuration, for depressurization P reduction the only option. When the central outlet valve (ZAV) is open, a plurality of different pressure reduction gradients can be preferably set via PWM control of the relevant switching valve (e.g., SV1) by closed-loop control. By the closed-loop controller, the depressurization P reduction is stopped, the central outlet valve (ZAV) is closed again. During depressurization P reduction it is also possible that two, three or four wheel cylinders are controlled simultaneously and based on wheel characteristics. During pressure increase P build-up similarly, it can be controlled as desired simultaneously and based on wheel characteristics in one wheel cylinder or two, three or four wheel cylinders.

[0059] In the case of intervention by a driving assistance system, which is usually a partially automated driving (level 2) such as in the case of an adaptive cruise control system or traffic jam assistance, the braking operation can be performed via the pressure supply unit (DV) without pedal operation by the driver. In this case, the brake pedal (1) is hydraulically disconnected from the above-mentioned intervention by the supply switching valve (FV) that is closed at this time.

[0060] Based on the so-called conventional three-box system (a braking system equipped with an ABS / ESP function, a vacuum brake booster, and an electric or mechanical vacuum pump) and the so-called conventional two-box system (a braking system equipped with an ABS / ESP function and an electric brake booster unit), the "brake-by-wire" braking system according to the present invention, which includes a stroke simulator (WS), an electric pressure supply unit (DV), and an ABS / ESP function, can be called a so-called one-box system. Such a high-level integration of the one-box system can reduce the installation space, weight, and cost of the entire structural unit, and furthermore, the installation and logistics can be optimized.

[0061] The valves FV, BP1, SV1, SV2, SV3, SV4 can be designed as electromagnetic valves that open when electrically shut off, while the valve ZAV and, if present, the stroke simulator shut-off valve (14) are preferably electromagnetic valves that close when electrically shut off. Further, the switching valves (SV1, SV2, SV3, SV4) are preferably connected to each wheel cylinder (RZ1, RZ2, RZ3, RZ4) via their outlet sides, whereby each switching valve (SV1, SV2, SV3, SV4) automatically opens based on the pressure in each wheel cylinder (RZ1, RZ2, RZ3, RZ4) when a failure occurs, for example, when a failure occurs in its electrical connection. With this valve configuration, in particular, when no power is supplied, the brake pedal (1) can be hydraulically connected to the wheel cylinders (RZ1, RZ2, RZ3, RZ4) via the open supply switching valve (FV), and it can be guaranteed that the brake pressure can be increased. Further, when there is a stroke simulator shut-off valve (14) that closes when electrically shut off, the stroke simulator (WS) can be disconnected from the brake pedal (1), whereby the pedal stroke can be reduced by, for example, about 40%.

[0062] All solenoid valves, especially the ZAV, can be designed as redundant valves and / or with redundant coils and / or with redundant controllers, thereby reducing the probability of valve failure. For example, if one failure occurs with a probability of 1e-6 per year, the redundancy with the same failure probability can reduce the annual failure probability to 1e-6 × 1e-6 = 1e-12.

[0063] Also, if there is a power supply means and the pressure supply unit (DV) is faulty, the valves FV, BP1, SV1, SV2, SV3, SV4 may be opened, and the valve ZAV and, if present, the stroke simulator shut-off valve (14) may be closed, whereby the brake pressure can be increased by the brake pedal operation. Alternatively, the bypass valve (BP1) may be closed, and sufficient brake pressure can still be increased in the second brake circuit (BK2) by the operation of the foot-transmitting brake pedal (1). A failure of the electric control device of the pressure supply unit (DV) can be classified as having no chance of occurring in a particularly preferred embodiment with a (single) multi-piston or gear pump and using redundant windings with 2×3-phase control. Since there is also no chance of a failure of the power supply means, the stroke simulator shut-off valve (14) may be omitted.

[0064] In the present invention, the braking system has various sensors, for example, in particular pressure sensors (DG, DG2), redundant pedal travel sensors (Sp1 and Sp2) for checking the pedal travel, a force-travel sensor (KWS) provided on the piston of a single master cylinder for checking the force-pedal travel characteristics, a fill level sensor element (6) for checking the fill level of the brake fluid in the reservoir (VB), a yaw rate sensor (GWS) for ESP intervention, or another sensor (for example, a temperature sensor) whose sensor value can be transmitted to the electronic control unit (ECU). Alternatively or additionally to the force-travel sensor (KWS), a pressure sensor (not shown) may be incorporated into the single master cylinder, and the pressure sensor can detect the pressure in the pressure chamber and transmit this to the ECU. Further, with regard to all solenoid valves, in particular valves SV1, SV2, SV3, SV4, BP1, ZAV, FV, 14, it is also possible to switch them by means of the electronic control unit (ECU), preferably via a redundant electronic control device or a redundant coil. In a single box device with ABS / ESP, the electronic control unit (ECU) can be attached to the hydraulic control unit (HCU) and can preferably be connected to the vehicle's on-board electrical system by means of a plug connector (13), in which case bus communication may be carried out, for example, by means of FlexRay or CAN or some other format.

[0065] The redundant pedal travel sensors (Sp1 and Sp2) can be realized in different forms. In FIG. 1a, two sensor rods are moved by the projections of the single master cylinder piston (3), and these sensor rods act on the redundant pedal travel sensors (Sp1 and Sp2). In order to prevent interference of the rods, a stop member can be accommodated in the projection of the piston (3). The redundant pedal travel sensors (Sp1 and Sp2) may be connected to two pistons and a spring between the two pistons. This has the advantage that in this way, force-travel measurement can be realized with additional advantages in terms of fault analysis, for example, with regard to jamming of the piston (3) (see also German Patent Application Publication No. 102010050132).

[0066] The following describes another fault condition, its consequences and its detection by diagnosis.

[0067] The loss of braking force caused by seal leakage in one of the wheel cylinders (RZ1, RZ2, RZ3, RZ4) can depend on various ambient conditions such as valve position, temperature, ventilation of the brake system, play in the wheel brakes (RB1, RB2, RB3, RB4), etc., and the boost pressure P build-up can be identified by comparison with a pre-determined pressure-volume characteristic curve for the boost pressure P, from additional acceptance of loss volume or additional delivery of volume by the pressure supply unit (DV). The wheel cylinder in which the loss of braking force occurs can be located using the following diagnosis: boost pressure P build-upAfter this occurs and all switching valves (SV1, SV2, SV3, SV4) are open, if there is residual pressure in the brake circuits (BK1, BK2), power is no longer supplied to the pressure supply unit (DV). After the bypass valve (BP1) is closed, the pressure measured by the pressure sensor (DG) in the second brake circuit (BK2) can be examined. If the pressure is dropping, it necessarily means that the wheel cylinder RZ3 and / or RZ4 is leaking. For example, by closing the switching valve SV3, if pressure drop occurs, leakage in the wheel cylinder RZ4 can be identified, or if the pressure is constant, leakage in the wheel cylinder RZ3 can be identified. On the other hand, if the pressure remains constant after the bypass valve (BP1) is closed, the wheel cylinders RZ3 and RZ4 can be identified as being in a sealed state. In this case, the bypass valve (BP1) is open and the switching valves SV1, SV3, and SV4 are closed. If the pressure is dropping, leakage in the wheel cylinder RZ2 can be identified, while if the pressure is constant, leakage in the wheel cylinder RZ1 can be identified. When the location of the wheel cylinder with a braking force loss (e.g., RZ1) is pinpointed, the relevant switching valve (e.g., SV1) may be closed before each braking operation until the unit is replaced during maintenance work, whereby deceleration can continue to be possible with two or three wheel cylinders (e.g., RZ2, RZ3, RZ4) that have a reduced but sufficient braking force for level 2 autonomous driving. As described above, if a small amount of leakage is identified in one wheel cylinder, this leakage can be compensated by replenishment by the pressure supply unit (DV) as an alternative to shutting off this wheel cylinder.

[0068] After all of the switching valves SV1, SV2, SV3, and SV4 are closed, the seals of the central outlet valve ZAV and the supply switching valve FV can be examined by alternately opening and closing the valve ZAV and the valve FV, preferably in a stopped state with or without volume delivery by the pressure supply unit (DV). If the location of possible leakage can be identified at ZAV or FV, for example, via pressure oscillations from the pressure supply unit (DV) and via the interaction between the filling level sensor element (6) in the reservoir (VB) and the movement of the pedal, the following means can each be distinguished: In the case of the central outlet valve (ZAV) that no longer seals, for example, blocked by dirt particles, or in the case where the central outlet valve (ZAV) can no longer close after a failure of the electric control device, the bypass valve (BP1) can be closed. In this case, sufficient braking pressure can still be increased by the pressure supply unit (DV) at least within the first brake circuit. On the other hand, in the case of the supply switching valve (FV) that no longer seals, for example, blocked by dirt particles, the bypass valve (BP1), the switching valves SV3 and SV4 in the second brake circuit (BK2), and the central outlet valve (ZAV) can be closed. Thereby, in principle, the deviation of the pedal characteristics in the single master cylinder that may occur due to leakage of the supply switching valve (FV) can be prevented, and sufficient braking pressure can still be increased by the pressure supply unit (DV) within the first brake circuit (BK1). If it is impossible to identify the location of leakage at ZAV or FV, the same procedure as in the case of leakage at FV can be used. Furthermore, if such a leakage flow is small, as described above, the leakage flow can be compensated by volume delivery by the pressure supply unit (DV).

[0069] If the central outlet valve (ZAV) fails to the extent that it can no longer open, the braking pressure can be reduced by opening the supply switching valve (FV) via the single master cylinder and the reservoir (VB). Alternatively, if a double master cylinder is used, another pressure chamber of the double master cylinder is connected to the hydraulic control unit via another supply switching valve (FV2), as shown in FIGS. 5a and 5b, and the pressure reduction P reductionFor this, both supply switching valves (FV, FV2) may be opened.

[0070] If one of the switching valves (SV3, SV4) in the second brake circuit, for example SV3, fails to the extent that it can no longer close, for example due to dirt particles, the bypass valve (BP1) may be closed, and in particular, sufficient braking force for level 2 autonomous driving can still be increased via the pressure supply unit (DV) in the first brake circuit (BK1). It is particularly advantageous when a fault occurs in one of the two brake circuits (BK1, BK2) in that the so-called diagonal arrangement of the braking force for the four wheels of the vehicle with respect to the arrangement of each brake circuit (BK1, BK2) between the front axle and the rear axle of the vehicle can result in a greater braking effect (for example, about 50% in the case of a diagonal arrangement compared to about 30% in the case of a front / rear axle arrangement when the front drive circuit fails). The diagonal arrangement of the braking force means that the front wheel brake on one side of the vehicle and the rear wheel brake on the other side of the vehicle are assigned to one brake circuit. The other diagonal wheel brakes are correspondingly assigned to the second brake circuit.

[0071] If one of the switching valves (SV1, SV2) in the first brake circuit, for example SV1, fails to the extent that it can no longer close, for example due to dirt particles, the bypass valve (BP1) may be closed and the supply switching valve (FV) may be opened, whereby sufficient brake pressure can still be increased in the second brake circuit (BK2) by the operation of the foot-transmitting brake pedal (1). If present, the stroke simulator shut-off valve (14) may also be additionally closed, whereby about 40% of the pedal stroke can be saved.

[0072] If the supply switching valve (FV) fails, for example, due to dirt particles, to the extent that it can no longer close, the second brake circuit can be disconnected by closing the switching valves SV3, SV4, the central outlet valve (ZAV), and the bypass valve (BP1). In this way, it is possible to prevent the deviation of the pedal stroke characteristics in the single master cylinder, and sufficient brake pressure can still be increased in the first brake circuit (BK1) via the pressure supply unit (DV). When the emergency brake is applied, after the switching valves (SV3, SV4) in the second brake circuit (BK2) are opened, the braking force in the wheel brakes (RB1, RB2, RB3, RB4) can be further increased by the operation of the foot-operated brake pedal (1). If the leakage flow in the supply switching valve (FV) is small and one of the wheel brakes (RB1, RB2, RB3, RB4) is blocked during the emergency brake, the ABS control may be performed via the central outlet valve (ZAV) and the pressure supply unit (DV).

[0073] If a pressure sensor (for example, DG) provided in one of the brake circuits (BK1, BK2) fails, another pressure sensor (for example, DG2) provided in one of the brake circuits (BK1, BK2), if present, can be used. If only one pressure sensor (DG) is provided in the brake system, the pressure in the brake circuits (BK1, BK2) may be set by closed-loop control via the current of the motor of the pressure supply unit (DV) according to a predetermined current-pressure relationship (for example, a characteristic map) stored in the ECU. In this case, these current-pressure relationships may include dependencies on various peripheral conditions, such as pressure increase P build-up or pressure decrease P reduction , the position of the solenoid valve, temperature, etc.

[0074] If the primary seal (D2) in the pressure chamber of the master cylinder fails, that is, if the primary seal (D2) is leaking, there is a possibility that the brake fluid in the master cylinder is leaking. This may have an uncontrollable effect (in this case, an increase) on the pedal stroke, and there is a risk that an excessive brake pressure will be increased by "brake-by-wire", resulting in an undesirable intense braking operation. Hereinafter, it is assumed that the master cylinder is a single master cylinder. In this case, the use of a tandem master cylinder is also possible in the same way. In order to avoid the possibility of a failure of the entire master cylinder, as shown in Fig. 1a, a connection to the reservoir (VB) of the single master cylinder may be made through a parallel connection of a check valve (RV1) that closes towards the reservoir and a throttle (Dr1). When the primary seal (D2) is leaking and the secondary seal (D1) is sealed, the leakage flow is blocked by the check valve (RV1) and throttled by the throttle (Dr1). As a result, the movement of the piston or the pedal is only extremely slight, and thus the deviation in the "brake-by-wire" braking operation is also only extremely slight. The throttle (Dr1) can be designed such that, for example, the movement of the pedal caused by leakage is about 0.2 mm / second. Therefore, in an average braking time of about 3 seconds for decelerating a vehicle at 100 km / h at 1g, a deviation of the pedal stroke of only 0.6 mm can occur, and this deviation is negligibly small with respect to the entire pedal stroke. The check valve (RV1) enables rapid filling of the brake system with brake fluid and rapid ventilation through the open vent screw in the wheel cylinders (RZ1, RZ2, RZ3, RZ4). The throttle (Dr1) also enables volume compensation in case of a temperature change.

[0075] A critical double failure consisting of the leakage of the primary seal (D2) that can no longer be throttled by the throttle (Dr1) and the potential individual failure of the additional secondary seal (D1) can be prevented by using another redundant primary seal and / or secondary seal (not shown). In the present invention, as shown in FIG. 1a, the seal of the secondary seal (D1) can be monitored by diagnosing at regular intervals (e.g., every time the vehicle stops). In the case where there is no stroke simulator (WS) or in the case of a stroke simulator (WS) that is switchably connected via a stroke simulator shut-off valve (14), the leakage may be assigned only to the secondary seal (D1) in this case. The procedure in one of these cases may be carried out, for example, as follows: When the residual pressure in the brake system flows into the single master cylinder via the open supply switching valve (FV) by switching the corresponding valve after the vehicle stops, it is possible to check the seals of the entire brake system, for example, for a period of 10 seconds, based on the pressure fluctuations detected by the pressure sensor (DG). In this case, the confirmed pressure drop indicates a leak. If such a leak is confirmed, after the switching valves (SV1, SV2, SV3, SV4) and, if present, the stroke simulator shut-off valve (14) are closed, a constant pressure of, for example, 20 bar can be supplied to the single master cylinder via the pressure supply unit (DV) for a predetermined time. The delivery volume in this case can be confirmed via the change in the angle detected by, for example, a rotor position sensor provided on the motor of the pressure supply unit (DV). If this delivery volume is greater than the known delivery volume of the throttle (Dr1) at, for example, 20 bar, the secondary seal (D1) can be evaluated as leaking. Therefore, the double failure in which both the primary seal (D2) and the secondary seal (D1) are leaking only occurs when there is no possibility of both seals (D1, D2) failing simultaneously during the stroke. In the case of a stroke simulator (WS) without a stroke simulator shut-off valve (14), due to some circumstances, it may not be possible to assign the detected leakage only to the secondary seal (D1) of the single master cylinder, similar to the described diagnosis.This is because leakage can also occur due to leakage of the stroke simulator seal (D3) of the stroke simulator (WS), and this can also result in a leakage flow into the reservoir (VB) via the connection part (not shown), based on the throttling due to the leakage of the stroke simulator seal (D3) and another throttling via another throttle (Dr3) between the stroke simulator seal (D3) of the stroke simulator (WS) and another redundant seal (Dr3). In this case, when leakage occurs in D1 or D3, since the configurations of the hydraulic resistances for the throttles Dr1 and Dr3 are different respectively, different leakage flows may occur through Dr1 and / or Dr3 to some extent, thereby enabling the diagnosis described below to identify the location of the leakage in D1 or D3. On the other hand, even without identifying the location of the leakage in D1 or D3, the potential failure in D1 or D3 can be avoided by replacing both seals (D1, D3) simultaneously, and in this way, the safety of the brake system can be guaranteed. The additional failure of the redundant primary seal (D3r) can be classified as a double failure with no likelihood of occurrence.

[0076] The reservoir (VB) may have two mutually redundant fluid chambers. The reservoir (VB) has a float (8) provided with a sensor target (7) in at least one fluid chamber, and the sensor target (7) can measure the filling level of the brake fluid in the reservoir (VB) in a substantially continuously changing manner together with the filling level sensor element (6) on the printed circuit board (5) of the electronic control unit (ECU) attached to the reservoir (VB). In this way, it is also possible to redundantly detect a small amount of leakage in the brake circuit, for example, leakage in D1 or one of the wheel cylinders RZ1 - RZ4. By integrating the filling level sensor element (6) into the electronic control unit (ECU), costs can be reduced.

[0077] Another embodiment of the braking system shown in FIG. 1b has another bypass valve (BP2), a shut-off valve (TV), and another (central) outlet valve (ZAV2). In this way, the safety within the braking system can be enhanced, particularly with regard to double failures.

[0078] Another bypass valve (BP2) may be incorporated into the second brake circuit (BK2), such that in the event of a failure in the second brake circuit (BK2), the second brake circuit (BK2) having wheel cylinders RZ3 and RZ4 can be disconnected from the rest of the braking system. As shown in FIG. 1b, for example, the second bypass valve (BP2) can be incorporated into the hydraulic line between the first bypass valve (BP1) and the pressure sensor (DG) within the second brake circuit (BK2), in which case the central outlet valve (ZAV) can be connected to the second brake circuit (BK2) via the second bypass valve (BP2). The combination of the two bypass valves (BP1, BP2) can be referred to as a safety gate (SIG), also in the case where there is the possibility of an extension by means of the shut-off valve (TV).

[0079] The shut-off valve (TV) may be incorporated into the first brake circuit (BK1), such that in the event of a failure (e.g., a double failure of RZ and SV) in the first brake circuit (BK1), the first brake circuit (BK1) having wheel cylinders RZ1 and RZ2 can be disconnected from the rest of the braking system. As shown in FIG. 1b, for example, the shut-off valve (TV) can be incorporated into the hydraulic line between the pressure supply unit (DV) or, if present, the check valve (RV3) or solenoid valve provided in the pressure supply unit (DV), and the switching valves (SV1, SV2) of the first brake circuit (BK1). Furthermore, a redundant pressure sensor (DG2) (not shown) can be connected to the first brake circuit (BK1).

[0080] Another central outlet valve (ZAV2) may be incorporated into the braking system so that it can redundantly reduce the pressure in the braking system with respect to the central outlet valve (ZAV). As shown in Figure 1b, said another central outlet valve may be connected, for example, to a hydraulic line between a shut-off valve (TV) and a pressure supply unit (DV) or, if present, a check valve (RV3) or solenoid valve provided in the pressure supply unit (DV). For safety reasons, the central outlet valves ZAV and ZAV2 should be connected to separate parts of the reservoir (VB). The central outlet valve ZAV2 may be connected to the reservoir (VB) via, for example, another opening provided in the master cylinder and an annular leakage opening provided in the piston (3), as shown in Figure 1b.

[0081] The second bypass valve (BP2) and the shut-off valve (TV) can be designed as solenoid valves that open when electrically shut off, whereas the other central outlet valve (ZAV2) can be designed as a solenoid valve that closes when electrically shut off. The second bypass valve (BP2) and the shut-off valve (TV) can further be connected to the second brake circuit (BK2) and the first brake circuit (BK1), respectively, via their outlet sides, so that, if a failure occurs in the valve control device (for example, when power is not supplied), the second bypass valve (BP2) and the shut-off valve (TV) can be opened by the residual pressure in the brake circuits (BK1, BK2). Thus, as in the case of the braking system in Figure 1a, it is possible that the braking operation can be performed by the operation of the foot-operated brake pedal (1) even when power is not supplied.

[0082] If one of the two (central) outlet valves (ZAV, ZAV2) (for example, ZAV) fails to the extent that it can no longer open, decompression P reduction can be carried out via the other central outlet valve (ZAV2). In this case, unlike the situation in Figure 1a, the supply switching valve (FV) does not have to be opened, whereby the "brake by wire" function can be maintained, and in particular, the deviation of the pedal travel characteristic and thus the influence on the movement of the pedal can be avoided.

[0083] In one embodiment according to the invention, another central outlet valve (ZAV2) further reduces the pressure P by closed-loop control independently in each of two wheel cylinders (RZ1, RZ2 and RZ3, RZ4) per brake circuit (BK1, BK2) during driving dynamics intervention (e.g., ABS). reduction It has the advantage that it can be set.

[0084] If the supply switching valve (FV) can no longer close (e.g., due to dirt particles or a fault in the electrical connection), safety can be enhanced via the second bypass valve (BP2). In such a case, the single master cylinder may be disconnected from the brake system by closing both bypass valves (BP1, BP2), and sufficient brake pressure can still be increased within the first brake circuit (BK1) via the pressure supply unit (DV). In this case, the pressure reduction P reduction may be effected, for example, via another (central) outlet valve ZAV2. When the emergency brake is applied, the braking force can be further increased in the second brake circuit (BK2) after opening the second bypass valve (BP2) by the operation of the foot-operated brake pedal (1). Thereby, it is possible to achieve, for example, a braking operation of about 75% of a complete normal braking operation. If the leakage due to the supply switching valve (FV) no longer being able to close is small, the pressure reduction P reduction (and the pressure increase pressure increase P build-up ) for ABS intervention can still be carried out.

[0085] In addition to the primary seal (D2) and the secondary seal (D1), the single master cylinder may further have redundant primary and / or secondary seals, in particular the redundant primary seal (D2r) shown in FIG. 1b.

[0086] The leakage opening provided between the primary seal (D2) and the secondary seal (D1) within the single master cylinder is the so-called diagnostic valve (V Dcan be connected to the reservoir (VB) via ( ). The pressure reduction P in the brake circuits (BK1, BK2) reduction If a failure occurs that cannot be carried out via the (central) outlet valve (ZAV, and if present, ZAV2), the pressure may be reduced by venting it into the reservoir (VB) via the open supply switching valve (FV) and the single master cylinder. In Figure 1a, based on the parallel connection of the throttle (Dr1) and the check valve RV1 at the hydraulic connection of the single master cylinder to the reservoir, the pressure reduction P reduction can only be carried out by a very small volume flow rate, whereas in the case of the pressure reduction P in Figure 1b reduction , a relatively large volume flow rate can be returned to the reservoir (VB), and this supplied volume flow rate is less than the pre-determined closed volume flow rate by the configuration of V D . By appropriate control of the relevant solenoid valves (e.g., SV1, SV2, SV3, SV4, BP1, BP2, FV), such as pulse width modulation (PWM), the pressure reduction P D can be carried out so as not to exceed the limiting volume flow rate of the diagnostic valve (V reduction ), and thus the diagnostic valve (V D ) remains open during pressure reduction. On the other hand, the diagnosis for monitoring the seal of the master cylinder, i.e., the secondary seal (D1), as described in Figure 1a can also be carried out by the diagnostic valve (V D ). In this case, a volume flow rate exceeding the closed volume flow rate of V D is carried into the master cylinder by the pressure supply unit (DV). Because when the diagnostic valve (V D ) is closed, it is possible to determine that it is sealed via the pressure characteristic curve detected by the pressure sensor (DG). To enhance safety in Figure 1a with a single central outlet valve (ZAV), the hydraulic connection between the single master cylinder and the reservoir (VB) may be replaced by the connection to the diagnostic valve (V D ) shown in Figure 1b.

[0087] In contrast to FIG. 1a, a redundant primary seal (D2r) may be used to protect the primary seal (D2) in the master cylinder that is not protected by the combination of the throttle (Dr1) and the check valve (RV1). The diagnosis of the primary seal may be performed during the braking operation via the force-stroke sensor (KWS) and the pedal stroke sensors (Sp1, Sp2). Alternatively, the diagnosis of the primary seal may be performed via the pressure sensor in the single master cylinder and the pedal stroke sensors (Sp1, Sp2).

[0088] FIG. 2 shows one possible embodiment of a back pressure valve that can be used, for example, as the diagnostic valve (V D ) in FIG. 1b. The back pressure valve may have two openings, in which case one of the two openings may have a valve seat and preferably an opening cross-section larger than that of the other opening. Further, the back pressure valve may have a plunger provided with a sealing ball (18), in which case, when no liquid is flowing, the plunger can be tightened in the valve housing by a spring (F) such that the sealing ball (18) cannot preferably close the valve seat of the larger opening. In contrast, when the liquid flows through the opening without a valve seat to the opening with a valve seat, based on the predetermined geometry of the opening, the valve seat and the sealing ball (18), a back pressure can be generated when the so-called closed volume flow rate is exceeded, and this back pressure pushes the sealing ball (18) into the valve seat and thus closes the valve in this direction. When the diagnostic valve (V D ) closes at a volume flow rate exceeding the closed volume flow rate, the diagnostic valve (V D ) can open again in the same flow direction when it falls below another predetermined open volume flow rate determined by the configuration of V D . In the other flow direction, the brake fluid may be carried through the valve without a closing operation.

[0089] Figures 3a to 3c show various embodiments according to the invention for a so-called fail-safe single master cylinder unit (SHZ) provided in a braking system according to the invention. The protection means described below can equally be used in a tandem master cylinder unit (THZ). The single master cylinder units (SHZ) described in connection with Figures 3a to 3c can each be used in a system according to Figures 1a to 1b, Figures 4a to 4c and Figures 5a to 5b.

[0090] Figure 3a shows one embodiment of a single master cylinder unit (SHZ) having a further redundant secondary seal (D1r) for protecting the seal of the master cylinder against the outside, with respect to Figure 1a. The master cylinder further has another opening between the secondary seal (D1) and the redundant secondary seal (D1r), and the other opening is connected to a reservoir (VB) via a throttle (Dr4). The seal of the secondary seal (D1) can also be diagnosed via this connection.

[0091] Figure 3b shows one embodiment of a single master cylinder unit (SHZ) with respect to the connection of the master cylinder to a reservoir (VB), corresponding to that shown in Figure 1b.

[0092] Figure 3c shows one embodiment of a single master cylinder unit (SHZ) having a redundant primary seal (D2r) and optionally a redundant secondary seal (D1r). In addition to the leakage opening between the primary seal (D2) and the secondary seal (D1), the master cylinder may have another opening between the primary seal (D2) and the redundant primary seal (D2r), in which case the two openings may be connected via a single hydraulic line, which hydraulic line may also be connected to a reservoir (VB) via a switchable reservoir shut-off valve (17). The reservoir shut-off valve (17) can be regarded as redundant means for the pressure chamber seal. This is because the reservoir shut-off valve (17) may be closed if a leak occurs in one of the primary seals (D2, D2r). The reservoir shut-off valve (17) in Figure 3c can be designed as a solenoid valve that opens when electrically shut off. Thereby, the brake system can be filled and vented even in the electrically shut-off state.

[0093] Similar to the case of the combination of the throttle and the check valve shown in Figures 1a and 3a, it is further possible that the diagnosis of the seal of the master cylinder against the outside, i.e., the secondary seal (D1), is performed via the residual pressure or the pressure supply unit (DV) when the reservoir shut-off valve (17) is closed in the stopped state. In the case of another opening of the master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r) connected to the reservoir (VB) via another redundant secondary seal (D1r) and a throttle (Dr4), the leakage flow passing through Dr4 can be considered in the diagnosis.

[0094] A plurality of other openings may be provided between different redundant primary seals, and these other openings may also be connected to the reservoir (VB) via the reservoir shut-off valve (17).

[0095] In this case, fail-safe generally means that individual failures of elements of the braking system are protected by redundant means and that failures of elements of the braking system or of the redundant means can be determined by diagnosis. An individual failure (or individual defect) is one failure (or defect) of only one element of the braking system. On the other hand, a double failure (or double defect) or multiple failure (or multiple defect) refers to failures (or defects) of two or more elements of the braking system. Generally, double or multiple defects can be tolerated if the likelihood of their occurrence is extremely low. However, double defects that could lead to a failure of the entire braking system should be avoided in a fail-safe system. When so-called potential individual defects, each leading to a double defect together with another individual defect, are protected or confirmed by redundant additional diagnosis, double defects in the fail-safe system can be avoided.

[0096] The single master cylinder is fail-safe if the pressure chamber seal of the master cylinder is fail-safe. In the normal, i.e., defect-free state, the pressure chamber seal of the single master cylinder is realized, for example, by the primary seal (D2) of the single master cylinder. An individual failure of the pressure chamber seal of the single master cylinder caused, for example, by a leak of the primary seal (D2) could lead to a failure of the entire braking system. Thus, the desired fail-safe requires at least one redundant means for the pressure chamber seal and at least one diagnosis of the pressure chamber seal or of the redundant means of the pressure chamber seal. The fail-safe master cylinder can be used at levels 3 to 4 according to SAE J3016 standard.

[0097] At least one redundant means required for the pressure chamber seal is, for example, - As shown in FIGS. 1a and 3a, by means of a combination of a throttle (D1r) provided at the connection of the master cylinder to the reservoir (VB) and a check valve (RV1), via the throttle described above with a pedal travel change that can be ignored in this case, - Or as shown in FIGS. 1b, 3b and 3c, via a second redundant primary seal (D2r). - or, as in Figure 3c, by closing the switchable reservoir shut-off valve (17) connecting the leakage opening of the single master cylinder to the reservoir (VB) can be achieved.

[0098] (apart from at least one further diagnosis that may be required) While one redundancy means is sufficient for fail-safe operation of the master cylinder, the redundancy means may be suitably combined to enhance safety. For example, a separate redundant primary seal (e.g., D2r) that does not rely on the redundancy means (combination of Dr1 / RV1 or reservoir shut-off valve 17) provided at the connection of the master cylinder to the reservoir (VB) may be used. In principle, it is also conceivable to combine the combination of Dr1 / RV1 and the reservoir shut-off valve 17.

[0099] At least one diagnosis of the pressure chamber seal or the redundancy means of the pressure chamber seal may be performed as a diagnosis of the pressure chamber seal, for example - as in Figures 1b, 3b and 3c, the seal of the primary seal (D2) is monitored during the braking operation, i.e., during the foot-transmitted operation, by a force-stroke sensor (KWS) provided on the piston of the master cylinder or a pressure sensor provided in the pressure chamber of the master cylinder that measures the pedal force (F P ) or the pressure in the pressure chamber, respectively, and the pedal force (F P ) or the pressure is analyzed according to the movement of the piston (3) detected by the pedal travel sensors (Sp1, Sp2); or it may be performed as a diagnosis of the redundancy means of the pressure chamber seal, for example - as in Figures 1a and 3a, by comparing the return to the reservoir (VB), which can be confirmed, for example, via the delivery volume of the pressure supply unit (DV) and / or the change in the filling level in the reservoir (VB), with the blocking by the possible check valve (RV1) and the throttling by the throttle (Dr1), the combination of the throttle (Dr3) and the check valve (RV1) can be diagnosed by the residual pressure in the brake system or by the pressure supply unit (DV), as described above, in the stationary state of the vehicle, preferably when parked; - Or, as in Figure 3c, the seal of the switchable reservoir shut-off valve (17) can be checked via the pressure supply unit (DV) and the corresponding valve positions (e.g., closed SV1, SV2, SV3, SV4, ZAV, 14 and open BP1, FV), optionally taking into account the fill level sensor in the reservoir (VB).

[0100] Regarding the diagnosis preferably carried out in the stopped state of the vehicle when parked, safety may be enhanced by the braking operation and thus in particular by the diagnosis carried out during several strokes. Another redundant primary seal (e.g., D2r) in the master cylinder can likewise be diagnosed by means of a force-stroke sensor (KWS) and / or a pressure sensor provided in the pressure chamber of the master cylinder.

[0101] As is customary in "brake-by-wire" systems, when the brake system is connected to a stroke simulator (WS), the stroke simulator (WS) should also be of a fail-safe design. The stroke simulator (WS) is fail-safe if the pressure chamber seal of the stroke simulator (WS) is fail-safe. In the normal, i.e., defect-free state, the pressure chamber seal of the stroke simulator (WS) is realized, for example, by the stroke simulator seal (D3) of the stroke simulator (WS). An individual failure of the seal of the stroke simulator pressure chamber, caused, for example, by leakage of the stroke simulator seal (D3), can also lead to a failure of the entire brake system. Thus, the desired fail-safe requires at least one redundant means for the pressure chamber seal and at least one diagnosis of the pressure chamber seal or the redundant means of the pressure chamber seal.

[0102] At least one redundant means required for the pressure chamber seal is, for example - Can be realized by a second redundant stroke simulator seal (D3r); - Alternatively, as shown in FIGS. 1a, 1b, 3a, 3b and 3c, it can be achieved by means of a second redundant stroke simulator seal (D3r) and a throttle (Dr3) between the stroke simulator seal (D3) and the redundant stroke simulator seal (D3r), in this case with a gentle pedal stroke change, as well as the throttle of the leakage described above.

[0103] At least one diagnosis of the pressure chamber seal of the stroke simulator or the redundant means of the pressure chamber seal may be carried out as a diagnosis of the pressure chamber seal, for example - As shown in FIGS. 1b, 3b and 3c, the force (F P ) or pressure is measured respectively by a force-stroke sensor (KWS) provided on the piston of the master cylinder or a pressure sensor provided in the pressure chamber of the master cylinder. During the braking operation, that is, during the foot transmission operation, the seals of the stroke simulator seal (D3) (and the primary seal (D2)) are monitored, and the pedal force (F P ) or pressure is analyzed respectively according to the movement of the piston (3) detected by the pedal stroke sensors (Sp1, Sp2); - Alternatively, as shown in FIGS. 1a, 1b, 3a, 3b and 3c, for example, the return to the reservoir (VB) which can be confirmed through the delivery volume of the pressure supply unit (DV) and / or the change in the filling level in the reservoir (VB) is compared with the possible cut-off by the check valve (RV1) and the throttling by the throttles (Dr1, Dr2), taking into account the filling level sensor in the reservoir (VB) if necessary, at the corresponding valve positions. The seal of the stroke simulator seal (D3) is preferably monitored by the residual pressure in the brake system or the pressure supply unit (DV) when the vehicle is in a stopped state, preferably when parking. - Alternatively, as shown in FIG. 3c, the seal of the stroke simulator seal (D3) can be confirmed through the pressure supply unit (DV) and the corresponding valve positions (for example, closed SV1, SV2, SV3, SV4, ZAV, 17 and open BP1, FV, 14), taking into account the filling level sensor in the reservoir (VB) if necessary.

[0104] To enhance safety, multiple diagnoses may be appropriately combined.

[0105] Normally, the location of the leak in the diagnosed and connected pressure chamber cannot be pinpointed based on the hydraulic connection between the pressure chamber of the master cylinder and the stroke simulator (WS). This is because this leak may be caused by, for example, both a leak in the primary seal (D2) of the master cylinder and a leak in the stroke simulator seal (D3). This is sufficient for fail-safe as long as both seals (D2, D3) are sealed for the diagnosed seal in the connected pressure chamber. If there is a stroke simulator shut-off valve (14), any leak location in the stroke simulator (WS) or the master cylinder can be pinpointed.

[0106] The safety requirements for the seal of the single master cylinder against the outside, which can be implemented, for example, via the secondary seal (D1) in the normal state, do not have to be stricter than those for the seal of the master cylinder pressure chamber. This is because, on the one hand, the secondary seal (D1) is not subjected to high pressure, and on the other hand, the consequences of a defect are not very critical. In contrast to the stricter requirements for fail-safe, safety is guaranteed if at least one redundant means of an element and / or one failure of an element can be diagnosed.

[0107] An individual failure of the seal of the single master cylinder against the outside, which may lead to a loss of brake fluid, for example, a leak in the secondary seal (D1), can be protected redundantly, for example, - as shown in Figures 3a and 3c, by a second redundant secondary seal (D1r), - Alternatively, as in FIGS. 3a and 3c, another opening of the single master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r) can be protected by throttling with another throttle (Dr4) that connects to the reservoir (VB) with a gentle leak in this case, and the gentle leak can also be monitored, for example, via a change in the level of the brake fluid in the reservoir (VB) when the vehicle is in a stationary state.

[0108] Furthermore, during an operation where no braking operation is performed, in particular during a non-braking operation referring to a stationary state of the vehicle (e.g., when parking), the seal of the secondary seal (D1) can be verified or diagnosed, that is, - As already described above in FIGS. 1a and 3a, the volume is carried into the reservoir (VB) via the master cylinder by the residual pressure in the brake circuits (BK1, BK2) in the first stage and by the pressure supply unit (DV) in the second stage, and at the pressure set by the closed-loop control, the delivery volume of the pressure supply unit (DV) is compared with the normal assumable throttle flow. - Or as already described above in FIGS. 1b and 3b, the volume is carried into the reservoir (VB) via the master cylinder by the pressure supply unit (DV) with a fluid flow exceeding the closed volume flow rate of the diagnostic valve (V D ), and the pressure characteristics detected by the pressure sensor (DG) are analyzed. - Or as in FIG. 3c, the volume is carried into the reservoir (VB) via the master cylinder by the pressure supply unit (DV) with a fluid flow, at this time the reservoir shut-off valve (17) is closed, and at the pressure set by the closed-loop control, the delivery volume of the pressure supply unit (DV) is compared with the normal assumable throttle flow passing through the throttle (Dr4).

[0109] To enhance safety, redundant means and diagnosis can be combined in various suitable ways. In diagnosis, the filling level sensor (6) in the reservoir (VB) can also be used, either similarly or additionally, to confirm leaks.

[0110] The sealing of the supply switching valve (FV) in the closed state, i.e., the sealing of the supply switching valve (FV) which is usually performed by, for example, the sealing of the valve seat, does not necessarily have to be stricter than the safety requirements for the sealing of the master cylinder pressure chamber. This is because the consequences of the defect are not very critical. In contrast to the stricter requirements for fail-safe, safety is guaranteed if at least one redundant means of the element and / or one failure of the element can be diagnosed.

[0111] For example, if an individual failure of the seal of the supply switching valve (FV) occurs, which is caused by dirt particles and may impair the "brake-by-wire" function and distort the force-stroke characteristics of the brake pedal system, it can be, for example, via redundant means, i.e., - via another solenoid valve (not shown) directly connected, - or, as already described in FIGS. 1a, 1b, 3a, 3b, 3c, by closing the solenoid valves ZAV, SV3, SV4, BP1 or optionally ZAV, BP1, BP2 to deactivate the second brake circuit (BK2), sufficient braking force can still be supplied via the first brake circuit (BK1) (for example, 50% of the braking operation still continues to depend on the wheel arrangement).

[0112] Furthermore, as in FIGS. 1a, 1b, 3a, 3b and 3c, preferably during non-braking operation, the sealing of the closed supply switching valve (FV) can be determined via the pressure supply unit (DV) and the pedal stroke change. To enhance safety, redundancy means and diagnosis can be combined in various appropriate ways.

[0113] If the (central) outlet valves (ZAV, ZAV2) in the hydraulic control unit (HCU) can no longer be opened, the pressure reduction P via the master cylinder reduction can only be performed by throttling (via Dr1) in FIGS. 1a and 3a, whereas in FIGS. 1b, 3b and 3c, the pressure reduction P reduction can be performed with less throttling via the master cylinder.

[0114] The hydraulic connection between at least one hydraulic outlet of the master cylinder and the supply switching valve (FV) may be effected via a backpressure valve (19), as shown in FIGS. 3b and 3c. The backpressure valve (19) blocks the main outlet, for example based on a backpressure action, in the flow direction from the master cylinder to the hydraulic control unit when an excessively high pedal force (greater than about 500 N) occurs, but maintains the second throttle outlet by a throttle point arranged on the valve plate (20). Based on the perforated valve plate (20) in the backpressure valve (19), it is configured and connected to form a throttle.

[0115] FIG. 3d illustrates the force - stroke characteristic line (21) of the pedal of the brake pedal (1) of the single master cylinder unit (SHZ) in FIG. 3c. In this case, the pedal stroke (Sp) is entered relative to the full pedal stroke. The return force of the brake pedal (1) is generated by the return spring (RF1) in the master cylinder (up to the 10% range in FIG. 3d) and by an elasticity controllable in the stroke simulator (WS) (from the 40% range in FIG. 3d). To prevent the brake pedal (1) from dropping in the case of a defect in the seal of the pressure chamber of the master cylinder or the stroke simulator (WS), another return spring (RF2) may be incorporated in the master cylinder. The other return spring increases the gradient of the force - stroke characteristic line of the brake pedal (1), for example, from approximately 10% of the pedal stroke.

[0116] One preferred embodiment of the brake system according to the invention can be derived from FIG. 3b. In this case, at the connection of the master cylinder to the reservoir (VB), the diagnostic valve V Dis omitted, i.e., the master cylinder is directly connected to the reservoir (VB) via a leakage opening between the primary seal (D2) and the secondary seal (D1). The single master cylinder of this embodiment is fail-safe by virtue of the redundant primary seal (D2r), the redundant stroke simulator seal (D3r), and the force-stroke sensor (KWS) based on the above description. The leakage of the secondary seal (D1) can be diagnosed by a filling level sensor element (6) provided in the reservoir (VB) or on the printed circuit board when the vehicle is in a stopped state. Further, the secondary seal (D1) can be checked for leakage by supplying compressed air, for example at 5 bar, to the reservoir (VB) with the valves FV, ZAV and, if present, ZAV2, AV1 - 4 as well as the stroke simulator shut-off valve closed during maintenance work (for example every 2 - 3 years).

[0117] Figure 4a shows another embodiment of a braking system according to the invention, in which, compared to Figures 1a and 1b, the pressure supply device (DV) has a two-circuit double-acting piston pump instead of a rotary pump. The two-circuit double-acting piston pump may have one piston, two pressure chambers provided one each in front of and behind the piston, and one central rod. In this case, the piston may be moved bidirectionally via the central rod and a transmission device provided with an electric drive device. For example, the transmission device may be realized as a ball screw drive device, and the electric drive device may be realized as a brushless DC motor or in some other form. Each component of the pressure supply unit (DV) described in connection with Figures 4a - 4c and Figures 5a - 5b can be used in or with the system according to the invention shown in Figures 1a - 1b and Figures 3a - 3c.

[0118] As is well known in the prior art, the connection of wheel cylinders (e.g., RZ1, RZ2) to a single brake circuit (e.g., BK1) can be realized via one switchable inlet valve (e.g., EV1, EV2) each. In this case, the wheel cylinders (e.g., RZ1, RZ2) can be connected to the reservoir (VB) via one switchable outlet valve (e.g., AV1, AV2) each. The inlet valve or the outlet valve may be regarded as a switching valve. Alternatively, the connection of wheel cylinders (e.g., RZ3, RZ4) to a brake circuit (e.g., BK2) as in FIGS. 1a and 1b can be realized via a single switching valve (e.g., SV3, SV4) each. In this case, at least one brake circuit can be switchably connected to the reservoir (VB) via a central outlet valve (ZAV) and optionally another valve. Such a connection can reduce the number of solenoid valves, thereby saving costs.

[0119] One of the two pressure chambers of the double-acting piston pump can be connected to the first brake circuit (BK1) via the hydraulic outlet of the pump, a check valve (RV3) that closes towards the pressure supply unit (DV), and optionally another valve. Further, the pressure chamber can be connected to the reservoir (VB) via the suction replenishment inlet (leakage opening or opening) of the pump, another check valve (RV6) that closes towards the reservoir (VB), and optionally another valve. Similarly, the other pressure chamber can be connected to the second brake circuit via another hydraulic outlet of the pump, a check valve (RV4) that closes towards the pressure supply unit (DV), and optionally another valve. Further, the pressure chamber can be similarly connected to the reservoir via another suction replenishment inlet (leakage opening or opening) of the pump, another check valve (RV5) that closes towards the reservoir (VB), and optionally another valve. A pump with two suction replenishment inlets, two hydraulic outlets, and a piston can be designed such that brake fluid can be sent from the reservoir (VB) to at least one of the two brake circuits (BK1, BK2) in both movement directions of the piston, i.e., both during the forward stroke and the return stroke, thereby increasing the brake pressure. In this case, by definition, the forward stroke refers to the movement direction of the piston that pushes out brake fluid from the pressure chamber on the side opposite to the central rod of the piston (via RV3 in Figure 4a). On the other hand, the return stroke refers to the movement direction of the piston that pushes out brake fluid from the other pressure chamber (via RV4 in Figure 4a). In this case, the effective piston range of the piston can be smaller than the effective piston range of the piston during the forward stroke.

[0120] Depending on the embodiment, the two brake circuits (BK1, BK2) can be switchably connected to each other via a bypass valve (BP1) as in FIG. 1a or via two bypass valves (BP1, BP2) connected in series as in FIG. 1b and optionally another valve. Thereby, during the forward stroke of the piston in the pressure supply unit (DV), the brake pressure can be selectively increased in the first brake circuit (BK1) or in both brake circuits (BK1, BK2). Similarly, during the reverse stroke of the piston in the pressure supply unit (DV), the brake pressure can be selectively increased in the second brake circuit (BK2) or in both brake circuits (BK1, BK2).

[0121] This is also common in brake systems. For a single-acting piston pump (not shown) that can deliver volume into the brake system only in one stroke direction (forward stroke), the brake system according to the invention having a double-acting piston pump as in FIG. 4a and an exemplary connection can save the time spent in the case of a single-acting piston pump where the piston has to be retracted wholly or partly with the hydraulic outlet of the pressure chamber closed before the additional delivery of the required brake liquid volume is carried out. During such an empty reverse stroke, pressure cannot be supplied to the brake system via the pressure supply unit (DV). In contrast, in the brake system according to the invention with a double-acting piston pump as in FIG. 4a, the brake pressure can be continuously supplied to the brake circuits (BK1, BK2) by the forward and reverse strokes alternating. In this way, in particular, the structural length of the double-acting piston pump can be shortened.

[0122] On the other hand, the braking system according to the invention with a double-acting piston pump as shown in FIG. 4a and an exemplary connection can be proven to be advantageous in that the different sizes of each effective piston range during the forward and backward strokes of the piston can be utilized for so-called miniaturization in the configuration of the transmission and the electric drive. In the braking system, for two common pressure ranges, i.e., on the one hand, the standard pressure range of the pressure up to the so-called lock pressure of, for example, about 100 - 120 bar when the friction coefficient in the wheel / grounding system is high, and on the other hand, the higher pressure range of the pressure up to, for example, about 200 bar, the effective piston range of the piston, the transmission of the double-acting piston pump, and the electric motor are preferably designed such that during the forward stroke, the pressure can still be sufficiently supported in the standard pressure range, while in the higher pressure range, the pressure can only be supported by a relatively small piston back side. The forward stroke via the relatively large piston back side can be proven to be advantageous, especially when it is necessary to overcome the play of the brake as quickly as possible where the brake pressure rises relatively gently, especially during the filling of the wheel cylinder. The backward stroke via the relatively small piston back side can be proven to be advantageous especially when the play of the brake has been overcome and the pressure rises significantly, and based on the significant rise in pressure, the volume of the brake fluid to be delivered becomes less.

[0123] In a design with miniaturization, after the backward stroke into the higher pressure range, the pressure increase P build-up may require an empty pre-stroke, whereby the brake fluid may be carried from the pressure chamber with a larger effective piston range into the reservoir (VB) via, for example, closed switching valves (SV3, SV4) and inlet valves (EV1, EV2), a closed supply switching valve (FV), and preferably, if present, a closed second bypass valve (BP2), an open first bypass valve (BP1), and an open central outlet valve (ZAV). Such an empty pre-stroke can last up to about 100 ms, but it is only very rarely necessary to use. Then, by the subsequent backward stroke, the pressure increase P build-up can continue within the higher pressure range.

[0124] Similar to the case of the rotary pump in FIGS. 1a and 1b, the reduced pressure P in the brake circuits (BK1, BK2) reduction can be realized via the central outlet valve (ZAV) or another (central) outlet valve (ZAV2) in the normal state, or via the supply switching valve (FV) and the single master cylinder in case of a defect. The reduced pressure P such as ABS intervention via the outlet valves (e.g., AV1, AV2) in each brake cylinder (e.g., RZ1, RZ2) reduction In contrast, the reduced pressure P via the switching valves (e.g., SV3, SV4) and the central outlet valve (ZAV) reduction may be regarded as advantageous in terms of the differential pressure between the individual wheel cylinders (RZ1, RZ2, RZ3, RZ4) and / or the brake circuits (BK1, BK2). In this case, the switching valves and / or the bypass valves (BP1, BP2) can be controlled by pulse width modulation (PWM). In this way, the generation of noise can also be reduced to a certain extent. In the case of a complete reduced pressure P reduction the piston of the double-acting piston pump may be brought to its initial position by a retraction stroke via its electric drive device. In this case, the brake liquid volume is sent into the reservoir (VB) from the pressure chamber with a smaller piston effective range, also via at least one of the bypass valves (BP1, BP2) and the central outlet valve (ZAV).

[0125] Based on the check valves (RV5, RV6) closing towards the reservoir (VB) at the connection of the double-acting piston pump to the reservoir (VB), in particular in this embodiment, only via the hydraulic outlet of the pump, each check valve (RV3, RV4), and each brake circuit (BK1, BK2), (partial) exhaust and ventilation of both pressure chambers of the double-acting piston pump are possible.

[0126] Figure 4b shows another embodiment in which the check valve (RV3) provided at the pump outlet of the pressure chamber, which preferably has a larger effective range compared to Figure 4a, is replaced by a switchable solenoid valve (PD1). As in Figure 4a, each brake circuit (BK1, BK2) may be connectable via one bypass valve (BP1) or via two bypass valves (BP1, BP2) connected in series. Further, another switchable shut-off valve (TV) may be used in the first brake circuit (BK1).

[0127] During the forward stroke of the piston, the switchable solenoid valve PD1 may be opened and the pressure may be increased in each brake circuit (BK1, BK2) as in Figure 4a. On the other hand, during the backward stroke of the piston, the switchable solenoid valve PD1 may be closed, whereby the increased pressure P build-up During which the brake fluid volume does not need to be sent back from each brake circuit (BK1, BK2) to the pressure chamber having a larger effective piston range.

[0128] In contrast to the embodiment in Figure 4a, in the embodiment in Figure 4b, it is possible that the switchable solenoid valve PD1 is opened for the purpose of reducing the pressure P reduction after the forward stroke. Thereby, for example, the brake fluid volume can flow back from each brake circuit (BK1, BK2) to the pressure chamber having a larger piston effective range of the double-acting piston pump through the opened switching valves (SV1, SV2, SV3, SV4), the opened bypass valves (BP1, BP2), and the opened shut-off valve (TV) in the first brake circuit (BK1) if present, with the central outlet valve (ZAV) and the supply switching valve (FV) closed. In this case, the brake fluid is simultaneously sent from the smaller effective piston range into the second brake circuit, so such a pressure reduction P reduction may be incomplete.

[0129] In the hydraulic connection of the double-acting piston pump in FIG. 4a, the other check valves (RV3, RV4, RV5, RV6) provided at the inlet and outlet of the pump can be replaced by one switchable solenoid valve (PD1, PD2, PD3, PD4) each. For example, in another embodiment shown in FIG. 4c, all the check valves (RV3, RV4, RV5, RV6) are replaced by solenoid valves. As in FIG. 4a, each brake circuit can be connected via one bypass valve (BP1) or via two bypass valves (BP1, BP2) connected in series. In the embodiment in FIG. 4c, a single master cylinder which may further have a force-stroke sensor (KWS) in the piston for measuring the pedal force may be directly connected to the first brake circuit (BK1), for example via a supply switching valve (FV). In the embodiment based on FIG. 4a, for example, a redundant central outlet valve (ZAV2) connected to the first brake circuit (BK1) can be used.

[0130] By variously combining the opened solenoid valves and the closed solenoid valves (PD1, PD2, PD3, PD4), various operating states of the double-acting piston pump can be set. As in FIG. 4b, during the decompression P reduction medium, the brake fluid may be returned from each brake circuit (BK1, BK2) to the double-acting piston pump, for example via PD1. Further, by opening the pump inlet (for example PD3) and closing the connected pump outlet (for example PD1), the brake fluid can be sent from each pressure chamber into the reservoir (VB).

[0131] Figure 5a shows another embodiment having a tandem cylinder (THZ) instead of a single master cylinder (SHZ) with respect to Figure 4a. The piston (3) of the brake pedal device may be coupled to a second, so-called floating piston (SK) via a first pressure chamber and a first return spring (RF), and the floating piston (SK) may also be moved in another pressure chamber on the side opposite to the second return valve (RF3). As in Figure 4a, for example, the first pressure chamber between the piston (3) of the tandem master cylinder (THZ) and the floating piston (SK) can be connected to the hydraulic line between the first bypass valve (BP1) and the central outlet valve (ZAV) via a hydraulic outlet and the first supply switching valve (FV). The stroke simulator (WS) can be connected to the tandem master cylinder (THZ) via, for example, another hydraulic outlet of the first pressure chamber and, if present, the stroke simulator shut-off valve (14). Further according to the invention, the second pressure chamber of the tandem master cylinder (THZ) can be connected to the second brake circuit (BK2) via another hydraulic outlet, the second supply switching valve (FV2), and optionally another valve, and in this case, the second supply switching valve (FV2) may preferably be designed as a solenoid valve that opens when electrically shut off for the fallback level. Both pressure chambers of the tandem master cylinder (THZ) may each have one leakage opening or aperture, and each leakage opening or aperture may be sealed, for example, by at least each one primary seal (D2, D5) and secondary seal (D1, D4), and may be connected to the reservoir (VB) via a throttle valve and a check valve that closes towards the reservoir (VB) connected in parallel as in Figure 1a. Optionally, the hydraulic connection between each pressure chamber of the tandem master cylinder and the reservoir (VB) may be realized via a diagnostic valve (V D ) as in Figures 1b and 3b, or via a reservoir shut-off valve (17) as in Figure 3c, or via a hydraulic line if redundant primary seals (D2, D5) are present.

[0132] In the normal state, the first supply valve (FV) and the second supply switching valve (FV2) may be closed during the braking operation, and then, by switching the corresponding valves in the hydraulic control unit (HCU) with "brake-by-wire", the pressure supply unit (DV) can increase the brake pressure in each brake circuit (BK1, BK2).

[0133] Using a tandem master cylinder (THZ) instead of a single master cylinder (SHZ) can reduce the probability of total failure of the master cylinder even without another redundant primary or secondary seal.

[0134] Fig. 5b shows another embodiment having a tandem master cylinder (THZ) with a plunger relative to Fig. 5a. The piston (3) of the brake pedal device may be moved in the first pressure chamber between the piston (3) and the floating piston (SK), and may be coupled to another plunger and another piston, and the other piston may also be moved into the second pressure chamber on the side opposite to the return spring. The hydraulic connection and function of this tandem master cylinder (THZ) are the same as those shown in Fig. 5a. The check valve RV3 is connected to the back chamber of the floating piston (SK) via another hydraulic line and another opening provided in the tandem master cylinder.

Explanation of Reference Numerals

[0135] RB1~4 Wheel brakes RZ1~4 Wheel cylinders SV1~4 Switching valves EV1~4 Inlet valves AV1~4 Outlet valves BK1,BK2 Brake circuits DG,DG2 Pressure sensors SHZ Single master cylinder unit THZ,DHZ Tandem master cylinder units, or equivalently double master cylinders KWS Force-stroke sensor GWS Yaw angle sensor Sp1,Sp2 Pedal stroke sensors Sp Pedal stroke Fp Pedal force BP1, BP2 Bypass valve ZAV, ZAV2 (Center) outlet valve FV, FV2 Supply switching valve TV Shut-off valve RV1~6 Check valve DV Pressure supply unit HCU Hydraulic control unit ECU Electronic control unit VB Reservoir WS Stroke simulator SK Floating piston of tandem master cylinder D1 Secondary seal of master cylinder D2 Primary seal of master cylinder D3 Primary seal of stroke simulator D4 Secondary seal of floating piston D5 Primary seal of floating piston D1r Redundant secondary seal of master cylinder D2r Redundant primary seal of master cylinder D3r Redundant primary seal of stroke simulator Dr1, Dr4 Orifice provided at connection between master cylinder and reservoir Dr2 Orifice provided at connection between master cylinder and stroke simulator Dr3 Orifice inside stroke simulator Dr5 Orifice inside back pressure valve 19 V D Diagnostic valve RF, RF1~3 Return spring PD1~4 Solenoid valve provided at connection of two-system double-acting piston pump F Spring 1 Brake pedal 2 Pedal plunger 3 Master cylinder piston 3a Part of master cylinder piston 4 Master cylinder housing 5 Printed circuit board 6 Filling level sensor element 7 Sensor target 8 Float in the reservoir 9 Electronic component for stroke simulator for force characteristics 10 Redundant electrical connection to the supply switching valve 11 Double-acting piston with a spindle drive 12 Redundant connection to the 2 x 3-phase winding motor 13 Electrical plug connector for on-board electrical system connection 14 Stroke simulator shut-off valve 15 Stop ball 16 Sensor rod 17 Reservoir shut-off valve 18 Ball valve 19 Back pressure valve 20 Valve plate 21 Force-stroke characteristic curve of the brake pedal

Claims

1. A vehicle brake system, comprising: at least two hydraulic brake circuits (BK1, BK2) each with at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4); at least one pressure supply device (DV) connected to one of said brake circuits (BK1, BK2) via a hydraulic line; - a switching valve (SV1, SV2, SV3, SV4) for each hydraulically actuated wheel brake (RB1, RB2, RB3, RB4) switchably connecting each one of said hydraulically actuated wheel brakes (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2); - at least one hydraulic connection switchable by at least one bypass switching valve (BP1) between the two brake circuits (BK1 and BK2); at least one hydraulic connection switchable between at least one of said brake circuits (BK1, BK2) and a reservoir (VB) via at least one outlet switching valve (ZAV); a hydraulic brake pedal system, the hydraulic outlet of which is switchably connected to at least one of said brake circuits (BK1, BK2) via a supply switching valve (FV); It has The reduction in pressure in at least one of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4) is achieved by opening the outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV4). Brake system for vehicles.

2. 2. The brake system of claim 1, wherein at least one of the pressure supply devices (DV) comprises a rotary pump.

3. 3. The brake system according to claim 2, wherein the rotary pump is designed as a gear pump or as a multi-piston pump, in particular as a three-piston pump.

4. 4. The brake system according to claim 3, wherein the pressure supply device (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) closing towards the pressure supply device (DV) or via a solenoid valve.

5. 4. The braking system according to claim 3, wherein the multi-piston pump is directly connected to at least one of the brake circuits (BK1, BK2), where directly connected means that there are no valves or pressure-influencing devices between the multi-piston pump and at least one of the brake circuits (BK1, BK2), and optionally one or more check valves may be incorporated in the multi-piston pump.

6. 6. The brake system according to claim 1, wherein the pressure supply device (DV) has a motor, which is preferably a brushless DC motor, in particular having a redundant winding and / or a connection to a 2x3 phase control device.

7. 7. The brake system according to claim 1, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that open when electrically disconnected, the bypass switching valve (BP1) is a bypass switching valve that opens when electrically disconnected, the outlet switching valve (ZAV) is an outlet switching valve that closes when electrically disconnected, and the supply switching valve (FV) is a supply switching valve that opens when electrically disconnected.

8. 8. The brake system according to claim 1, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected in such a way that they are opened by residual pressure in the wheel brakes (RB1, RB2, RB3, RB4) when the respective switching valves (SV1, SV2, SV3, SV4) are electrically disconnected.

9. 9. Brake system according to claim 1, characterized in that the two hydraulic brake circuits (BK1, BK2) each have exactly one or more pressure sensors (DG).

10. 10. The brake system according to claim 1, wherein ABS and / or ESP control can be implemented via at least one of the directional control valves (SV1, SV2, SV3, SV4) and the outlet directional control valve (ZAV).

11. 11. The brake system according to claim 1, wherein no valve is present between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK2).

12. 12. The brake system according to claim 1, wherein there are no valves between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV4).

13. 13. The brake system according to claim 1, wherein strictly speaking only the outlet switching valve (ZAV) switchably connects the brake circuits (BK1, BK2) to the reservoir (VB).

14. 14. A brake system according to claim 1, wherein each wheel brake (RB1, RB2, RB3, RB4) strictly has only one associated switching valve (SV1, SV2, SV3, SV4).

15. 15. A brake system according to claim 1, wherein there is a second outlet switching valve (ZAV2) which is directly connected to the outlet of the pressure supply device (DV) or to the associated check valve (RV3) and which switchably connects it to the reservoir (VB), and in particular precisely only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuit (BK1, BK2) to the reservoir (VB).

16. 16. The brake system according to claim 1, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2) connected in series, and the outlet switching valve (ZAV) is connected to a pipeline section between the two bypass switching valves (BP1, BP2).

17. 17. The brake system according to claim 1, further comprising a cut-off valve (TV) connected directly to the outlet of the pressure supply device (DV) or the associated check valve (RV3) and directly to at least one of the directional control valves (SV1, SV2).

18. 18. The brake system according to claim 1, wherein the hydraulic brake pedal system comprises a single master cylinder (SHZ) or a double master cylinder (DHZ).

19. Braking system according to any one of the preceding claims, characterized in that the braking system further comprises a stroke simulator (WS).

20. 20. The brake system of claim 19, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the double master cylinder (DHZ) via an optional switchable stroke simulator shutoff valve (14).

21. 21. The brake system according to claim 1, wherein the single master cylinder (SHZ) or the double master cylinder (DHZ) has a force-stroke sensor (KWS), or the single master cylinder (SHZ) or the double master cylinder (DHZ) does not have a force-stroke sensor (KWS).

22. 22. The brake system according to claim 1, wherein the brake system is designed as a brake-by-wire system.

23. 23. The brake system according to claim 1, wherein the hydraulic brake pedal system has a vent opening connected to the reservoir (VB) through a parallel circuit of a throttle (Drl) and a check valve (RV1) closing towards the reservoir (VB).

24. 24. The braking system according to any one of the preceding claims, further comprising an open-loop / closed-loop control unit (ECU) for performing open-loop and / or closed-loop control of the braking system.

25. A vehicle brake system, comprising: at least two hydraulic brake circuits (BK1, BK2) each with at least one hydraulically actuated wheel brake (RB1, RB2, RB3, RB4); at least one pressure supply device (DV) connected to one of said brake circuits (BK1, BK2) via a hydraulic line; - a switching valve (SV1, SV2, SV3, SV4) for each hydraulically actuated wheel brake (RB1, RB2, RB3, RB4) switchably connecting each one of said hydraulically actuated wheel brakes (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2); - at least one hydraulic connection switchable by at least one bypass switching valve (BP1) between the two brake circuits (BK1 and BK2); at least one hydraulic connection switchable between at least one of said brake circuits (BK1, BK2) and a reservoir (VB) via at least one outlet switching valve (ZAV); a hydraulic brake pedal system, the hydraulic outlet of which is switchably connected to at least one of said brake circuits (BK1, BK2) via a supply switching valve (FV); It has At least one of the pressure supply devices (DV) comprises a rotary pump; Brake system for vehicles.

26. 26. Brake system according to claim 25, characterized in that the rotary pump is designed as a gear pump or as a multi-piston pump, in particular as a three-piston pump.

27. 27. A braking system according to claim 26, wherein the pressure supply (DV) is connected to at least one of the brake circuits (BK1, BK2) via a check valve (RV3) closing towards the pressure supply (DV).

28. 27. The braking system according to claim 26, wherein the multi-piston pump is directly connected to at least one of the brake circuits (BK1, BK2), where directly connected means that there are no valves or pressure-influencing devices between the multi-piston pump and at least one of the brake circuits (BK1, BK2), and optionally one or more check valves may be incorporated in the multi-piston pump.

29. 29. A brake system according to claim 25, wherein the pressure supply device (DV) has a motor, which is a brushless DC motor, in particular having a redundant winding and / or a connection to a 2x3 phase control device.

30. 30. Brake system according to any one of claims 25 to 29, characterized in that the pressure supply device (DV) is part of a hydraulic control unit (HCU), which hydraulic control unit (HCU) comprises only one pressure supply means.

31. 31. The brake system according to claim 25, wherein the reduction in pressure in at least one of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4) is achieved by opening the outlet diverter valve (ZAV) and the associated diverter valve (SV1, SV2, SV3, SV4).

32. 32. The brake system according to any one of claims 25 to 31, wherein the switching valves (SV1, SV2, SV3, SV4) are switching valves that open when electrically disconnected, the bypass switching valve (BP1) is a bypass switching valve that opens when electrically disconnected, the outlet switching valve (ZAV) is an outlet switching valve that closes when electrically disconnected, and the supply switching valve (FV) is a supply switching valve that opens when electrically disconnected.

33. 33. The brake system according to claim 25, wherein the switching valves (SV1, SV2, SV3, SV4) are designed and connected in such a way that they are opened by residual pressure in the wheel brakes (RB1, RB2, RB3, RB4) when the respective switching valves (SV1, SV2, SV3, SV4) are electrically disconnected.

34. 34. Brake system according to claim 25, characterized in that the two hydraulic brake circuits (BK1, BK2) have exactly one or more pressure sensors (DG).

35. 35. The brake system according to claim 25, wherein ABS and / or ESP control can be implemented via at least one of the directional control valves (SV1, SV2, SV3, SV4) and the outlet directional control valve (ZAV).

36. 36. The brake system according to claim 25, wherein there is no valve between the outlet switching valve (ZAV) and at least one of the switching valves (SV3, SV4) of one of the brake circuits (BK2).

37. 37. The brake system according to claim 25, wherein there are no valves between the bypass switching valve (BP1) and two, preferably all four, of the switching valves (SV1, SV2, SV3, SV4).

38. 38. A brake system according to claim 25, wherein precisely only the outlet switching valve (ZAV) switchably connects the brake circuits (BK1, BK2) to the reservoir (VB).

39. 39. A braking system according to any one of claims 25 to 38, wherein each wheel brake (RB1, RB2, RB3, RB4) strictly has only one associated switching valve (SV1, SV2, SV3, SV4).

40. 40. A brake system according to claim 25, wherein there is a second outlet switching valve (ZAV2) which is directly connected to the outlet of the pressure supply device (DV) or the associated check valve (RV3) and which switchably connects it to the reservoir (VB), and in particular precisely only the outlet switching valve (ZAV) and the second outlet switching valve (ZAV2) switchably connect the brake circuit (BK1, BK2) to the reservoir (VB).

41. The brake system according to any one of claims 25 to 35 or claims 38 to 40, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2) connected in series, and the outlet switching valve (ZAV) is connected to a pipeline section between the two bypass switching valves (BP1, BP2).

42. 42. The brake system according to claim 25, further comprising a cut-off valve (TV) connected directly to the outlet of the pressure supply device (DV) or the associated check valve (RV3) and directly to at least one of the directional control valves (SV1, SV2).

43. 43. The brake system of any one of claims 25 to 42, wherein the hydraulic brake pedal system comprises a single master cylinder (SHZ) or a double master cylinder (DHZ).

44. Braking system according to any one of claims 25 to 43, characterized in that the braking system further comprises a stroke simulator (WS).

45. 45. The braking system of claim 44, wherein the stroke simulator (WS) is connected to the single master cylinder (SHZ) or the double master cylinder (DHZ) via an optional switchable stroke simulator shutoff valve (14).

46. 46. ​​The brake system according to claim 1, wherein the single master cylinder (SHZ) or the double master cylinder (DHZ) has a force-stroke sensor (KWS), or the single master cylinder (SHZ) or the double master cylinder (DHZ) does not have a force-stroke sensor (KWS).

47. 47. The braking system according to claim 25, wherein the braking system is designed as a brake-by-wire system.

48. 48. The brake system according to claim 25, wherein the hydraulic brake pedal system has a vent opening connected to the reservoir (VB) through a parallel circuit of a restrictor (Drl) and a check valve (RV1) closing towards the reservoir (VB).

49. 49. A braking system according to any one of claims 25 to 48, further comprising an open-loop / closed-loop control unit (ECU) for performing open-loop and / or closed-loop control of the braking system.

Images