Fail-safe braking system

Abstract

To provide a braking system with two breaking circuits.SOLUTION: The invention relates to a braking system for a vehicle, which comprises a hydraulic brake pedal system having a master cylinder having at least one pressure chamber, from which a hydraulic output is coupled to at least one brake circuit via an infeed switch valve, and wherein the master cylinder is coupled to a reservoir via at least one opening by a hydraulic connection. According to the invention, a failure of a pressure chamber seal of the at least one pressure chamber of the master cylinder is safeguarded by at least one redundancy means and the failure of the pressure chamber seal or the redundancy means of the pressure chamber seal of the at least one pressure chamber of the master cylinder can be diagnosed.SELECTED DRAWING: Figure 3a

Description

[Technical Field]

[0001] The present invention relates to a hydraulic braking system that prevents failure.

[0002] background The requirements that significantly influence the design of the brake system, especially the safety requirements (e.g., for dual-circuit brake systems), become more stringent with the level of vehicle automation (Levels 0 to 5 of the SAE J3016 standard). For example, for autonomous driving at Level 1 and above (e.g., adaptive cruise control systems), braking force must be guaranteed even without brake pedal activation by the vehicle driver. This requires at least one pressure supply unit in the hydraulic brake system and correspondingly configured electronic sensors and control units. Fault tolerance also depends on the level of automation. At Level 2, individual failures are tolerated if braking action of at least approximately 0.3 g is possible, whereas at Level 3, braking action of at least approximately 0.5 g must be guaranteed in the event of an individual failure. At Level 3 and above, ABS / ESP functionality must also be guaranteed in the event of an individual failure. Generally, double failures are tolerated if the probability of failure based on ppm and FIT data is low. It is desirable to avoid double failures that result in total brake failure.

[0003] Summary of the Invention The present invention relates to a braking system having two brake circuits, preferably meeting at least the requirements of Level 2 according to the SAE J3016 standard, where individual faults can be identified in a timely manner by redundant means and diagnostics, and double faults have an extremely low failure probability.

[0004] In a first aspect, the present invention provides a method for producing a pharmaceutical composition comprising the following components: - at least one hydraulic brake circuit (BK1, BK2) with at least one hydraulically operated wheel brake (RB1, RB2, RB3, RB4); - at least one pressure supply device (DV) connected to one of the brake circuits (BK1, BK2) via a hydraulic line; - a hydraulic brake pedal system having a master cylinder with at least one pressure chamber, the hydraulic outlet of which is switchably connected to at least one brake circuit (BK1, BK2) via a supply switching valve (FV), the master cylinder being hydraulically connected to a reservoir (VB) via at least one opening; It has Optionally, Failure of a pressure chamber seal of at least one pressure chamber of the master cylinder is prevented by at least one redundant means; and The master cylinder is provided with a pressure chamber seal or a redundant means for sealing the pressure chamber, the pressure chamber seal being capable of being diagnosed for failure in at least one pressure chamber of the master cylinder; The present invention relates to a vehicle brake system.

[0005] Aspect 2: A brake system based on aspect 1, further comprising a switching valve (AV, SV1, SV2, SV3, SV4) for each hydraulically operated wheel brake (RB1, RB2, RB3, RB4), and the switching valves switchably connect each one of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4) to one of two brake circuits (BK1, BK2).

[0006] Aspect 3: A brake system based on aspect 1 or 2, further comprising at least one hydraulic connection, which can be switched between two brake circuits (BK1, BK2) by at least one bypass switching valve (BP1).

[0007] Aspect 4: A brake system based on any one of the preceding aspects, wherein the brake system has a single master cylinder (SHZ).

[0008] Aspect 5: A brake system based on any one of the preceding aspects, the brake system having an open-loop / closed-loop control unit (ECU).

[0009] Aspect 6: A brake system based on any one of the preceding aspects, wherein the master cylinder has a force-travel sensor (KWS) for verifying pedal force and / or the master cylinder has a pressure transducer for detecting pressure in at least one pressure chamber of the master cylinder, and the brake system optionally has at least one pedal travel sensor (Sp1, Sp2).

[0010] Aspect 7: A brake system based on any one of the preceding aspects, wherein at least one pressure chamber of the hydraulic brake pedal system is connected to a stroke simulator (WS) via a hydraulic valve circuit.

[0011] Aspect 8: A brake system based on aspect 7, wherein failure of a pressure chamber seal of a pressure chamber of the stroke simulator (WS) is prevented by at least one other redundant means, and failure of a pressure chamber seal of at least one pressure chamber of the stroke simulator (WS) is diagnosable.

[0012] Aspect 9: A brake system according to aspect 7 or 8, wherein the pressure chamber of the stroke simulator (WS) is sealed by a stroke simulator seal (D3).

[0013] Aspect 10: A brake system based on aspect 9, wherein the pressure chamber of the stroke simulator (WS) has at least one second stroke simulator seal (D3r), which is a redundant means for the stroke simulator seal (D3) and is used for pressure chamber sealing of at least one pressure chamber of the stroke simulator (WS).

[0014] Aspect 11: A brake system based on aspect 10, wherein the stroke simulator (WS) has a stroke simulator opening between the stroke simulator seal (D3) and the redundant stroke simulator seal (D3r), and the stroke simulator opening is connected to the reservoir (VB) via a third restriction (Dr3).

[0015] Aspect 12: A brake system based on any one of Aspects 9 to 11, wherein the stroke simulator seal (D3) is a pressure chamber seal of a pressure chamber of the stroke simulator (WS).

[0016] Aspect 13: A brake system based on aspect 12, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the stroke simulator seal (D3), optionally using a pressure supply device (DV).

[0017] Aspect 14: A brake system according to aspect 13, wherein the force-travel sensor (KWS) is not used for diagnostics.

[0018] Aspect 15: A brake system based on aspect 12, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose failures of the stroke simulator seal (D3) using a force-stroke sensor (KWS) and / or a pressure transducer.

[0019] Aspect 16: A brake system based on any one of the preceding aspects, wherein the opening is sealed by at least one primary seal (D2) and optionally at least one secondary seal (D1).

[0020] Aspect 17: A brake system based on any one of the preceding aspects, wherein the hydraulic connection has a parallel circuit of a restrictor (Dr1) and a check valve (RV1) that closes in the direction of the reservoir (VB).

[0021] Aspect 18: A brake system according to aspect 16 or 17, wherein the primary seal (D2) is a pressure chamber seal of at least one pressure chamber of the master cylinder.

[0022] Aspect 19: A brake system based on aspect 18, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose failure of the primary seal (D2) using a force-stroke sensor (KWS) and / or a pressure transducer.

[0023] Aspect 20: A brake system based on aspect 17, wherein the restrictor (Dr1) and the check valve (RV1) closing in the direction of the reservoir (VB) are redundant means of sealing the pressure chamber of at least one pressure chamber of the master cylinder.

[0024] Aspect 21: A brake system based on aspect 20, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose failure of the redundant means of the pressure chamber seal, optionally using a pressure supply device (DV).

[0025] Aspect 22: A brake system based on any one of aspects 16 to 21, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a failure of the secondary seal (D1), optionally using a pressure supply device (DV).

[0026] Aspect 23: A brake system based on any one of the preceding aspects, wherein the reservoir (VB) has a level converter capable of detecting the filling level of the reservoir (VB).

[0027] Aspect 24: A brake system based on aspect 23, in which failure of the secondary seal (D1) can be diagnosed via a level converter in the reservoir (VB), particularly during maintenance when a pressure of, for example, approximately 5 bar is generated in the reservoir (VB).

[0028] Aspect 25: A brake system according to any one of aspects 21 to 24, wherein the force-travel sensor (KWS) is not used for diagnostics.

[0029] Aspect 26: A brake system based on any one of the preceding aspects, wherein the master cylinder has at least one redundant secondary seal (D1r) for the secondary seal (D1).

[0030] Aspect 27: A brake system based on aspect 26, wherein the master cylinder has another opening between the secondary seal (D1) and the redundant secondary seal (D1r), and the other opening is connected to the reservoir (VB) via another restriction (Dr4).

[0031] Aspect 28: A brake system based on any one of the preceding aspects, wherein the master cylinder has at least one redundant primary seal (D2r) for the primary seal (D2), and the redundant primary seal (D2r) is used for pressure chamber sealing.

[0032] Aspect 29: A brake system according to aspect 26, wherein the hydraulic connection includes a valve (VB) that closes when a predetermined limit volume flow rate is exceeded in a flow direction from the master cylinder to the reservoir (VB) and is always open in the opposite flow direction. D )

[0033] Aspect 30: A brake system based on aspect 28 or 29, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose failure of the redundant primary seal (D2r) using a force-stroke sensor (KWS) and / or a pressure transducer.

[0034] Aspect 31: A brake system according to aspect 29 or 30, wherein the open-loop / closed-loop control unit (ECU) controls a valve (V D ) optionally using a pressure supply (DV).

[0035] Aspect 32: A braking system based on any one of the preceding aspects, wherein the hydraulic connection comprises a switchable solenoid valve (17).

[0036] Aspect 33: A brake system based on aspect 32, wherein the master cylinder has at least one redundant primary seal (D2r), and the master cylinder has at least one other opening between the at least one redundant primary seal (D2r) and the at least one primary seal (D2), and the other opening is also switchably connected to the reservoir (VB) via a switchable solenoid valve (17).

[0037] Aspect 34: A brake system based on aspect 32 or 33, wherein the master cylinder has at least one other opening between the at least one redundant secondary seal (D1r) and the at least one secondary seal (D1), and the other opening is connected to the reservoir (VB) via another restriction (Dr4).

[0038] Aspect 35: A brake system based on any one of aspects 32 to 34, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the switchable solenoid valve (17) using a force-stroke sensor (KWS).

[0039] Aspect 36: A brake system based on any one of aspects 32 to 34, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the switchable solenoid valve (17), optionally using a pressure supply device (DV), and the force-stroke sensor (KWS) is not used for this diagnosis.

[0040] Aspect 37: A brake system based on any one of the preceding aspects, wherein each hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is assigned a switchable inlet valve (EV), and the switching valve (AV) of each hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is connected to a reservoir (VB).

[0041] Aspect 38: A brake system based on any one of the preceding aspects, wherein the brake system further has at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and a reservoir (VB) via at least one outlet switching valve (ZAV).

[0042] Aspect 39: A brake system based on aspect 38, wherein pressure reduction in at least one hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is achieved by opening an outlet switching valve (ZAV) and associated switching valves (SV1, SV2, SV3, SV4).

[0043] Aspect 40: A brake system based on aspect 38 or 39, wherein two hydraulic brake circuits (BK1, BK2) are connected to each other via a series-connected bypass switching valve (BP1) and another bypass switching valve (BP2), and an outlet switching valve (ZAV) is connected to the pipeline section between the two bypass switching valves (BP1, BP2).

[0044] Aspect 41: A braking system based on any one of the preceding aspects, wherein pressure reduction in at least one hydraulically operated wheel brake (RB1, RB2, RB3, RB4) can be achieved via a master cylinder.

[0045] Aspect 42: A brake system based on any one of the preceding aspects, the brake system having a first return spring (RF1) and optionally a second return spring (RF2), the second return spring (RF2) acting against possible pedal fall.

[0046] Aspect 43: A brake system based on any one of the preceding aspects, wherein at least one pressure chamber of the master cylinder is connected to the supply switching valve (FV) via an inserted back pressure valve (19).

[0047] Aspect 44: In a brake system based on aspect 43, when pressure exceeding a predetermined pressure occurs in the direction from the master cylinder to the supply switching valve (FV), the back pressure valve (19) acts as a throttle toward the supply switching valve (FV) and does not substantially perform a throttle action in the opposite direction.

[0048] Aspect 45: A brake system based on any one of the preceding aspects, wherein the brake system has at least two hydraulic brake circuits (BK1, BK2). [Brief explanation of the drawings]

[0049] [Figure 1a] FIG. 1 shows a first embodiment of a possible braking system according to the invention in a minimum arrangement of valves in the HCU with a bypass valve (BP1) and a central outlet valve (ZAV). [Figure 1b] FIG. 2 shows a second embodiment of a possible braking system according to the invention in an expanded arrangement of valves in the HCU with two bypass valves (BP1 and BP2), two (central) outlet valves (ZAV1, ZAV2) and a shut-off valve (TV). [Figure 2] FIG. 1 is a diagram showing the structure of a diagnostic valve (VD). [Figure 3a] FIG. 1 shows one embodiment according to the invention for connecting between a single master cylinder and a reservoir (VB) with two throttles (Dr1, Dr4), a check valve (RV1) and a redundant secondary seal (D1r). [Figure 3b] FIG. 1 illustrates one embodiment according to the present invention for connecting between a single master cylinder and a reservoir (VB) with a reservoir shut-off valve (VD) and a redundant primary seal (D2r). [Figure 3c] FIG. 1 shows one embodiment of the invention for connecting between a single master cylinder and a reservoir (VB) with a reservoir shutoff valve (17), a restrictor (Dr4), and one each of a redundant primary seal (D2r) and a redundant secondary seal (D1r). [Figure 3d]FIG. 10 is a diagram showing an example of a pedal force-stroke characteristic curve for a single master cylinder equipped with another return spring (RF2) and a stroke simulator (WS). [Figure 4a] FIG. 1 shows an embodiment according to the present invention with a single master cylinder unit (SHZ) and a dual-channel double-acting piston pump with four check valves (RV3, RV4, RV5, RV6). [Figure 4b] FIG. 1 shows an embodiment according to the present invention with a single master cylinder unit (SHZ) and a dual-path double-acting piston pump having three check valves (RV4, RV5, RV6) and one solenoid valve (PD1). [Figure 4c] FIG. 1 shows an embodiment with a single master cylinder unit (SHZ) and a dual-path double-acting piston pump having four solenoid valves (PD1, PD2, PD3, PD4). [Figure 5a] FIG. 1 shows an embodiment according to the present invention comprising a conventional tandem master cylinder unit (THZ) and a dual-path double-acting piston pump having four check valves (RV3, RV4, RV5, RV6). [Figure 5b] FIG. 1 shows an embodiment according to the present invention comprising a tandem master cylinder unit (THZ) having a plunger and a dual-path double-acting piston pump having four check valves (RV3, RV4, RV5, RV6).

[0050] Detailed Description FIG. 1a shows the elements of a hydraulic brake system having a brake pedal (1), a single master cylinder unit (SHZ) with a single master cylinder and reservoir (VB), a pressure supply device (DV), an electronic control unit (ECU), and one wheel brake (RB1, RB2, RB3, RB4) (not shown) with one wheel cylinder (RZ1, RZ2, RZ3, RZ4) for each wheel. The terms pressure supply device (DV) and pressure supply unit are used synonymously here. Two wheel cylinders (RZ1, RZ2) are connected to a first brake circuit (BK1) via respective switching valves (SV1, SV2), and two other wheel cylinders (RZ3, RZ4) are connected to a second brake circuit (BK2) via respective switching valves (SV3, SV4). Instead of one switching valve per wheel cylinder, two or more switching valves can be provided for each wheel cylinder. The pressure supply unit (DV) includes a pump and a brushless DC motor, which optionally has redundant windings and / or is connected to the electronic control unit (ECU) via a 2x3 phase. The pump can be a plunger pump (not shown) with a spindle drive or a rotary pump, which can also be designed as a multi-piston pump (e.g., a three-piston pump) or a gear pump. In the case of a bidirectionally rotatable gear pump, the pressure supply unit (DV) can be connected to the first brake circuit (BK1) via a check valve (RV3) that closes toward the pressure supply unit (DV). In the case of a multi-piston pump that can pump volume in only one direction, the pressure supply unit (DV) can be connected directly to the first brake circuit (BK1) (without RV3). One or more check valves can be integrated into the multi-piston pump. In the case of a plunger pump, a solenoid valve (not shown) is required instead of the check valve RV3. Furthermore, a plunger pump or a rotary pump may be connected to the reservoir (VB). The two brake circuits (BK1 and BK2) are connected to each other via a switchable bypass valve (BP1).The second brake circuit (BK2) is connected to the reservoir (VB) via a switchable central outlet valve (ZAV) and to the hydraulic outlet of the pressure chamber of the single master cylinder via a switchable supply switching valve (FV). As an alternative to the single master cylinder, a double master cylinder with corresponding connections as illustrated in FIG. 5a or 5b may be used to provide additional safety. The pressure in one of the two brake circuits (e.g., BK2) can be measured by a pressure sensor (e.g., DG) provided in the brake circuit (e.g., BK2) and transmitted to the ECU. Optionally, the pressure in another brake circuit (e.g., BK1) can also be measured by a pressure sensor (e.g., DG2) and transmitted to the ECU. The hydraulic units with the wheel cylinders (RZ1, RZ2, RZ3, RZ4), the switching valves (SV1, SV2, SV3, SV4), the two brake circuits (BK1, BK2), the pressure sensors (DG1, DG2), the bypass valve (BP1), the central outlet valve (ZAV), the pressure supply unit (DV) and, if present, the check valve (RV3) may be combined into one so-called hydraulic control unit (HCU). In one preferred embodiment, the hydraulic control unit (HCU) has only one hydraulic supply means (DV).

[0051] In the single master cylinder unit (SHZ), a stroke simulator (WS) can additionally be connected to another hydraulic outlet of the single master cylinder (or to the hydraulic line between the supply switching valve (FV) and the single master cylinder), with or without a switchable stroke simulator shut-off valve (14). The stroke simulator can transmit a predetermined pedal stroke-force characteristic to the brake pedal (1) via a slave piston, which can be displaced in the opposite direction to the return spring arrangement, for example, as a result of actuation of the foot-operated brake pedal (1). The hydraulic connection of the stroke simulator (WS) to the single master cylinder can be achieved, for example, by connecting a throttle (Dr2) and a check valve (RV2) in parallel, as shown in FIG. 1a, or in some other way. The pedal movement can be reduced when pressure increases via the throttle (Dr2), and during exhaust of the stroke simulator (WS), the throttle (Dr2) can be bypassed via the check valve (RV2).

[0052] Under normal conditions, particularly when an electric power supply and a functional pressure supply DV are present, braking is performed by the driver applying the brake pedal. In this case, the supply switching valve (FV) is closed during brake pedal application and remains closed as long as the brake pedal (1) is kept depressed. The pedal system is therefore hydraulically decoupled from the hydraulic control unit (HCU). Instead, the connection is made in a "brake-by-wire" manner via a redundantly configured pedal travel sensor, the ECU, and the pressure supply unit DV, which, when the switching valves (SV1, SV2, SV3, SV4) are open, the bypass valve (BP1) is open, and the central outlet valve (ZAV) is closed, can deliver brake fluid volume from the reservoir (VB) to the wheel cylinders (RZ1, RZ2, RZ3, RZ4) of both brake circuits (BK1, BK2), thereby increasing the brake pressure. If braking is to be performed solely by the wheel cylinders (RZ1, RZ2) of the first brake circuit (BK1), the bypass valve (BP1) may be closed during normal braking, depending on the desired braking force and other ambient conditions. The target pressure can be set by closed-loop control as a function of pedal travel via at least one pressure sensor (DG) in one of the brake circuits (BK1, BK2) and / or via pulse-width modulation of the directional control valves (SV1, SV2, SV3, SV4) and / or the bypass valve (BP1). The stroke simulator (WS) and the return spring (RF) in the single master cylinder provide the driver with a predetermined pedal travel-force characteristic that is preferably as constant as possible and independent of the brake pressure in the brake circuits (BK1, BK2). In particular, the combination of the stroke simulator (WS) and the return spring (RF) in a "brake-by-wire" system prevents the brake pedal from dropping and returns it to a predetermined starting position after a foot-activated actuation. Thus, in particular in the case of electric or hybrid vehicles, the recovery of braking energy in the electric traction motor can be decoupled from the brake pedal (1), and in particular, the pedal travel-force characteristic remains unaffected even in abnormal situations, such as in the event of a brake circuit failure.

[0053] When the brake pedal force is released, the central outlet valve (ZAV) may open, especially if a rotary pump is used. Furthermore, the switching valves (SV1, SV2, SV3, SV4) and / or the bypass valves (BP1, BP2) may be opened completely, or according to a desired pressure reduction gradient via pulse width modulation (PWM), temporary deactivation (e.g., after a time Δt or a pressure differential Δp), or some other method. As a result, the brake fluid volume may be returned to the reservoir (VB), and the brake pressure may be reduced. When the piston (3) of the single master cylinder returns to its predetermined starting position after the foot-actuated brake pedal (1) has ceased to be operated, brake fluid exchange between the pressure chamber of the single master cylinder and the reservoir (VB) may be achieved, for example, by hydraulic connection through the piston (3) and a radial leakage opening of the single master cylinder. This hydraulic connection may be achieved by connecting a throttle (Dr1) and a check valve (RV1) in parallel, as shown in FIG. 1a, or in some other way. Sealing of the pressure chamber in the single master cylinder may be achieved by a primary seal (D2), a secondary seal (D1) and another redundant seal (not shown), in which case the primary seal (D2) in particular may be mounted in the single master cylinder or on the piston (3) of the single master cylinder.

[0054] In normal conditions, individual brake pressures for driving dynamics interventions such as ABS or ESP can be set for each wheel by closed-loop control. For example, the closed-loop control function for ABS is as follows: build-up During this time, the closed-loop controller may signal that the brake cylinder of one wheel (e.g., RZ1) meets the criteria for, for example, excessive brake pressure, and then monitor this wheel by detecting the pressure rise P build-up or (possibly after such a monitoring time) reductionIn this case, the supply switching valve (FV) remains closed and, according to this embodiment, the pump in the pressure supply unit (DV) cannot receive any volume from the brake circuit, so that the opening of the central outlet valve (ZAV) is in one possible configuration reduced pressure P reduction When the central outlet valve (ZAV) is open, several different pressure reduction gradients can be set by closed loop control, preferably via PWM control of the associated switching valve (e.g. SV1). reduction When the pressure drop P is stopped, the central outlet valve (ZAV) is closed again. reduction It is also possible for two, three or four wheel cylinders to be controlled simultaneously and depending on the wheel characteristics. build-up can likewise be controlled in one wheel cylinder or two, three or four wheel cylinders simultaneously and as desired based on wheel characteristics.

[0055] In the case of intervention by a driver assistance system, which is usually for partially automated driving (level 2), such as in the case of an adaptive cruise control system or traffic jam assistance, braking operations can be carried out via the pressure supply unit (DV) even without pedal action by the driver, with the brake pedal (1) being hydraulically isolated from such intervention by the supply switching valve (FV), which is then closed.

[0056] Based on the so-called conventional three-box system (brake system with ABS / ESP function, vacuum brake booster and electric or mechanical vacuum pump) and the so-called conventional two-box system (brake system with ABS / ESP function and electric brake booster unit), the "brake-by-wire" brake system according to the invention with a stroke simulator (WS), an electric pressure supply unit (DV) and ABS / ESP function can be referred to as a so-called one-box system. The sophisticated integration of such a one-box system can reduce the installation space, weight and costs of the entire structural unit and further optimize the installation and logistics.

[0057] The valves FV, ​​BP1, SV1, SV2, SV3, and SV4 can be designed as solenoid valves that open when electrically disconnected, while the valve ZAV and, if present, the stroke simulator shut-off valve (14), are preferably solenoid valves that close when electrically disconnected. Furthermore, the directional control valves (SV1, SV2, SV3, and SV4) are preferably connected via their outlets to the respective wheel cylinders (RZ1, RZ2, RZ3, and RZ4), so that in the event of a fault, e.g., a fault in their electrical connections, the respective directional control valves (SV1, SV2, SV3, and SV4) automatically open based on the pressure in the respective wheel cylinders (RZ1, RZ2, RZ3, and RZ4). This valve configuration ensures, in particular, that, in the absence of electrical power, the brake pedal (1) can be hydraulically connected to the wheel cylinders (RZ1, RZ2, RZ3, and RZ4) via the open supply directional control valve (FV), allowing the brake pressure to build up. Furthermore, if a stroke simulator shut-off valve (14) is present that closes when electrically disconnected, the stroke simulator (WS) may be decoupled from the brake pedal (1), thereby saving pedal travel by, for example, approximately 40%.

[0058] All solenoid valves, especially ZAVs, can be designed with redundant valves and / or with redundant coils and / or with redundant controllers, thereby reducing the probability of valve failure. For example, if there is a 1e-6 probability of one failure per year, redundancy with the same failure probability can reduce the failure probability per year to 1e-6 x 1e-6 = 1e-12.

[0059] Furthermore, if the power supply means is present and the pressure supply unit (DV) fails, the valves FV, ​​BP1, SV1, SV2, SV3, and SV4 may be opened, and the valve ZAV and, if present, the stroke simulator shut-off valve (14) may be closed, allowing brake pressure to be built up by brake pedal actuation. Alternatively, the bypass valve (BP1) may be closed, and sufficient brake pressure may still be built up in the second brake circuit (BK2) by actuation of the foot-operated brake pedal (1). Failure of the electrical control of the pressure supply unit (DV) can be classified as highly unlikely in particularly preferred embodiments with a (single) multi-piston or gear pump and redundant windings with 2x3-phase control. Since failure of the power supply means is also unlikely, the stroke simulator shut-off valve (14) may be omitted.

[0060] In the present invention, the brake system may include various sensors, such as pressure sensors (DG, DG2), redundant pedal travel sensors (Sp1 and Sp2) for determining the pedal travel, a force-travel sensor (KWS) on the piston of the single master cylinder for determining the force-pedal travel characteristic, a fill level sensor element (6) for determining the brake fluid fill level in the reservoir (VB), a yaw angle sensor (GWS) for ESP intervention, or other sensors (e.g., a temperature sensor) whose sensor values ​​can be transmitted to the electronic control unit (ECU). Alternatively or additionally to the force-travel sensor (KWS), a pressure sensor (not shown) may be integrated into the single master cylinder, which detects the pressure in the pressure chamber and transmits it to the ECU. Furthermore, all solenoid valves, particularly valves SV1, SV2, SV3, SV4, BP1, ZAV, FV, and 14, can also be switched by the electronic control unit (ECU), preferably via redundant electronic control devices or redundant coils. In a single box system with ABS / ESP, the electronic control unit (ECU) is attached to the hydraulic control unit (HCU) and may be connected to the vehicle's on-board electrical system preferably by means of a plug connector (13), in which case bus communication may take place e.g. via FlexRay or CAN or some other type.

[0061] The redundant pedal travel sensors (Sp1 and Sp2) can be realized in different ways. In FIG. 1a, two sensor rods are moved by a protrusion of the single master cylinder piston (3), which acts on the redundant pedal travel sensors (Sp1 and Sp2). To prevent jamming of the rods, a detent member can be housed in the protrusion of the piston (3). The redundant pedal travel sensors (Sp1 and Sp2) can also be connected to two pistons and a spring between the two pistons. This has the advantage that force-travel measurement can be realized in this way with additional advantages in terms of fault analysis, for example with regard to jamming of the piston (3) (see also DE 10 2010 050 132 A1).

[0062] The following describes different fault conditions, their consequences and their detection by diagnostics.

[0063] The loss of braking force caused by a seal leakage in one of the wheel cylinders (RZ1, RZ2, RZ3, RZ4) can depend on various environmental conditions such as valve position, temperature, ventilation of the brake system, play of the wheel brakes (RB1, RB2, RB3, RB4), etc. build-up By comparison with a predetermined pressure-volume characteristic line for P, the additional intake of lost volume by the pressure supply unit (DV) or the additional delivery of volume can be identified. The wheel cylinder in which the loss of braking force occurs can be located using the following diagnostics: build-upAfter this, all directional control valves (SV1, SV2, SV3, SV4) are open, and if pressure remains in the brake circuits (BK1, BK2), power is no longer supplied to the pressure supply unit (DV). After the bypass valve (BP1) is closed, the pressure measured by the pressure sensor (DG) in the second brake circuit (BK2) can be checked. If the pressure drops, this necessarily indicates that wheel cylinders RZ3 and / or RZ4 are leaking. For example, by closing the directional control valve SV3, a leak in wheel cylinder RZ4 can be identified if a pressure drop occurs, or if the pressure remains constant. On the other hand, if the pressure remains constant after the bypass valve (BP1) is closed, it can be determined that wheel cylinders RZ3 and RZ4 are sealed. In this case, the bypass valve (BP1) is open and the directional control valves SV1, SV3, and SV4 are closed. If the pressure drops, wheel cylinder RZ2 can be identified as leaking, whereas if the pressure remains constant, wheel cylinder RZ1 can be identified as leaking. Once the wheel cylinder with the loss of braking force (e.g., RZ1) is located, the associated switching valve (e.g., SV1) can be closed before each braking operation until the unit is replaced during maintenance, thereby allowing deceleration to continue with two or three wheel cylinders (e.g., RZ2, RZ3, RZ4) with reduced but sufficient braking force for Level 2 autonomous driving. If a small leak is identified in one wheel cylinder as described above, this leak can be compensated for by replenishing with a pressure supply unit (DV) as an alternative to shutting off this wheel cylinder.

[0064] After all of the directional control valves SV1, SV2, SV3, SV4 have been closed, the sealing of the central outlet valve ZAV and the supply directional control valve FV can be checked by alternately opening and closing the valves ZAV and FV, preferably in a standstill state with or without volume delivery by the pressure supply unit DV. If a possible leak location can be located in ZAV or FV, for example, via pressure oscillations from the pressure supply unit DV and via the interaction of the fill level sensor element (6) in the reservoir VB with the pedal movement, the following measures can be distinguished: if the central outlet valve ZAV is no longer sealing, for example, blocked by dirt particles, or if it can no longer close after a failure of the electrical control device, the bypass valve BP1 can be closed, and sufficient brake pressure can still be built up by the pressure supply unit DV, at least in the first brake circuit. On the other hand, if the supply switching valve (FV) is blocked and no longer seals, for example because of dirt particles, the bypass valve (BP1), the switching valves SV3 and SV4 in the second brake circuit (BK2), and the central outlet valve (ZAV) can be closed, which would prevent a possible pedal characteristic disturbance in the single master cylinder due to a leak in the supply switching valve (FV), and sufficient brake pressure can still be boosted by the pressure supply unit (DV) in the first brake circuit (BK1). If it is not possible to locate the leak in the ZAV or FV, the same procedure as in the case of a leak in the FV can be used. Furthermore, if such a leakage flow is small, it can be compensated for by the volumetric delivery of the pressure supply unit (DV), as described above.

[0065] If the central outlet valve (ZAV) fails so that it can no longer be opened, the brake pressure can be reduced by opening the supply switching valve (FV) via the single master cylinder and the reservoir (VB). Alternatively, if a double master cylinder is used, the other pressure chamber of the double master cylinder is connected to the hydraulic control unit via a separate supply switching valve (FV2), as in Figures 5a and 5b, and the pressure reduction P reductionFor this purpose, both supply switching valves (FV, FV2) may be opened.

[0066] If one of the switching valves (SV3, SV4) in the second brake circuit (e.g., SV3) fails to the extent that it can no longer be closed, for example due to dirt particles, the bypass valve (BP1) can be closed, and sufficient braking force can still be built up in the first brake circuit (BK1) via the pressure supply unit (DV), particularly for Level 2 autonomous driving. In the event of a failure in one of the two brake circuits (BK1, BK2), a so-called diagonal arrangement of the braking forces for the vehicle's four wheels between the front and rear axles of the vehicle can provide a greater braking effect (e.g., approximately 50% in the case of a diagonal arrangement, compared to approximately 30% in the case of a front / rear axle arrangement, in the case of a front drive circuit failure). Diagonal arrangement of the braking forces means that the front wheel brakes on one side of the vehicle and the rear wheel brakes on the other side of the vehicle are assigned to one brake circuit. The other diagonal wheel brakes are also assigned to the second brake circuit accordingly.

[0067] If one of the directional control valves (SV1, SV2) in the first brake circuit (e.g., SV1) fails to the extent that it can no longer close, e.g., due to dirt particles, the bypass valve (BP1) can be closed and the supply directional control valve (FV) can be opened, so that sufficient brake pressure can still be built up in the second brake circuit (BK2) by actuation of the foot-operated brake pedal (1). If present, the stroke simulator shut-off valve (14) can also be closed in addition, which can save approximately 40% of the pedal stroke.

[0068] If the supply switching valve (FV) fails to the extent that it can no longer be closed, for example due to dirt particles, the second brake circuit can be isolated by closing the switching valves SV3 and SV4, the central outlet valve (ZAV), and the bypass valve (BP1). In this way, a disturbance in the pedal stroke characteristic of the single master cylinder can be prevented, and sufficient brake pressure can still be built up in the first brake circuit (BK1) via the pressure supply unit (DV). In the event of an emergency braking situation, after the switching valves (SV3 and SV4) in the second brake circuit (BK2) are opened, the braking force in the wheel brakes (RB1, RB2, RB3, RB4) can still be increased by operating the foot-operated brake pedal (1). If the leakage flow in the supply switching valve (FV) is small and one of the wheel brakes (RB1, RB2, RB3, RB4) is blocked during emergency braking, ABS control can be performed via the central outlet valve (ZAV) and the pressure supply unit (DV).

[0069] In the event of failure of a pressure sensor (e.g., DG) provided in one of the brake circuits (BK1, BK2), another pressure sensor (e.g., DG2) provided in one of the brake circuits (BK1, BK2) can be used, if present. If the brake system is provided with only one pressure sensor (DG), the pressure in the brake circuits (BK1, BK2) can be set by closed-loop control via the current of the motor of the pressure supply unit (DV) according to predetermined current-pressure relationships (e.g., characteristic maps) stored in the ECU, where these current-pressure relationships can vary depending on various ambient conditions, e.g., the pressure boost P build-up or reduced pressure P reduction , the position of the solenoid valve, temperature, etc.

[0070] If the primary seal (D2) in the pressure chamber of the master cylinder fails, i.e., if the primary seal (D2) leaks, brake fluid in the master cylinder may leak, which may have an uncontrollable effect on (in this case, increase) the pedal travel and may cause excessive brake pressure buildup due to the "brake-by-wire" system, resulting in undesirable harsh braking. Hereinafter, the master cylinder will be referred to as a single master cylinder, although the use of tandem master cylinders is also possible. To avoid the possibility of a total master cylinder failure, the single master cylinder may be connected to the reservoir (VB) via a parallel connection of a check valve (RV1) and a throttle (Dr1) that closes towards the reservoir, as shown in FIG. 1a. If the primary seal (D2) leaks and the secondary seal (D1) seals, the leakage flow is blocked by the check valve (RV1) and throttled by the throttle (Dr1), resulting in only slight piston or pedal movement and therefore minimal disruption of the "brake-by-wire" braking action. The throttle (Dr1) can be designed, for example, so that the pedal movement caused by the leakage is approximately 0.2 mm / sec. Thus, an average braking time of approximately 3 seconds, slowing a vehicle at 100 km / h with 1 g, can result in a 0.6 mm disruption of pedal travel, which is negligible relative to the overall pedal travel. The check valve (RV1) allows for rapid filling of the brake system with brake fluid and rapid venting via the open vent screws in the wheel cylinders (RZ1, RZ2, RZ3, RZ4). The throttle (Dr1) also allows for volume compensation in the event of temperature changes.

[0071] A critical double failure consisting of a leak in the primary seal (D2) and a potential individual failure of the additional secondary seal (D1), which can no longer be throttled by the throttle (Dr1), can be prevented by using another redundant primary and / or secondary seal (not shown). In the present invention, as in FIG. 1a, the sealing of the secondary seal (D1) can be monitored by diagnostics at regular intervals (e.g., after each parking). In the absence of a stroke simulator (WS) or in the case of a stroke simulator (WS) that is switchably connected via the stroke simulator shutoff valve (14), the leakage can be assigned exclusively to the secondary seal (D1) in this case. In one of these cases, the procedure can be performed, for example, as follows: if, after the vehicle has stopped, the residual pressure in the brake system flows into the single master cylinder via the open supply switching valve (FV) due to the corresponding valve switching, the sealing of the entire brake system can be checked based on the pressure fluctuations detected by the pressure sensor (DG) for a period of, for example, 10 seconds. A detected pressure drop indicates a leak. If such a leak is detected, the switching valves (SV1, SV2, SV3, SV4) and, if present, the stroke simulator shutoff valve (14) are closed, and a constant pressure of, for example, 20 bar is supplied to the single master cylinder via the pressure supply unit (DV) for a predetermined time. The delivery volume in this case can be determined, for example, via an angle change detected by a rotor position sensor on the motor of the pressure supply unit (DV). If this delivery volume is greater than the known delivery volume of the throttle (Dr1), for example, at 20 bar, the secondary seal (D1) can be determined to be leaking. Therefore, a double fault in which the primary seal (D2) and the secondary seal (D1) are leaking can only occur in the unlikely event that both seals (D1, D2) fail simultaneously during a stroke. In the case of a stroke simulator (WS) without a stroke simulator shutoff valve (14), certain circumstances may prevent the detected leak from being assigned exclusively to the secondary seal (D1) of the single master cylinder, as in the described diagnosis.This is because leakage can also occur through a leakage in the stroke simulator seal (D3) of the stroke simulator (WS), which can also result in a leakage flow into the reservoir (VB) through a connection (not shown) due to the restriction caused by the leakage in the stroke simulator seal (D3) and the restriction through another restriction (Dr3) between the stroke simulator seal (D3) of the stroke simulator (WS) and another redundant seal (Dr3). In this case, if a leakage occurs in D1 or D3, the hydraulic resistance configurations for the restrictions Dr1 and Dr3 are different, so that somewhat different leakage flows may occur through Dr1 and / or Dr3, respectively, which allows the described diagnosis to then locate the leak in D1 or D3. On the other hand, even if the leak in D1 or D3 is not located, a potential failure in D1 or D3 can be avoided by replacing both seals (D1, D3) at the same time, thus ensuring the safety of the brake system. An additional failure of the redundant primary seal (D3r) can be classified as an unlikely double failure.

[0072] The reservoir (VB) may have two mutually redundant fluid chambers. In at least one of the fluid chambers, the reservoir (VB) has a float (8) with a sensor target (7). The sensor target (7), together with a fill level sensor element (6) on a printed circuit board (5) of an electronic control unit (ECU) attached to the reservoir (VB), can measure the fill level of the brake fluid in the reservoir (VB) in a substantially continuously changing manner. In this way, it is also possible to redundantly detect small leaks in the brake circuit, for example, leaks in D1 or one of the wheel cylinders RZ1 to RZ4. Integrating the fill level sensor element (6) into the electronic control unit (ECU) can reduce costs.

[0073] An alternative embodiment of the brake system shown in Figure 1b has, with respect to Figure 1a, an alternative bypass valve (BP2), a shut-off valve (TV) and an alternative (central) outlet valve (ZAV2), thus increasing safety in the brake system, particularly with regard to double failures.

[0074] Another bypass valve (BP2) may be incorporated into the second brake circuit (BK2), allowing the second brake circuit (BK2) with the wheel cylinders RZ3 and RZ4 to be isolated from the rest of the brake system in the event of a failure in the second brake circuit (BK2). For example, as shown in FIG. 1b, a second bypass valve (BP2) may be incorporated into the hydraulic line between the first bypass valve (BP1) and the pressure sensor (DG) in the second brake circuit (BK2). In this case, the central outlet valve (ZAV) may be connected to the second brake circuit (BK2) via the second bypass valve (BP2). The combination of the two bypass valves (BP1, BP2), possibly with the possibility of expansion by a shut-off valve (TV), may be referred to as a safety gate (SIG).

[0075] A shut-off valve (TV) may be incorporated into the first brake circuit (BK1) to isolate the first brake circuit (BK1) with the wheel cylinders RZ1 and RZ2 from the rest of the brake system in the event of a failure in the first brake circuit (BK1) (e.g., a double failure of RZ and SV). For example, as shown in FIG. 1b, a shut-off valve (TV) may be incorporated into the hydraulic line between the pressure supply unit (DV) or, if present, the check valve (RV3) or solenoid valve provided in the pressure supply unit (DV) and the switching valves (SV1, SV2) of the first brake circuit (BK1). Furthermore, a redundant pressure sensor (DG2) (not shown) may be connected to the first brake circuit (BK1).

[0076] A separate central outlet valve (ZAV2) may be incorporated into the brake system to allow redundant pressure reduction in the brake system relative to the central outlet valve (ZAV). As shown in FIG. 1b, the separate central outlet valve may be connected, for example, to the hydraulic line between the shutoff valve (TV) and the pressure supply unit (DV) or, if present, the check valve (RV3) or solenoid valve provided in the pressure supply unit (DV). For safety reasons, the central outlet valves ZAV and ZAV2 should be connected to separate portions of the reservoir (VB). The central outlet valve ZAV2 may be connected to the reservoir (VB) via another opening in the master cylinder and an annular leakage opening in the piston (3), as shown in FIG. 1b.

[0077] The second bypass valve (BP2) and the shut-off valve (TV) can be designed as solenoid valves that open when electrically disconnected, while the other central outlet valve (ZAV2) can be designed as a solenoid valve that closes when electrically disconnected. The second bypass valve (BP2) and the shut-off valve (TV) can furthermore be connected via their outlet sides to the second brake circuit (BK2) and the first brake circuit (BK1), respectively, so that in the event of a failure of the valve control device (e.g., when power is not supplied), the second bypass valve (BP2) and the shut-off valve (TV) can be opened by the residual pressure in the brake circuits (BK1, BK2). Thus, as in the brake system of FIG. 1a, braking can be performed by actuation of the foot-operated brake pedal (1) even when power is not supplied.

[0078] If one of the two (central) outlet valves (ZAV, ZAV2) (for example ZAV) fails to the extent that it can no longer be opened, the pressure reduction P is transferred via the other central outlet valve (ZAV2). reduction In this case, unlike the situation in FIG. 1a, the supply switching valve (FV) does not have to be opened, which allows the "brake-by-wire" function to be maintained and in particular avoids any disturbances in the pedal travel characteristic and thus any influence on the pedal movement.

[0079] In one embodiment according to the invention, the further central outlet valve (ZAV2) is further adapted to reduce the pressure P independently in each of the two wheel cylinders (RZ1, RZ2 and RZ3, RZ4) per brake circuit (BK1, BK2) during a driving dynamics intervention (e.g. ABS) by closed-loop control. reduction This has the advantage that the

[0080] If the supply switching valve (FV) can no longer be closed (e.g. due to dirt particles or a fault in the electrical connection), safety can be increased via the second bypass valve (BP2). In such a case, the single master cylinder can be disconnected from the brake system by closing both bypass valves (BP1, BP2), and sufficient brake pressure can still be built up in the first brake circuit (BK1) via the pressure supply unit (DV). In this case, the pressure reduction P reduction This can be achieved, for example, via a further (central) outlet valve ZAV2. In the event of emergency braking, the braking force can be further increased in the second brake circuit (BK2) by actuation of the foot-operated brake pedal (1) after opening of the second bypass valve (BP2). This makes it possible, for example, to achieve a braking action of approximately 75% of the full normal braking action. In the event of a small leakage due to the supply switching valve (FV) no longer closing, a pressure reduction P for ABS intervention can be achieved, for example, via the switching valves (SV3, SV4) and one of the central outlet valves (ZAV). reduction (and pressure booster P build-up ) can still be implemented.

[0081] In addition to the primary seal (D2) and secondary seal (D1), the single master cylinder may further have redundant primary and / or secondary seals, in particular a redundant primary seal (D2r) as shown in FIG. 1b.

[0082] The leakage opening between the primary seal (D2) and the secondary seal (D1) in the single master cylinder is a so-called diagnostic valve (V), shown in FIG. 2 and described further below. D) can be connected to the reservoir (VB). reduction In the event of a failure in which the pressure cannot be delivered via the (central) outlet valves (ZAV and, if present, ZAV2), the pressure can be reduced by releasing the pressure into the reservoir (VB) via the open supply switching valve (FV) and the single master cylinder. In FIG. 1a, the pressure reduction P reduction can be achieved only with a very small volume flow rate, whereas the reduced pressure P in Fig. 1b reduction In the case of , a relatively large volume flow can be returned to the reservoir (VB), and this volume flow delivered is V D By suitable control of the associated solenoid valves (e.g. SV1, SV2, SV3, SV4, BP1, BP2, FV), e.g. by pulse width modulation (PWM), the diagnostic valve (V D ) so as not to exceed the limit volume flow rate P reduction Therefore, the diagnostic valve (V D ) remains open during pressure reduction. On the other hand, the diagnostic valve (V) for monitoring the seal of the master cylinder, i.e., the secondary seal (D1), as explained in FIG. 1a, is also used. D ) can be performed, in which case, V D A volumetric flow exceeding the closed volumetric flow of the diagnostic valve (V) is delivered to the master cylinder by the pressure supply unit (DV). D ) is closed, it is possible to determine that sealing is achieved via the pressure characteristic curve detected by the pressure sensor (DG). To increase safety in Fig. 1a with a single central outlet valve (ZAV), the hydraulic connection between the single master cylinder and the reservoir (VB) can be replaced by a diagnostic valve (V) shown in Fig. 1b. D ) may be substituted by a connection to

[0083] In contrast to FIG. 1a, a redundant primary seal (D2r) can be used to protect the primary seal (D2) in the master cylinder that is not protected by the combination of the throttle (Dr1) and the check valve (RV1). Diagnosis of the primary seal can be performed during braking via the force-stroke sensor (KWS) and the pedal stroke sensors (Sp1, Sp2). Alternatively, diagnosis of the primary seal can be performed via a pressure sensor and the pedal stroke sensors (Sp1, Sp2) in a single master cylinder.

[0084] FIG. 2 shows, for example, the diagnostic valve (V D ) is shown. The backpressure valve may have two openings, one of which may have a valve seat and preferably a larger opening cross section than the other opening. Furthermore, the backpressure valve may have a plunger with a sealing ball (18), which may be clamped in the valve housing by a spring (F) so that the sealing ball (18) cannot close the valve seat of the larger opening when no liquid is flowing. In contrast, when liquid flows through an opening with a valve seat via an opening without a valve seat, a backpressure can be generated due to the predetermined geometry of the opening, the valve seat, and the sealing ball (18) above a so-called closing volume flow rate. This backpressure presses the sealing ball (18) against the valve seat and thus closes the valve in this direction. At volume flows above the closing volume flow rate, the diagnostic valve (V) D When the diagnostic valve (V D ) is V D When the predetermined opening volume flow rate is reached, the valve can be opened again in the same flow direction. In the other flow direction, brake fluid can be conveyed through the valve without closing.

[0085] Figures 3a to 3c show various embodiments according to the invention for a so-called fail-safe single master cylinder unit (SHZ) in a brake system according to the invention, the protection measures described below can also be used in tandem master cylinder units (THZ). The single master cylinder units (SHZ) described in connection with Figures 3a to 3c can also be used in the systems according to Figures 1a to 1b, 4a to 4c and 5a to 5b, respectively.

[0086] 3a shows an embodiment of a single master cylinder unit (SHZ) with a redundant secondary seal (D1r) for protecting the master cylinder seal from the outside, as shown in FIG. 1a. The master cylinder further has another opening between the secondary seal (D1) and the redundant secondary seal (D1r), which is connected to the reservoir (VB) via a throttle (Dr4). The seal of the secondary seal (D1) can also be diagnosed via this connection.

[0087] FIG. 3b shows an embodiment of a single master cylinder unit (SHZ) for the connection of the master cylinder to the reservoir (VB) corresponding to that shown in FIG. 1b.

[0088] FIG. 3c shows one embodiment of a single master cylinder unit (SHZ) with a redundant primary seal (D2r) and, optionally, a redundant secondary seal (D1r). In addition to the leakage opening between the primary seal (D2) and the secondary seal (D1), the master cylinder may have another opening between the primary seal (D2) and the redundant primary seal (D2r). In this case, the two openings may be connected via a single hydraulic line, which is also connected to the reservoir (VB) via a switchable reservoir shutoff valve (17). The reservoir shutoff valve (17) can be considered a redundant pressure chamber seal because it can be closed if one of the primary seals (D2, D2r) leaks. The reservoir shutoff valve (17) in FIG. 3c can be designed as a solenoid valve that opens when electrically disconnected. This allows the brake system to be filled and vented even when electrically disconnected.

[0089] 1a and 3a, it is further possible that the diagnosis of the seal of the master cylinder against the outside, i.e. the secondary seal (D1), is carried out via the residual pressure or the pressure supply unit (DV) when the reservoir shut-off valve (17) is closed in the standstill state. In the case of a further opening of the master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r), connected to the reservoir (VB) via another redundant secondary seal (D1r) and a throttle (Dr4), the leakage flow through Dr4 can be taken into account in the diagnosis.

[0090] A number of further openings may be provided between the further redundant primary seals, and these further openings may also be connected to the reservoir (VB) via reservoir shut-off valves (17).

[0091] In this case, fail-safe generally means that individual failures of elements of the brake system are protected against by redundant means, and that failures of the elements of the brake system or of the redundant means can be confirmed by diagnostics. An individual failure (or individual defect) is a failure (or defect) of only one element of the brake system. A double failure (or double defect) or multiple failure (or multiple defect) on the other hand refers to failures (or defects) of two or more elements of the brake system. Generally, double or multiple defects can be tolerated if the likelihood of their occurrence is extremely low. However, double defects that could lead to failure of the entire brake system should be avoided in a fail-safe system. Double defects in a fail-safe system can be avoided if so-called potential individual defects, which together with another individual defect each lead to a double defect, are protected against or confirmed redundantly by additional diagnostics.

[0092] A single master cylinder is fail-safe if the master cylinder's pressure chamber seal is fail-safe. Under normal, i.e., fault-free, conditions, the pressure chamber seal of the single master cylinder is realized, for example, by the single master cylinder's primary seal (D2). Individual failure of the pressure chamber seal of the single master cylinder, caused, for example, by leakage of the primary seal (D2), can lead to failure of the entire brake system. Therefore, the desired fail-safe requires at least one redundant means for the pressure chamber seal and at least one diagnostic of the pressure chamber seal or the redundant means for the pressure chamber seal. The fail-safe master cylinder can be used at levels 3 to 4 according to the SAE J3016 standard.

[0093] The at least one redundant means required for the pressure chamber seal may be, for example: - as in Figures 1a and 3a, by means of the above-mentioned throttle in combination with a check valve (RV1) and a throttle (D1r) in the connection of the master cylinder to the reservoir (VB), with a negligible change in pedal travel in this case, or via a second redundant primary seal (D2r), as in Figures 1b, 3b and 3c, or by closing a switchable reservoir shut-off valve (17) connecting the leakage opening of the single master cylinder to the reservoir (VB), as in FIG. 3c. It can be realized.

[0094] While one redundant means is sufficient for fail-safe operation of the master cylinder (apart from at least one additional diagnostic that may be required), redundant means may be combined appropriately to increase safety. For example, a separate redundant primary seal (e.g., D2r) may be used that does not rely on the redundant means (Dr1 / RV1 combination or reservoir shut-off valve 17) provided in the master cylinder's connection to the reservoir (VB). In principle, it is also conceivable to combine the Dr1 / RV1 combination with the reservoir shut-off valve 17.

[0095] At least one diagnosis of the pressure chamber seal or the redundant means of the pressure chamber seal may be performed as a diagnosis of the pressure chamber seal, e.g. - pedal force (F P The sealing of the primary seal (D2) is monitored during braking, i.e. foot-transmitted operation, by a force-stroke sensor (KWS) on the piston of the master cylinder or a pressure sensor in the pressure chamber of the master cylinder, which measures the pressure in the pressure chamber or the pedal force (F P ) or pressure, respectively, are analyzed according to the movement of the piston (3) detected by the pedal travel sensors (Sp1, Sp2); Or it may be performed as a diagnostic for redundant means of pressure chamber sealing, e.g. - as in Figures 1a and 3a, the combination of the throttle (Dr3) and the check valve (RV1) can be diagnosed by the residual pressure in the brake system or the pressure supply unit (DV) when the vehicle is stationary, preferably when parked, by comparing the return to the reservoir (VB), which can be determined for example via the delivery volume of the pressure supply unit (DV) and / or the change in the filling level in the reservoir (VB), with a possible blocking by the check valve (RV1) and throttling by the throttle (Dr1); - Or as in Figure 3c, the sealing of the switchable reservoir shut-off valve (17) can be checked via the pressure supply unit (DV) and the corresponding valve positions (e.g. closed SV1, SV2, SV3, SV4, ZAV, 14 and open BP1, FV), possibly taking into account a fill level sensor in the reservoir (VB).

[0096] With regard to the diagnostics that are preferably performed when the vehicle is stationary while parked, safety can be increased by diagnostics that are performed during the braking operation, and thus during several strokes in particular.Further redundant primary seals (e.g., D2r) in the master cylinder can likewise be diagnosed by a force-stroke sensor (KWS) and / or a pressure sensor provided in the pressure chamber of the master cylinder.

[0097] If the braking system is connected to a stroke simulator (WS), as is customary in "brake-by-wire" systems, the stroke simulator (WS) should also be of fail-safe design. The stroke simulator (WS) is fail-safe if the pressure chamber seal of the stroke simulator (WS) is fail-safe. Under normal, i.e., fault-free, conditions, the pressure chamber seal of the stroke simulator (WS) is realized, for example, by the stroke simulator seal (D3) of the stroke simulator (WS). An individual failure of the seal of the stroke simulator pressure chamber, caused, for example, by a leak in the stroke simulator seal (D3), can also lead to a failure of the entire brake system. The desired fail-safe therefore requires at least one redundant means for the pressure chamber seal and at least one diagnosis of the pressure chamber seal or the redundant means of the pressure chamber seal.

[0098] At least one redundant means for sealing the pressure chamber is required, e.g. -Can be realized by a second redundant stroke simulator seal (D3r); Or, as in Figures 1a, 1b, 3a, 3b and 3c, this can be achieved by a second redundant stroke simulator seal (D3r) and the aforementioned restriction of the leakage via a restriction (Dr3) between the stroke simulator seal (D3) and the redundant stroke simulator seal (D3r), in this case with a gradual pedal travel change.

[0099] At least one diagnosis of the pressure chamber seal or the redundant means of the pressure chamber seal of the stroke simulator may be carried out as a diagnosis of the pressure chamber seal, for example - pedal force (F P During braking, i.e. foot-transmitted operation, the sealing of the stroke simulator seal (D3) (and primary seal (D2)) is monitored by a force-stroke sensor (KWS) on the piston of the master cylinder or a pressure sensor in the pressure chamber of the master cylinder, which measures the pedal force (F P ) or pressure, respectively, are analyzed according to the movement of the piston (3) detected by the pedal travel sensors (Sp1, Sp2); - or as in Figures 1a, 1b, 3a, 3b and 3c, the residual pressure in the brake system or the pressure supply unit (DV) is monitored in the corresponding valve position by comparing the return to the reservoir (VB), which can be determined for example via the delivery volume of the pressure supply unit (DV) and / or the change in the filling level in the reservoir (VB), with possible blocking by the check valve (RV1) and throttling by the throttles (Dr1, Dr2), possibly taking into account a filling level sensor in the reservoir (VB); -Or as in Figure 3c, the seal of the stroke simulator seal (D3) can be checked via the pressure supply unit (DV) and the corresponding valve positions (e.g. closed SV1, SV2, SV3, SV4, ZAV, 17 and open BP1, FV, 14), possibly taking into account a fill level sensor in the reservoir (VB).

[0100] To enhance safety, multiple diagnostics may be appropriately combined.

[0101] Typically, the location of a leak in the diagnosed connected pressure chamber cannot be determined based on the hydraulic connection between the master cylinder pressure chamber and the stroke simulator (WS), because the leak may be caused by, for example, both a leak in the master cylinder primary seal (D2) and a leak in the stroke simulator seal (D3). This is sufficient for fail-safe purposes as long as the seals in the diagnosed connected pressure chamber include both seals (D2, D3). If a stroke simulator shut-off valve (14) is present, any leak in the stroke simulator (WS) or the master cylinder can be determined.

[0102] The safety requirements for the sealing of a single master cylinder against the outside, which can be implemented under normal conditions, for example, via a secondary seal (D1), can be less stringent than those for the sealing of the master cylinder pressure chamber, because, on the one hand, the secondary seal (D1) is not subjected to high pressure and, on the other hand, the consequences of a failure are less critical. In contrast to the stricter requirements for fail-safe, safety is guaranteed if there is redundant means for at least one of the elements and / or if a failure of one of the elements can be diagnosed.

[0103] An individual failure of a seal of a single master cylinder to the outside, e.g. leakage of the secondary seal (D1), which may lead to loss of brake fluid, can be avoided by redundantly, e.g. - as in Figures 3a and 3c, may be protected by a second redundant secondary seal (D1r), Or, as in Figures 3a and 3c, another opening of the single master cylinder between the secondary seal (D1) and the redundant secondary seal (D1r) can be protected by throttling by another throttle (Dr4) which in this case connects to the reservoir (VB) with a gentle leakage, which can also be monitored, for example, via the change in the level of brake fluid in the reservoir (VB) when the vehicle is stationary.

[0104] Furthermore, the sealing of the secondary seal (D1) can be determined or diagnosed during non-braking operations, which refers to operations in which no braking operation is performed, in particular when the vehicle is stationary (e.g., when parking), i.e. As already mentioned above in FIGS. 1a and 3a, the volume is conveyed into the reservoir (VB) via the master cylinder in a first stage by the residual pressure in the brake circuits (BK1, BK2) and in a second stage by the pressure supply unit (DV), the delivery volume of which is compared with the normal conceivable throttle flow at the pressure set by the closed-loop control; or as already mentioned above in FIGS. 1b and 3b, the volume is supplied by a pressure supply unit (DV) via the master cylinder into the reservoir (VB) and via a diagnostic valve (V D ) is carried in a fluid flow exceeding the closed volume flow rate of the pressure sensor (DG), and the pressure characteristics detected by the pressure sensor (DG) are analyzed; Or as in FIG. 3c, a volume is delivered by a fluid flow by the pressure supply unit (DV) through the master cylinder into the reservoir (VB), while the reservoir shut-off valve (17) is closed and the delivery volume of the pressure supply unit (DV) is compared with the normal possible throttle flow through the throttle (Dr4) at the pressure set by the closed-loop control.

[0105] For increased safety, redundancy measures and diagnostics may be combined in various suitable ways, in which the fill level sensor (6) in the reservoir (VB) may also or additionally be used to check for leaks.

[0106] The safety requirements for the seal of the supply switching valve (FV) in the closed state, i.e., the seal of the supply switching valve (FV) in the normal state, for example, by the seal of the valve seat, can also be less stringent than the safety requirements for the seal of the master cylinder pressure chamber, since the consequences of a failure are less critical. In contrast to the stricter requirements for fail-safe, safety is guaranteed if there is at least one redundant means of the elements and / or if a failure of one of the elements can be diagnosed.

[0107] In the event of an individual failure of the seal of the supply switching valve (FV), which may be caused, for example, by dirt particles, and which may impair the "brake-by-wire" function and upset the force-stroke characteristics of the brake pedal system, it is possible, for example, to prevent the brake pedal from being turned off via redundant means, i.e. - via another directly connected solenoid valve (not shown), - Or, as already described in Figures 1a, 1b, 3a, 3b and 3c, by closing the solenoid valves ZAV, SV3, SV4, BP1 or possibly ZAV, BP1, BP2 and deactivating the second brake circuit (BK2), sufficient braking force can still be supplied via the first brake circuit (BK1) (e.g. 50% of the braking effort still remains dependent on the wheel arrangement).

[0108] Furthermore, as in Figures 1a, 1b, 3a, 3b and 3c, preferably during non-braking operation, the sealing of the closed supply switching valve (FV) can be determined via the pressure supply unit (DV) and pedal travel changes. To increase safety, redundancy measures and diagnostics can be combined in various suitable ways.

[0109] If the (central) outlet valves (ZAV, ZAV2) in the hydraulic control unit (HCU) can no longer be opened, the pressure reduction P via the master cylinder reduction 1a and 3a can only be achieved by squeezing (through Dr1), whereas in Figs. 1b, 3b and 3c the reduced pressure P reduction This may be done without much throttling via the master cylinder.

[0110] The hydraulic connection between at least one hydraulic outlet of the master cylinder and the supply switching valve (FV) may be made via a back pressure valve (19), as in Figures 3b and 3c, which is configured and connected to throttle in the flow direction from the master cylinder towards the hydraulic control unit in the event of an excessively high pedal force (greater than about 500 N), for example by means of a perforated valve plate (20) in the back pressure valve (19) which blocks the main outlet by back pressure action but maintains the second throttle outlet by means of a throttle point arranged in the valve plate (20).

[0111] FIG. 3d shows an example of a pedal force-travel characteristic curve (21) for the brake pedal (1) of the single master cylinder unit (SHZ) of FIG. 3c, where the pedal travel (Sp) is plotted relative to the total pedal travel. The return force of the brake pedal (1) is generated by a return spring (RF1) in the master cylinder (up to 10% of the travel range in FIG. 3d) and by a controllable elasticity in the stroke simulator (WS) (from 40% of the travel range in FIG. 3d). To prevent the brake pedal (1) from collapsing in the event of a seal defect in the pressure chamber of the master cylinder or the stroke simulator (WS), an additional return spring (RF2) can be installed in the master cylinder, which increases the slope of the pedal force-travel characteristic curve of the brake pedal (1), for example, from approximately 10% of the pedal travel.

[0112] One preferred embodiment of the brake system according to the invention can be derived from FIG. 3b, in which a diagnostic valve V is provided at the connection of the master cylinder to the reservoir (VB). DIn this embodiment, the master cylinder is directly connected to the reservoir (VB) via a leakage opening between the primary seal (D2) and the secondary seal (D1). Based on the above explanation, the single master cylinder of this embodiment is fail-safe thanks to the redundant primary seal (D2r), redundant stroke simulator seal (D3r), and force-stroke sensor (KWS). Leaks in the secondary seal (D1) can be diagnosed with a fill level sensor element (6) mounted on the reservoir (VB) or on the printed circuit board while the vehicle is stationary. Furthermore, the secondary seal (D1) can be checked for leaks during maintenance (e.g., every 2-3 years) by supplying compressed air, e.g., at 5 bar, to the reservoir (VB) with valves FV, ​​ZAV, and, if present, ZAV2, AV1-AV4, and the stroke simulator shut-off valve closed.

[0113] FIG. 4a shows another embodiment of a brake system according to the invention. In this case, in contrast to FIGS. 1a and 1b, the pressure supply unit (DV) has a dual-acting piston pump instead of a rotary pump. The dual-acting piston pump may have one piston, two pressure chambers (one in front of the piston and one behind it), and a central rod. The piston may be moved bidirectionally via the central rod and a transmission with an electric drive. For example, the transmission may be realized as a ball screw drive, and the electric drive may be realized as a brushless DC motor or in some other form. The configurations of the pressure supply unit (DV) described in connection with FIGS. 4a-4c and 5a-5b may be used in or with the systems according to the invention shown in FIGS. 1a-1b and 3a-3c.

[0114] As is well known in the prior art, the connection of wheel cylinders (e.g., RZ1, RZ2) to one brake circuit (e.g., BK1) can be realized via a single switchable inlet valve (e.g., EV1, EV2), where each wheel cylinder (e.g., RZ1, RZ2) can be connected to the reservoir (VB) via a single switchable outlet valve (e.g., AV1, AV2). The inlet or outlet valves may be considered as switching valves. Alternatively, as in FIGS. 1a and 1b, the connection of wheel cylinders (e.g., RZ3, RZ4) to a brake circuit (e.g., BK2) can be realized via a single switchable valve (e.g., SV3, SV4), where at least one brake circuit can be switchably connected to the reservoir (VB) via a central outlet valve (ZAV) and, optionally, via additional valves. Such a connection can reduce the number of solenoid valves, thereby saving costs.

[0115] One of the two pressure chambers of the double-acting piston pump can be connected to the first brake circuit (BK1) via a hydraulic outlet of the pump, a check valve (RV3) closed to the pressure supply unit (DV), and possibly another valve. The pressure chamber can also be connected to the reservoir (VB) via a suction replenishment inlet (leak opening or opening) of the pump, a check valve (RV6) closed to the reservoir (VB), and possibly another valve. The other pressure chamber can also be connected to the second brake circuit via a different hydraulic outlet of the pump, a check valve (RV4) closed to the pressure supply unit (DV), and possibly another valve. The pressure chamber can also be connected to the reservoir (VB) via a different suction replenishment inlet (leak opening or opening) of the pump, a check valve (RV5) closed to the reservoir (VB), and possibly another valve. The pump with two suction refill inlets, two hydraulic outlets and piston can be designed so that brake fluid can be pumped from the reservoir (VB) to at least one of the two brake circuits (BK1, BK2) in both directions of piston movement, i.e., during both the forward stroke and the reverse stroke, whereby the forward stroke, by definition, refers to the direction of piston movement in which the brake fluid is forced out of the pressure chamber on the side of the piston opposite the central rod (via RV3 in FIG. 4a), while the reverse stroke refers to the direction of piston movement in which the brake fluid is forced out of the other pressure chamber (via RV4 in FIG. 4a), whereby the effective piston range of the piston in this case can be smaller than the effective piston range of the piston during the forward stroke.

[0116] Depending on the embodiment, the two brake circuits (BK1, BK2) can be switchably connected to one another via a bypass valve (BP1) as in FIG. 1a or via two series-connected bypass valves (BP1, BP2) and, optionally, further valves as in FIG. 1b. This allows the brake pressure to be selectively increased in the first brake circuit (BK1) or in both brake circuits (BK1, BK2) during the forward stroke of the piston in the pressure supply unit (DV). Similarly, the brake pressure can be selectively increased in the second brake circuit (BK2) or in both brake circuits (BK1, BK2) during the retraction stroke of the piston in the pressure supply unit (DV).

[0117] In contrast to single-acting piston pumps (not shown), which are also common in brake systems and can deliver volume into the brake system in only one stroke direction (forward stroke), the brake system according to the present invention, with a double-acting piston pump and exemplary connection as shown in FIG. 4a, can prove advantageous in that it saves the time required with a single-acting piston pump, in which the piston must be fully or partially retracted with the hydraulic outlet of the pressure chamber closed before the additional required brake fluid volume can be delivered. During this empty retract stroke, pressure cannot be supplied to the brake system via the pressure supply unit (DV). In contrast, in the brake system according to the present invention with the double-acting piston pump shown in FIG. 4a, brake pressure can be continuously supplied to the brake circuits (BK1, BK2) by alternating forward and reverse strokes. In this way, the structural length of the double-acting piston pump, in particular, can be reduced.

[0118] On the other hand, a brake system according to the present invention, including a double-acting piston pump and an exemplary connection as shown in FIG. 4a, can prove advantageous in that different effective piston strokes during the piston's forward and reverse strokes can be utilized to reduce the size of the transmission and electric drive. For two pressure ranges common in brake systems, namely, on the one hand, a standard pressure range up to a so-called locking pressure of, for example, about 100-120 bar when the friction coefficient in the wheel / ground system is high, and on the other hand, a higher pressure range up to, for example, about 200 bar, the effective piston strokes of the pistons and the transmission and electric motor of the double-acting piston pump can be preferably designed so that during the forward stroke, the pressure can still be sufficiently supported in the standard pressure range, whereas in the higher pressure range, the pressure can only be supported by a relatively small piston backside. A forward stroke via a relatively large piston backside can prove advantageous when it is necessary to overcome brake play as quickly as possible, particularly when the brake pressure increases relatively slowly during filling of the wheel cylinder. A relatively small retraction stroke via the piston rear side can prove advantageous, particularly when the pressure rises significantly after the brake play is overcome and, due to this significant pressure rise, a smaller brake fluid volume has to be delivered.

[0119] In a compact design, the pressure boost P after the retraction stroke into the higher pressure range is build-up An empty pre-stroke may be required, whereby brake fluid may be conveyed from the pressure chamber with a larger effective piston range into the reservoir (VB), for example via the closed directional control valves (SV3, SV4) and inlet valves (EV1, EV2), the closed supply directional control valve (FV), preferably the closed second bypass valve (BP2), the open first bypass valve (BP1) and the open central outlet valve (ZAV). Such an empty pre-stroke may last for a maximum of approximately 100 ms, but need only be used very rarely. The subsequent reverse stroke then causes the pressure build-up P build-up can be continued in the higher pressure range.

[0120] As in the case of the rotary pump in Figures 1a and 1b, the pressure reduction P in the brake circuits (BK1, BK2) reduction This can be achieved under normal conditions via the central outlet valve (ZAV) or via a separate (central) outlet valve (ZAV2), or in case of a fault, via the supply switching valve (FV) and the single master cylinder. reduction In contrast to the pressure reduction P via the switching valves (e.g., SV3, SV4) and the central outlet valve (ZAV), reduction This may be considered advantageous in terms of the pressure difference between the individual wheel cylinders (RZ1, RZ2, RZ3, RZ4) and / or brake circuits (BK1, BK2), in which case the switching valves and / or bypass valves (BP1, BP2) can be controlled by pulse width modulation (PWM). In this way, noise generation can also be reduced to a minimum to some extent. reduction In this case, the piston of the double-acting piston pump can be brought to its initial position by a reverse stroke via its electric drive, and in this case the brake fluid volume is delivered from the pressure chamber having the smaller piston effective area into the reservoir (VB) again via at least one of the bypass valves (BP1, BP2) and the central outlet valve (ZAV).

[0121] Due to the check valves (RV5, RV6) at the connection of the double-acting piston pump to the reservoir (VB) which close towards the reservoir (VB), in this particular embodiment (partial) evacuation and venting of both pressure chambers of the double-acting piston pump is possible only via the hydraulic outlet of the pump, the respective check valves (RV3, RV4) and the respective brake circuits (BK1, BK2).

[0122] Figure 4b shows another embodiment in which, compared to Figure 4a, the check valve (RV3) at the pump outlet of the pressure chamber, which preferably has a larger effective area, is replaced by a switchable solenoid valve (PD1). As in Figure 4a, each brake circuit (BK1, BK2) can be connected via one bypass valve (BP1) or via two bypass valves (BP1, BP2) connected in series. Furthermore, a separate switchable shut-off valve (TV) can be used in the first brake circuit (BK1).

[0123] During the forward stroke of the piston, the switchable solenoid valve PD1 may be opened and pressure may be increased in each brake circuit (BK1, BK2) as in FIG. 4a. On the other hand, during the retraction stroke of the piston, the switchable solenoid valve PD1 may be closed, whereby the pressure increase P build-up During this time, the brake fluid volume is not sent back from each brake circuit (BK1, BK2) to the pressure chamber with a larger effective piston range.

[0124] In contrast to the embodiment in FIG. 4a, in the embodiment in FIG. 4b, the pressure reduction P reduction For this purpose, the switchable solenoid valve PD1 can be opened, so that, for example, the brake fluid volume can flow back from each brake circuit (BK1, BK2) via the open switchover valves (SV1, SV2, SV3, SV4), the open bypass valves (BP1, BP2) and, if present, the open shut-off valve (TV) in the first brake circuit (BK1) to the pressure chamber with the larger piston effective area of ​​the double-acting piston pump, with the central outlet valve (ZAV) and the supply switchover valve (FV) closed. In this case, brake fluid is simultaneously pumped into the second brake circuit from the smaller effective piston area, so that such a pressure reduction P reduction may be incomplete.

[0125] In the hydraulic connection of the double-acting piston pump in FIG. 4a, the additional check valves (RV3, RV4, RV5, RV6) at the pump inlet and outlet can be replaced by one switchable solenoid valve each (PD1, PD2, PD3, PD4). For example, in another embodiment shown in FIG. 4c, all check valves (RV3, RV4, RV5, RV6) are replaced by solenoid valves. As in FIG. 4a, each brake circuit can be connected via one bypass valve (BP1) or via two bypass valves (BP1, BP2) connected in series. In the embodiment in FIG. 4c, a single master cylinder, which may additionally have a force-stroke sensor (KWS) in the piston to measure the pedal force, can be directly connected to the first brake circuit (BK1), for example, via a supply switching valve (FV). In the embodiment according to FIG. 4a, for example, a redundant central outlet valve (ZAV2) connected to the first brake circuit (BK1) can be used.

[0126] By various combinations of open and closed solenoid valves (PD1, PD2, PD3, PD4), various operating states of the double-acting piston pump can be set. reduction During this time, brake fluid can be returned from each brake circuit (BK1, BK2) to the double-acting piston pump, for example via PD1. Furthermore, by opening a pump inlet (for example PD3) and closing the connected pump outlet (for example PD1), brake fluid can be pumped from each pressure chamber into the reservoir (VB).

[0127] FIG. 5a shows another embodiment of the brake pedal device having a tandem cylinder (THZ) instead of the single master cylinder (SHZ) shown in FIG. 4a. The piston (3) of the brake pedal device may be connected to a second, so-called floating piston (SK) via a first pressure chamber and a first return spring (RF), and the floating piston (SK) may also be moved in another pressure chamber opposite the second return valve (RF3). As shown in FIG. 4a, for example, the first pressure chamber between the piston (3) and the floating piston (SK) of the tandem master cylinder (THZ) may be connected to the hydraulic line between the first bypass valve (BP1) and the central outlet valve (ZAV) via a hydraulic outlet and a first supply switching valve (FV). A stroke simulator (WS) may be connected to the tandem master cylinder (THZ), for example, via a separate hydraulic outlet of the first pressure chamber and, if present, a stroke simulator shutoff valve (14). According to the present invention, the second pressure chamber of the tandem master cylinder (THZ) can be connected to the second brake circuit (BK2) via a further hydraulic outlet, a second supply switching valve (FV2), and possibly a further valve, where the second supply switching valve (FV2) can be designed as a solenoid valve that opens in the event of electrical disconnection, preferably for a fallback level. Both pressure chambers of the tandem master cylinder (THZ) can each have a leakage opening or opening, which can be sealed, for example, by at least one primary seal (D2, D5) and one secondary seal (D1, D4), and can be connected to the reservoir (VB) via a parallel-connected throttle and a check valve closing toward the reservoir (VB), as in FIG. 1a. Optionally, the hydraulic connection between each pressure chamber of the tandem master cylinder and the reservoir (VB) can be controlled by a diagnostic valve (VB) as in FIGS. 1b and 3b. D ), or via a reservoir shut-off valve (17) as in FIG. 3c, or via hydraulic lines if redundant primary seals (D2, D5) are present.

[0128] Under normal conditions, the first supply valve (FV) and the second supply switching valve (FV2) may be closed during braking, and then the pressure supply unit (DV) can increase the brake pressure in each brake circuit (BK1, BK2) by "brake-by-wire" and switching the corresponding valves in the hydraulic control unit (HCU).

[0129] The use of a tandem master cylinder (THZ) versus a single master cylinder (SHZ) can reduce the probability of total master cylinder failure without the need for separate redundant primary or secondary seals.

[0130] Figure 5b shows another embodiment of the tandem master cylinder (THZ) with a plunger compared to Figure 5a. The piston (3) of the brake pedal device may be moved in a first pressure chamber between the piston (3) and the floating piston (SK), and may be connected to another plunger and another piston, which may also be moved into a second pressure chamber on the opposite side of the return spring. The hydraulic connections and function of this tandem master cylinder (THZ) are similar to those shown in Figure 5a. The check valve RV3 is connected to the rear chamber of the floating piston (SK) via another hydraulic line and another opening provided in the tandem master cylinder. [Explanation of symbols]

[0131] RB1~4 Wheel brakes RZ1~4 wheel cylinder SV1~4 switching valve EV1~4 inlet valves AV1~4 outlet valve BK1, BK2 brake circuit DG, DG2 pressure sensor SHZ Single Master Cylinder Unit THZ, DHZ Tandem master cylinder unit, or synonymously double master cylinder KWS Force-Stroke Sensor GWS yaw angle sensor Sp1, Sp2 pedal travel sensor Sp pedal travel Fp pedal force BP1, BP2 bypass valves ZAV, ZAV2 (center) outlet valve FV, FV2 supply switching valve TV shutoff valve RV1~6 check valves DV Pressure Supply Unit HCU Hydraulic Control Unit ECU Electronic Control Unit VB Reservoir WS journey simulator SK Tandem Master Cylinder Floating Piston D1 Master cylinder secondary seal D2 Master cylinder primary seal D3 Process Simulator Primary Seal D4 Floating piston secondary seal D5 Floating piston primary seal D1r Master Cylinder Redundant Secondary Seal D2r master cylinder redundant primary seal D3r Process Simulator Redundant Primary Seals Dr1, Dr4: A throttle provided at the connection between the master cylinder and the reservoir Dr2 A throttle provided at the connection between the master cylinder and the stroke simulator Dr3 Aperture in the process simulator Dr5 Back pressure valve 19 internal restriction V D Diagnostic Valve RF, RF1~3 return spring PD1~4 Solenoid valves installed at the connection points of two-system double-acting piston pumps F spring 1 brake pedal 2 pedal plungers 3 Master cylinder piston 3a Master cylinder piston part 4 Master cylinder housing 5 Printed circuit board 6 Fill level sensor element 7 Sensor Targets 8 Float in the reservoir 9 Electronic components for a stroke simulator for force characteristics 10 Redundant electrical connections to supply diverter valves 11 Double-acting piston with spindle drive 12 Redundant connections for 2x3 phase winding motors 13 Electrical plug connector for connecting the on-board electrical system 14 Stroke Simulator Shutoff Valve 15 Stop ball 16 Sensor rod 17 Reservoir shutoff valve 18 Ball Valve 19 Back pressure valve 20 Valve plate 21 Brake pedal force-travel characteristic curve

Claims

1. A vehicle brake system, comprising: - at least one hydraulic brake circuit (BK1, BK2) with at least one hydraulically operated wheel brake (RB1, RB2, RB3, RB4); at least one pressure supply device (DV) connected via a hydraulic line to one of the brake circuits (BK1, BK2); a hydraulic brake pedal system having a master cylinder with at least one pressure chamber, the hydraulic outlet of which is switchably connected to at least one brake circuit (BK1, BK2) via a supply switching valve (FV), the master cylinder being hydraulically connected to a reservoir (VB) via at least one opening; and failure of a pressure chamber seal of the at least one pressure chamber of the master cylinder is prevented by at least one redundant means; and a pressure chamber seal or a redundant means for sealing the pressure chamber of the at least one pressure chamber of the master cylinder can be diagnosed for failure; Vehicle braking system.

2. 2. The brake system according to claim 1, further comprising a switching valve (AV, SV1, SV2, SV3, SV4) for each of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4), the switching valves switchably connecting each one of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4) to one of the two brake circuits (BK1, BK2).

3. 3. A brake system according to claim 1, further comprising at least one hydraulic connection, which can be switched between the two brake circuits by at least one bypass switching valve.

4. 4. The brake system according to claim 1, wherein the brake system has a single master cylinder (SHZ).

5. 5. A braking system according to any one of claims 1 to 4, characterized in that the braking system comprises an open-loop / closed-loop control unit (ECU).

6. 6. A brake system according to claim 1, wherein the master cylinder comprises a force-travel sensor (KWS) for ascertaining the pedal force and / or the master cylinder comprises a pressure transducer for detecting the pressure in the at least one pressure chamber of the master cylinder, the brake system optionally comprising at least one pedal travel sensor (Sp1, Sp2).

7. 7. Brake system according to claim 1, wherein at least one pressure chamber of the hydraulic brake pedal system is connected to a stroke simulator (WS) via a hydraulic valve circuit.

8. 8. The brake system of claim 7, wherein a failure of a pressure chamber seal of a pressure chamber of the stroke simulator (WS) is prevented by at least one further redundant means, and the failure of the pressure chamber seal of at least one of the pressure chambers of the stroke simulator (WS) is diagnosable.

9. 9. A brake system according to claim 7, wherein the pressure chamber of the stroke simulator (WS) is sealed by a stroke simulator seal (D3).

10. 10. The brake system of claim 9, wherein the pressure chamber of the stroke simulator (WS) has at least one second stroke simulator seal (D3r), which is redundant to the stroke simulator seal (D3) and serves as the pressure chamber seal for the at least one pressure chamber of the stroke simulator (WS).

11. 11. The brake system of claim 10, wherein the stroke simulator (WS) has a stroke simulator opening between the stroke simulator seal (D3) and the redundant stroke simulator seal (D3r), the stroke simulator opening being connected to a reservoir (VB) via a third restriction (Dr3).

12. Brake system according to any one of claims 9 to 11, characterized in that the stroke simulator seal (D3) is the pressure chamber seal of the pressure chamber of the stroke simulator (WS).

13. 13. A braking system according to claim 12, wherein said open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in said stroke simulator seal (D3), optionally using said pressure supply device (DV).

14. The brake system of claim 13, wherein the force-travel sensor (KWS) is not used for the diagnostics.

15. 13. The braking system of claim 12, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the stroke simulator seal (D3) using the force-stroke sensor (KWS) and / or the pressure transducer.

16. Brake system according to any one of the preceding claims, wherein the opening is sealed by at least one primary seal (D2) and optionally at least one secondary seal (D1).

17. 17. Brake system according to claim 1, wherein the hydraulic connection comprises a parallel circuit of a throttle (Dr1) and a check valve (RV1) closing in the direction of the reservoir (VB).

18. 18. A brake system according to claim 16 or 17, wherein the primary seal (D2) is the pressure chamber seal of the at least one pressure chamber of the master cylinder.

19. 19. The braking system of claim 18, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a failure of the primary seal (D2) using the force-travel sensor (KWS) and / or the pressure transducer.

20. 18. The brake system according to claim 17, wherein the throttle (Dr1) and the check valve (RV1) closing in the direction of the reservoir (VB) are the redundant means of the pressure chamber seal of the at least one pressure chamber of the master cylinder.

21. 21. A braking system according to claim 20, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a failure of the redundant means of the pressure chamber seal, optionally using the pressure supply device (DV).

22. 22. A braking system according to any one of claims 16 to 21, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a failure of the secondary seal (D1), optionally using the pressure supply device (DV).

23. 23. Brake system according to any one of claims 1 to 22, characterized in that the reservoir (VB) comprises a level converter capable of detecting the filling level of the reservoir (VB).

24. 24. A brake system according to claim 23, wherein a fault in the secondary seal (D1) can be diagnosed via the level converter in the reservoir (VB), in particular during maintenance, when a pressure of, for example, about 5 bar is generated in the reservoir (VB).

25. Brake system according to any one of claims 21 to 24, wherein the force-travel sensor (KWS) is not used for the diagnosis.

26. 26. A brake system according to any one of the preceding claims, wherein the master cylinder has at least one redundant secondary seal (D1r) for the secondary seal (D1).

27. 27. The brake system of claim 26, wherein the master cylinder has another opening between the secondary seal (D1) and the redundant secondary seal (D1r), the another opening being connected to the reservoir (VB) through another restriction (Dr4).

28. 28. The brake system according to claim 1, wherein the master cylinder has at least one redundant primary seal (D2r) for the primary seal (D2), the redundant primary seal (D2r) being used for sealing the pressure chamber.

29. The hydraulic connection is provided with a valve (VB) that closes when a predetermined limit volume flow rate is exceeded in the flow direction from the master cylinder to the reservoir (VB) and is always open in the opposite flow direction. Ｄ 27. The braking system of claim 26, further comprising:

30. 30. A braking system according to claim 28 or 29, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a failure of the redundant primary seal (D2r) using the force-stroke sensor (KWS) and / or the pressure transducer.

31. The open-loop / closed-loop control unit (ECU) controls the valve (V Ｄ 31. A braking system according to claim 29 or 30, adapted to diagnose faults in the pressure supply device (DV), optionally using said pressure supply device (DV).

32. 32. Brake system according to any one of claims 1 to 31, characterized in that the hydraulic connection comprises a switchable solenoid valve (17).

33. 33. A brake system according to claim 32, wherein the master cylinder has at least one redundant primary seal (D2r), and the master cylinder has at least one further opening between the at least one redundant primary seal (D2r) and the at least one primary seal (D2), the further opening also being switchably connected to the reservoir (VB) via the switchable solenoid valve (17).

34. 34. A brake system according to claim 32 or 33, wherein the master cylinder has at least one further opening between the at least one redundant secondary seal (D1r) and the at least one secondary seal (D1), the further opening being connected to the reservoir (VB) via a further restriction (Dr4).

35. 35. The braking system according to any one of claims 32 to 34, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the switchable solenoid valve (17) by means of the force-stroke sensor (KWS).

36. 35. A braking system according to any one of claims 32 to 34, wherein the open-loop / closed-loop control unit (ECU) is adapted to diagnose a fault in the switchable solenoid valve (17), optionally using the pressure supply device (DV), without using the force-travel sensor (KWS) for the diagnosis.

37. 37. A brake system according to claim 1, wherein each hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is assigned a switchable inlet valve (EV), and the switch valve (AV) of each hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is connected to the reservoir (VB).

38. 38. The brake system according to claim 1, further comprising at least one hydraulic connection switchable between at least one of the brake circuits (BK1, BK2) and the reservoir (VB) via at least one outlet switching valve (ZAV).

39. 39. A braking system according to claim 38, wherein the pressure reduction in the at least one hydraulically operated wheel brake (RB1, RB2, RB3, RB4) is achieved by opening the outlet switching valve (ZAV) and the associated switching valve (SV1, SV2, SV3, SV4).

40. 40. A brake system according to claim 38 or 39, wherein the two hydraulic brake circuits (BK1, BK2) are connected to each other via the bypass switching valve (BP1) and another bypass switching valve (BP2) connected in series, and the outlet switching valve (ZAV) is connected to a pipe section between the two bypass switching valves (BP1, BP2).

41. 41. Brake system according to claim 1, wherein pressure reduction in at least one of the hydraulically operated wheel brakes (RB1, RB2, RB3, RB4) can be effected via the master cylinder.

42. 42. A braking system according to any one of claims 1 to 41, comprising a first return spring (RF1) and optionally a second return spring (RF2), the second return spring (RF2) acting against possible pedal depression.

43. 43. A brake system according to any one of claims 1 to 42, wherein the at least one pressure chamber of the master cylinder is connected to the supply switching valve (FV) via an inserted back pressure valve (19).

44. 44. A brake system as claimed in claim 43, wherein the back pressure valve (19) acts as a throttle towards the supply switching valve (FV) and does not substantially throttle in the opposite direction when a pressure in excess of a predetermined pressure is generated from the master cylinder in the direction of the supply switching valve (FV).

45. 45. Brake system according to any one of claims 1 to 44, characterized in that the brake system comprises at least two hydraulic brake circuits (BK1, BK2).

Images