HYDRAULIC SYSTEM WITH AT LEAST ONE PRESSURE SUPPLY DEVICE AND A SAFETY GATE FOR THE CONNECTION OF THE HYDRAULIC CIRCUITS

Abstract

A hydraulic system includes at least two hydraulic circuits with hydraulic circuit lines and at least one hydraulic component connected to each hydraulic circuit or to a hydraulic circuit line thereof via a respective switch valve used for pressure build-up and release. At least one pressure supply device can build up pressure in both hydraulic circuits. At least one circuit separating valve blocks or releases a hydraulic connection line connecting the two hydraulic circuits. At least one outlet valve selectively connects an accumulator container to at least one hydraulic circuit. A hydraulic connection between a pump of the pressure supply device and a respective hydraulic circuit connects a return flow from the hydraulic circuit into the pressure supply device or its pump. A controlled feed valve or a non-return valve controls the hydraulic connection. A pressure supply device or outlet valve releases pressure in at least one hydraulic component.

Description

The present invention relates to a hydraulic system, in particular in the form of a brake system, having two hydraulic circuits with hydraulic circuit lines, in particular in the form of brake circuits, wherein at least one hydraulic component per hydraulic circuit, in particular in the form of a wheel brake, is provided, wherein each hydraulic component is connectable via a respectively assigned switching valve to the respective hydraulic circuit or to the hydraulic circuit line thereof, wherein the pressure build-up and the pressure reduction in the hydraulic component are performed via the respectively assigned switching valve, and that at least one pressure supply device is provided, by means of which a pressure build-up in both hydraulic circuits is performed or can be performed, wherein at least one circuit isolation valve is provided, which serves for selectively shutting off or opening up a hydraulic connecting line that connects the two hydraulic circuits.

Use is increasingly being made of hydraulic systems with two or more circuits, wherein the safety requirements for these hydraulic systems are increasing. In particular, the following fault situations and functions must be taken into consideration or provided:

• a. The failure or malfunction of one hydraulic circuit must not affect the function of the other hydraulic circuit;
• b. If two pressure supply devices are present, in the event of failure of one of the pressure supply devices, the full functionality of the hydraulic system must be maintained by means of the remaining pressure supply device;
• c. If only one pressure supply devices is available, an auxiliary pressure supply with low power for so-called emergency operation must be present for the event of failure thereof;
• d. In the hydraulic circuits, a supply must be provided to closed-loop control systems which require both an open-loop-controlled and/or closed-loop-controlled pressure increase and also an open-loop-controlled and/or closed-loop-controlled pressure reduction for closed-loop control operation.

For the fail safety of the hydraulic system, it is necessary to always use diagnostic functions or programs to trace faults in the hydraulic system and to implement corresponding measures. In particular, it is highly important to pay attention to single and double faults.

Possible single and double faults in a hydraulic system will be discussed below on the basis of a two-circuit brake system.

The extent to which a vehicle can take over the tasks of the driver when required, and how man and machine interact on the road today and will do so in the future, are covered in the various development steps. The five levels of automation of the vehicle are often referred to, which are listed below:

• Level 1: Assisted driving, in the case of which driver assistance systems assist the driver but are not yet capable of steering the vehicle themselves;
• Level 2: Partially automated driving, in the case of which systems can take over inter alia the steering the vehicle, but the driver always remains responsible;
• Level 3: Highly automated driving, in the case of which the driver can divert their attention from the driving situation for longer periods of time in certain situations;
• Level 4: Fully automated driving, in the case of which the vehicle drives predominantly independently, but the driver must be capable of driving;
• Level 5: Autonomous driving, in the case of which the vehicle takes over all driving functions and the persons in the vehicle are purely passengers.

Whether single and/or double faults in a brake system can be tolerated therefore depends on the degree of automation or the abovementioned level of the vehicle.

I. Single Fault

In the case of a brake system for a level 2 vehicle, single faults are permitted if the minimum braking action of approximately <0.3 g is still achieved. Such a low level of braking deceleration can however be classed as posing an extremely high risk of accidents.

In the case of a brake system for a level 3 vehicle, a braking deceleration of at least 0.5 g should be achieved, wherein the ABS function must also be ensured.

II. Double Fault with Total Brake Failure

In many systems, double faults are accepted if the probability of failure based on ppm and FIT data is low.

A risk is posed in particular by dormant faults if no corresponding diagnosis is performed.

In the case of high safety requirements, critical single faults, which for example cause the braking action to be reduced to less than 0.5 g, should be preventable through redundancies and identifiable by means of diagnostic functions. and

A typical case of a dormant fault is outlined below:

The brake system has, for example, only one pressure supply device which provides a supply to two brake circuits with four wheel brakes via infeed valves. As soon as one of the four wheel brakes fails, this fault cannot be localized. As a result, the entire pressure supply fails. By means of an auxiliary pressure supply, such as the master brake cylinder which is actuatable by means of the brake pedal, only one brake circuit can still be supplied with a reduced pressure level. Owing to the critically low pressure level, it is also the case that only a very weak and therefore dangerous braking action is achieved. It is normally the case that important components cannot be diagnosed either. For example, a solenoid valve, which is always open in the normal situation, cannot be diagnosed with regard to its leak-tightness, because the leak and thus the fault only occur upon a change to another operating state.

A double fault with a dormant fault occurs, for example, in the event of failure of one brake circuit which is connected to the other brake circuit via only one circuit isolation valve. The circuit isolation valve, which is open in the normal situation, must be closed in the event of failure of the brake circuit. However, owing to a (dormant) fault, said circuit isolation valve does not close completely, such that the other brake circuit consequently also fails, which leads to a total failure of the brake system.

It is therefore the object of the invention to provide a fail-safe hydraulic system.

Said object is achieved according to the invention by means of a hydraulic system having the features of claim 1. Advantageous embodiments of the hydraulic system according to claim 1 result from the features of the subclaims.

The hydraulic system according to the invention is distinguished by a particularly high level of fail safety and diagnostic capability.

Advantages of the Invention

The advantageous provision of a means for isolating the pressure supply device from one or both brake circuits or for preventing an undesired backflow of hydraulic medium from a hydraulic circuit into the pressure supply device prevents the entire hydraulic system from failing in the event of a fault of the pressure supply device, because either closed-loop pressure control can be performed in at least one hydraulic circuit by means of the other pressure supply device, if present, and/or a pressure build-up can be performed by means of an auxiliary pressure supply. A switching valve in the form of an infeed valve may be used for the isolation of the pressure supply device. This is expedient whenever the pressure supply device has a piston pump, in particular a piston-cylinder pump. If the pressure supply device has a pump by means of which only a pressure build-up is possible, a check valve is advantageously sufficient to prevent an undesired backflow of hydraulic medium from the hydraulic circuit into the pump.

For the isolation of the auxiliary pressure supply, a further isolation valve may likewise be provided between the auxiliary pressure supply and the safety gate or a hydraulic circuit.

The pressure reduction in at least one hydraulic component can advantageously be performed in the hydraulic system according to the invention either by means of a pressure supply device or via an outlet valve, in a manner dependent on the state of the hydraulic system itself and/or the closed-loop pressure control situation. This measure enables the hydraulic system to continue to be operated even if single or double faults have occurred, as will be discussed in detail further below.

Depending on the use of the hydraulic system according to the invention and the associated requirements with regard to the fail safety of the hydraulic system, either only one circuit isolation valve or two circuit isolation valves arranged in series may be provided for the selective isolation and connection of the two hydraulic circuits.

If only a single switched circuit isolation valve is provided, it is advantageous if the hydraulic circuit that is separated from the pressure supply device by means of a circuit isolation valve is connectable via an outlet valve to a reservoir for the pressure reduction in the respective hydraulic circuit. When the circuit isolation valve is closed, a pressure increase or a pressure reduction can then be performed in the other hydraulic circuit by means of the pressure supply device.

If two series-connected circuit isolation valves are provided, it is advantageous if the hydraulic line which connects the two circuit isolation valves arranged in series, and which forms a part of the hydraulic connecting line for connecting the two hydraulic circuits, is connectable via an outlet valve to the reservoir. In this way, pressure can be reduced by dissipation into the reservoir via the respective switching valve assigned to the wheel brake, a circuit isolation valve and via the outlet valve. Here, at the same time, a pressure increase or a pressure reduction can be performed in the other hydraulic circuit by means of a pressure supply device.

A controllable valve arranged between the wheel brake and the reservoir, for example the switching valve assigned to the wheel brake, the outlet valve or the circuit isolation valve, may in this case be controlled with a pulse-width signal, such that the pressure reduction gradient is settable.

In the event of a failure of all present electromotively operated pressure supply devices of the hydraulic system, a fall-back level may be formed by means of an optional auxiliary pressure supply. This may for example be a master brake cylinder in a brake system, which is actuatable by means of a brake pedal such that a hydraulic pressure can be built up in at least one hydraulic circuit by means of the brake pedal. Advantageously, this auxiliary pressure supply can be connected via a further hydraulic line, for the selective shut-off of which a switching valve is provided, to one or both hydraulic circuits. If only one circuit isolation valve is present, this further hydraulic line is connected to a hydraulic circuit, or to the hydraulic circuit line thereof, which is in particular isolated from the pressure supply device by means of the circuit isolation valve. In the event of failure of the pressure supply device, this can be decoupled from both hydraulic circuits by closure of the infeed valve, such that a pressure build-up can then be achieved in both hydraulic circuits by means of the auxiliary pressure supply with the circuit isolation valve open.

In normal operation of the hydraulic system, the pressure reduction in at least one hydraulic component can advantageously be performed via an outlet valve, and, at the same time or in a temporally overlapping manner, a pressure change, in particular a pressure reduction, in at least one other hydraulic component of the other hydraulic circuit can be performed by means of a pressure supply device.

It is likewise possible that, with the hydraulic system according to the invention, a pressure build-up is performed in at least one hydraulic component by means of at least one pressure supply device and, at the same time, in a temporally overlapping manner or at a subsequent time, a pressure reduction is performed in at least one other hydraulic component. This is possible, for example, by closure of the circuit isolation valve, because both hydraulic circuits are then isolated from one another.

If two pressure supply devices are provided, each pressure supply device is advantageously connected via a respectively assigned hydraulic connecting line to in each case one hydraulic circuit or to the hydraulic circuit line thereof, wherein in each case one switchable infeed valve or at least one check valve is arranged in the respective hydraulic connecting line. A check valve is sufficient if the pressure supply device can only build up pressure but cannot actively reduce it.

If only one circuit isolation valve is present, this forms a so-called safety gate—or SIG for short. If two series-connected circuit isolation valves are present, which are connected in series, then these together form the safety gate. In the event of failure of a component of a hydraulic circuit, the hydraulic circuits are hydraulically isolated from one another by closure of the safety gate, that is to say of the at least one circuit isolation valve, and a pressure build-up and/or pressure reduction can then be performed in the other hydraulic circuit by means of a pressure supply device.

If the hydraulic system has an auxiliary pressure supply, this can, in the event of failure of a component of a hydraulic circuit and when at least one circuit isolation valve is closed, whereby the hydraulic circuits are hydraulically isolated from one another, generate a pressure build-up by means of the auxiliary pressure supply in the hydraulic circuit that is still intact.

Further safety is achieved in that, in at least one hydraulic circuit line, there is arranged a switchable isolation valve, which is in particular open when electrically deenergized and which closes or is closed in the event of failure of a switching valve and/or of a hydraulic component of the respective hydraulic circuit.

Furthermore, in a fault situation or in order to achieve a high pressure and/or a rapid pressure change, the two circuit isolation valves may be open, wherein, in the fault situation, only one pressure supply performs the pressure supply for both hydraulic circuits, and both pressure supply devices cooperate to achieve a high pressure and/or a rapid pressure change.

Through the use of at least one pressure sensor, the ascertained pressures can advantageously serve or be used as an input variable for closed-loop control of the pressure change, in particular during the pressure build-up.

With the hydraulic system according to the invention and its multiple redundancies, various methods can be implemented for the pressure change in at least one hydraulic component, whereby the possibility of an ABS method, for example, is still available even if faults have occurred.

For example, for the pressure build-up in a hydraulic component, one pressure supply device alone or in cooperation with the other pressure supply device may provide a pressure or a hydraulic volume, wherein the respective switching valve is permanently open during the pressure setting phase. Also, the pressure reduction in a hydraulic component may be performed safely and rapidly via the switching valve which is assigned to the component and which is operated with pulse width clocking, wherein the pressure supply device then only needs to provide a pressure that is at least as high as the pressure that is to be set, or set by closed-loop control.

It is likewise possible that the pressure reduction in a hydraulic component is performed by dissipation via the switching valve assigned to the component and an outlet valve, which is operated with pulse width clocking, to a reservoir, wherein the respective switching valve is permanently open during the pressure setting phase, is set or set by closed-loop control.

Alternatively, it is possible for the pressure reduction in a hydraulic component to be performed by means of a pressure supply device, wherein the respective switching valve and the circuit isolation valve(s) possibly arranged in between is or are permanently open during the pressure setting phase.

According to the invention, for the pressure build-up in a hydraulic component, one pressure supply device alone or in cooperation with the other pressure supply device may provide a pressure or a hydraulic volume, wherein the pressure in the respective hydraulic component is set, or set by closed-loop control, by means of a circuit isolation valve which is operated with pulse width clocking, wherein the respective switching valve is permanently open during the pressure setting phase.

For the methods listed above by way of example, a closed-loop controller may be provided which specifies or determines the rate of pressure change dP_{reduction/build-up}/dt for the pressure reduction and/or the pressure build-up, wherein the rate of pressure change dP_{reduction/build-up}/dt may be a function of the pressure difference Δp to be readjusted.

To increase the safety of the hydraulic system according to the invention, a further outlet valve may be arranged in parallel with respect to the central outlet valve, which advantageously results in redundancy for this component too.

The central outlet valve may also have two controllable electrical coils and/or two redundant coil connections, such that the central outlet valve can still be switched in the event of failure of one coil or of the control thereof.

If the pressure supply device has a piston-cylinder pump as a pump, this may advantageously be provided with a breather hole which is not closed by the piston only in one end position thereof, wherein the breather hole is connected via a hydraulic connection to a reservoir. When the piston has been retracted, the working chamber of the piston-cylinder pump is thus connected via the breather hole to the reservoir, such that a pressure reduction in a hydraulic component is also possible via the working chamber of the piston-cylinder pump when the switching valve is correspondingly open and the other valves connected in between are open.

If the switching valve arranged between the auxiliary pressure supply and the brake circuits fails or develops a leak, the auxiliary pressure supply can be hydraulically isolated from both hydraulic circuits by means of the at least one circuit isolation valve, whereby further fail safety is realized. In this case, it is for example still possible, by means of a pressure supply device, for a pressure build-up and/or a pressure reduction to be performed in the respectively assigned hydraulic circuit, wherein the pressure reduction may also be performed via an outlet valve.

If a mere leak is present in the switching valve described above, this can, in emergency operation for the pressure build-up, be opened such that a pressure build-up in at least one hydraulic circuit can be achieved by means of the auxiliary pressure supply, wherein said switching valve should be closed during the pressure reduction.

In the case of a low leakage rate of this switching valve, it is advantageously furthermore possible in emergency operation for a brake pressure at which the vehicle wheels do not lock, and thus steerability is maintained, to be set by closed-loop control and held by means of the switching valves, in particular for a period of more than 200 ms.

Furthermore, in the event of failure of a pressure supply device and/or in the event of failure of the infeed valve, a pressure reduction in a hydraulic component can be performed via an opened outlet valve and/or via the opened switching valve.

As described above, it is thus possible with the hydraulic system according to the invention, even if one or two faults of components of the hydraulic system occur, for closed-loop pressure control, for example in the case of use as a brake system for an ABS function, to furthermore be performed in at least one hydraulic circuit, and the at least one hydraulic component thereof, by means of at least one pressure supply device alone or in cooperation with the at least one outlet valve and/or the switching valve. The hydraulic system according to the invention thus advantageously has a high level of fail safety.

If the hydraulic system according to the invention is used as a two-circuit brake system, it forms a system in which safety in the event of individual faults, and the possibility of diagnosis, exist even in a first possible embodiment with only one circuit isolation valve and only one pressure supply device, which will hereinafter also be referred to as safety level 1. For example, the failure of a wheel cylinder can be diagnosed by closure of the respectively assigned switching valve and measurement of the pressure in the respective brake circuit. If no pressure drop occurs, the wheel cylinder that has just been tested is functioning correctly, and the next wheel cylinder can be diagnosed or checked using the same procedure. At the same time, the pressure supply in the other brake circuit can be used to check the wheel cylinder thereof, wherein it is likewise possible a pressure measurement or else with an unchanged drive current to check whether the piston of the pump of the pressure supply device is displaced when the switching valves are closed. In the 1st safety level, approximately 75% of the braking action still remains even in the event of failure of one wheel brake. This 75% is available until a very unlikely double fault occurs, which statistically occurs only once in 100 million vehicles per year. In the event of a double fault, one brake circuit then remains available, with approximately 50% braking action.

In a second possible embodiment, two series-connected circuit isolation valves and only one pressure supply device are provided, which can also be referred to as 2nd safety level. This second circuit isolation valve increases the functional reliability of the overall system significantly because, even in the event of failure of a circuit isolation valve and for example a switching valve assigned to the respective wheel brake—whereby a double fault is present—this leads not to the failure of the entire brake system, only to the failure of one brake circuit. In the 2nd safety level, it is for example the case that the failure of the second brake circuit is prevented by means of the auxiliary pressure supply.

In a further possible third embodiment, which is a further development of the second embodiment and which can also be referred to as 3rd safety level, an additional isolation valve is arranged in the first brake circuit, such that the brake system still provides sufficient options for braking the vehicle even in the presence of a double fault.

With the abovementioned embodiments and their refinements, a wide variety of closed-loop control functions can be implemented for the pressure change (P_build-up and P_reduction) for a wheel cylinder. In ABS systems which are conventional nowadays, the ABS function has for around 50 years been implemented in a known manner by means of inlet and outlet valves for each wheel brake. In the brake system according to the invention, however, the pressure reduction in a wheel brake can also be controlled in open-loop or closed-loop fashion by means of the switching valve assigned to the wheel brake and one outlet valve, which is utilized for two or four wheel brakes. Here, either the switching valve assigned to the wheel brake or the outlet valve may be controlled by means of a pulse-width-modulated signal (PWM control). If the pressure is also measured at the same time, closed-loop control may also be performed here. Instead of only a single outlet valve for all wheel brakes, it is also possible for two outlet valves to be provided, such that, in normal operation, each outlet valve is assigned to exactly two wheel brakes and, in the event of a fault, there is also the possibility of the pressure reduction being performed by means of one of the outlet valves for all or only some of the wheel brakes. In this way, a further redundancy for the ABS function of the brake system also realized. Also, in a further, 4th safety level, a third brake circuit may be provided, in which a further circuit isolation valve is provided for dividing the one brake circuit into two brake circuits. This further increases the fail safety, and a braking deceleration of greater than 75% of the maximum braking deceleration with a fully intact brake system can still be achieved even in the event of failure of a wheel brake.

The possible embodiments described above can be configured with one pressure supply device together with an auxiliary pressure supply or else with two pressure supply devices and one auxiliary pressure supply. It is likewise possible that only two pressure supply devices and no auxiliary pressure supply are provided. As already stated above, the pressure supply device may have a pump in the form of a plunger pump with a spindle drive. It is however likewise also possible to use rotary pumps, such as gear pumps or rotary piston pumps. The latter may require additional check valves or solenoid valves at the pump outlet.

The various embodiments of the brake system according to the invention described above advantageously satisfy the various safety levels from 2 to 5 according to VDA or SAE or corresponding to the definitions listed above and are of modular design for development and manufacture. The outlay required for the safety of the safety gate (SIG) is considerably lower than in the benchmark, to which the new closed-loop control technology of the ABS function also contributes. It advantageously has increased fail safety with simultaneously low costs.

Possible embodiments of the hydraulic system according to the invention will be discussed in more detail below on the basis of brake systems:

In the drawings:

FIG. 1 shows a hydraulic system with two hydraulic circuits K1 and K2 and four wheel brakes and one pressure supply device and one auxiliary pressure supply and one pressure transducer, wherein the two hydraulic circuits can be selectively connected to or isolated from one another by means of a circuit isolation valve;

FIG. 2 shows the hydraulic system as per FIG. 1 with a safety gate with two series-connected circuit isolation valves;

FIG. 3 shows the hydraulic system as per FIG. 2 with an additional isolation valve in the first hydraulic circuit;

FIG. 4 shows a hydraulic system with rotary pump;

FIG. 5 shows the hydraulic system with two pressure supply devices and one auxiliary pressure supply with a safety gate with two series-connected circuit isolation valves;

FIG. 6 shows the hydraulic system according to the 4th safety level with two pressure supply devices and one auxiliary pressure supply with a safety gate with two series-connected circuit isolation valves for the selective connection of the first and the second hydraulic circuit, wherein the second hydraulic circuit can be connected to or isolated from a third hydraulic circuit by means of a further circuit isolation valve.

FIG. 1 shows brake system of safety level 1. The individual components can be combined to form modules. The brake system has two hydraulic circuits K1 and K2 to which a supply is provided by a pressure supply device DV which is connected to the first hydraulic circuit K1 via the infeed valve PD1. The infeed valve PD1 is preferably a valve which is closed when electrically deenergized, such that, in the event of failure of the pressure supply device DV, no failure of the first hydraulic circuit K1 occurs. If the pressure supply device DV performs a pressure change in the form of a pressure build-up P_build-up or pressure reduction P_reduction, the infeed valve PD1 is open. As illustrated, the pressure supply device may have a plunger pump with a spindle drive, which is preferably driven by means of an EC motor. The electrical connection 12 may also be of redundant configuration with a 2×3 phase connection. Instead of the pump with a plunger piston, use may also be made of a rotary pump with a toothed gear or of a piston pump, see for example FIG. 4, wherein, then, instead of the infeed valve PD1, use is for example made of a check valve to prevent an undesired backflow of hydraulic medium out of the brake circuit into the rotary pump.

The plunger pump can preferably be used for the pressure build-up P_build-up and the pressure reduction P_reduction, wherein this then, using a pressure-volume characteristic curve, displaces a corresponding volume of hydraulic medium in order to achieve the desired pressure change. Here, the volume is proportional to the adjustment travel of the plunger piston. Optionally, a breather hole may be provided, which is arranged such that it is opened up by the plunger piston only in the initial position of said piston, such that a pressure reduction P_reduction is possible by dissipation via the working chamber of the plunger pump to a reservoir VB, which has great advantages.

The plunger pump solution is relatively complex in relation to the use of a rotary pump or rotary piston pump, because additional valves must be provided for the pressure reduction P_reduction and the shut-off of the return line to the reservoir VB. The volume of the pressure supply device DV passes directly into the first hydraulic circuit K1 and via the circuit isolation valve BP1 into the second hydraulic circuit K2. The wheel brake cylinders or wheel brakes RZ1-RZ4 are each connected by means of respectively assigned switching valves SV to the respective hydraulic circuit K1, K2. In any hydraulic system, any number of actuating cylinders may be arranged in place of the wheel cylinders RZ 1-4.

The valves SV have the following functions:

1. Identification of a Wheel Brake Cylinder Fault

If a failure is present at a wheel brake cylinder RZ1-4, this is identified by way of the additional volume intake/delivery of the pressure supply device DV in relation to the so-called p-v characteristic curve, which is read in as a vehicle characteristic curve during the end of line inspection or is measured at intervals in the vehicle. This method is known per se. In conventional brake systems, however, this fault can be localized only with difficulty.

If the above-mentioned deviation is identified in the hydraulic system according to the invention, the following method is started in order to localize the fault. Firstly, the circuit isolation valve BP1 is closed and the pressure or pressure progression in the second hydraulic circuit K2 is measured. A check of the wheel brake cylinders RZ3 and RZ4 is thus performed. If the pressure changes over time, the switching valve SV3 of the wheel brake cylinder RZ3, for example, is closed next. If the pressure now remains constant in the second hydraulic circuit K2, the failure lies in the wheel brake cylinder RZ3. If the pressure does not change, the circuit isolation valve BP1 is opened and the switching valves SV3 and SV4 of the two wheel brake cylinders RZ3 and RZ4 are closed. The switching valve SV1 of the wheel brake cylinder RZ1 is also closed. If the pressure measured by means of the pressure transducer DG now remains constant, then a failure of the wheel brake cylinder RZ1 is present. To shorten the time of the diagnostic process described above, the hydraulic circuits K1 and K2 may also be checked at the same time, wherein, then, the above-described method is performed by means of the pressure transducer in the second hydraulic circuit K2 with the circuit isolation valve BP1 closed. At the same time, the pressure can be measured in the first hydraulic circuit K1 by means of the pressure supply device DV. If the piston of the pump moves in the presence of a constant current when only one switching valve SV1 or SV2 is open, this means that the wheel brake cylinder RZ1 or RZ2 respectively is leaking.

2. Use for the ABS Function

The second function consists in the use of the ABS function for the 1st safety level during pressure build-up P_build-up. If the closed-loop controller reports that a wheel is for example delivering the criterion of excessive pressure, the pressure build-up P_build-up can be stopped for the purposes of observation of the wheel. If the closed-loop controller now sends the signal “excessive braking torque/pressure”, the pressure reduction P_reduction is performed. In this case, the outlet valve ZAV is opened and the associated switching valve SV is preferably controlled with a pulse-width-modulated signal (PWM), whereby the rate of the pressure reduction P_reduction can be controlled. The closed-loop controller stops the pressure reduction P_reduction by closing the outlet valve ZAV again. It is self-evidently also possible that the pressure reduction is also performed in two, three or four wheel brake cylinders RZ at the same time, wherein the respective switching valves are then controlled in pulse-width-modulated fashion such that the pressure reduction can be controlled individually for each wheel brake cylinder. As an alternative to the pulse width control of the switching valves, the pressure reduction P_reduction may also be performed in a temporally offset or temporally overlapping manner in multiple wheel brake cylinders by virtue of the switching valves being switched in an overlapping manner, taking into consideration the switching times, wherein, for example, one switching valve SV_i closes and the other switching valve SV_j is already activated.

The pressure reduction P_reduction may also be performed in the first hydraulic circuit K1 via the outlet valve ZAV. Likewise, the pressure reduction P_reduction may be performed by means of the pressure supply device DV, which may likewise act as a pressure sink.

3. Use in Normal Operation

The switching valves SV1-4 may also be used for the pressure reduction in normal operation. There are three possible uses here:

• a. The pressure reduction P_reduction is performed via all four switching valves SV1-4 with a brief stoppage, for example in accordance with Δt or Δp, for pressure equalization in the hydraulic circuits K1 and K2, because the switching valves SV1-4 are subject to tolerances.
• b. The pressure reduction is performed via the outlet valve ZAV with the switching valve SV and outlet valve ZAV permanently open, wherein at least one of the circuit isolation valves BP1, BP2 is controlled with a pulse-width-modulated signal. Alternatively, it is possible that the switching valves or the outlet valve is/are controlled by means of a pulse-width-modulated signal, wherein the other valves in the hydraulic connection to the reservoir are then permanently open during the pressure reduction.
• c. The pressure reduction P_reduction is performed by means of the switching valve FV and the auxiliary pressure supply HDV, which corresponds to the single master brake cylinder SHZ, wherein, in this case, too, the switching valve SV1-4 may be controlled by means of PWM in order to control the pressure reduction rate.

The system has the auxiliary pressure supply HDV, which supplies a relatively low pressure to one or both hydraulic circuits in emergency operation. This may for example be a master brake cylinder HZ, which is connectable directly to the second hydraulic circuit K2 via the valve FV, which is open when electrically deenergized, and to the first hydraulic circuit K1 via the circuit isolation valve BP1.

The pressure build-up P_build-up and the pressure reduction P_reduction are performed here in normal operation without a closed-loop control function in the wheel brake cylinders RZ 1-4 by means of the pressure supply device DV. The pressure reduction P_reduction may optionally also be performed by dissipation via the above-described breather hole of the pressure supply device DV to the reservoir VB. In ABS operation, the pressure reduction is performed either via the outlet valve ZAV or by means of the pressure supply device DV as a pressure sink, wherein it is also possible for the pressure reduction gradient or the pressure reduction to be controlled in open-loop and/or closed-loop fashion by means of a pulse-width-modulated control signal of a switching valve. In the event of failure of the pressure supply device DV and/or of the infeed valve PD1, the pressure reduction P_reduction can be performed via the outlet valve ZAV or, with the switching valve FV open, also into the auxiliary pressure supply HDV. The pressure P in the hydraulic circuits K1 and K2 is measured by means of the pressure transducer DG when the valve BP1 is open. During the pressure build-up P_build-up and during the pressure reduction P_reduction, the correlation of pressure P to motor current I is measured, such that acceptable control is still possible in the event of failure of the pressure transducer DG. With the circuit isolation valve BP1 closed, closed-loop pressure control for the hydraulic circuit K1 may also be performed without measurement of the pressure by means of the pressure transducer DG, which now only measures the pressure in the second hydraulic circuit K2.

The hydraulic system illustrated in FIG. 2 differs from the hydraulic system according to FIG. 1 in that two circuit isolation valves BP1 and BP2 connected or arranged in series are now provided, whereby the 2nd safety level is formed. In the event of a double fault of, for example, the wheel brake cylinder RZ3 or RZ4 and the switching valves SV3 and SV4, the circuit isolation valve BP2 is closed, after which the double faults no longer have any effect on the auxiliary pressure supply HDV or on the first hydraulic circuit K1. BP1 additionally acts here. The first hydraulic circuit K1 is therefore safe with respect to double faults.

The second circuit isolation valve BP2 offers additional safety in the event of failure of the valve FV, wherein a failure may be present for example owing to a leak or a fault in the electrical connection. In the event of this fault, the two circuit isolation valves BP1 and BP2 are closed, whereby the travel simulator function of the travel simulator WS is advantageously maintained. In this case, braking operation is performed by means of the pressure supply device DV in the first hydraulic circuit K1 with approximately 50% braking action in the case of a diagonal brake circuit distribution. In the event of an emergency braking operation with a higher braking action desired by the driver, the circuit isolation valve BP2 may optionally be opened, in which case an additional pressure can then be generated in the second hydraulic circuit or brake circuit K2 by way of the foot-imparted force, which can increase the braking action by over 75%. In this case, the change in the pedal characteristic in relation to the travel simulator is also no longer great. However, in the event of failure of the valve FV, no ABS function is possible. In this case, the wheels can lock, in particular in the presence of a low coefficient of friction. However, if the valve FV only has a low leakage rate, the ABS function is still possible by virtue of the valve FV being closed and the pressure reduction P_reduction being performed via the respective switching valve SV and the outlet valve ZAV. In this case, the valve FV remains closed. For the pressure build-up P_build-up, a smaller pressure difference is selected in relation to the pressure reduction P_reduction in order to prevent renewed locking of the vehicle wheels. Both switching valves SV remain closed for the rest of the braking operation. Thus, in this special case, steerability is maintained.

For the abovementioned fault situations, a diagonal brake circuit distribution is more favorable owing to the greater braking action of 50% in relation to the front axle/rear axle brake circuit distribution. Here, in the event of failure of the front axle VA, only approximately 30% is available with the rear axle HA. In the case of the circuit with so-called emergency braking, approximately 50% applies independently of the VA/HA brake circuit distribution, and 75% applies in the case of the diagonal brake circuit distribution.

The use of a multi-piston and gear pump further reduces the probability of failure.

FIG. 3 shows an additional isolation valve TV in the first hydraulic circuit K1, whereby even double faults of wheel brake cylinders RZ 1/2 and switching valves SV 1/2 do not lead to failure of the hydraulic system, whereby the 3rd safety level 3, which also corresponds to level 3, is attained.

FIG. 4 shows an embodiment of the hydraulic system according to the invention which corresponds to that illustrated in FIG. 2, wherein the pressure supply device DV is designed as a piston pump or rotary pump, which cannot deliver any volume in the return line for the purposes of the pressure reduction P_reduction. Therefore, a second outlet valve ZAV1 is provided here for the first hydraulic circuit K1, which second outlet valve acts redundantly for the pressure reduction P_reduction and the ABS closed-loop control. The check valve RV2 prevents the unwanted backflow of hydraulic medium and also acts redundantly in relation to the at least one outlet valve of the pump. The check valve may also be a constituent part of the rotary pump, such that there is no need for an additional check valve RV2 to be arranged in the hydraulic line connected to the pump.

The embodiment illustrated in FIG. 5 corresponds substantially to the embodiment illustrated in FIG. 3, but has two pressure supply devices DV1 and DV2, wherein the pressure supply devices DV1, DV2 may also both operate as rotary pumps or piston pumps, which is why the second outlet valve ZAV2 must then be provided. Instead of a switchable infeed valve, a check valve RV2 is arranged between the second pressure supply device DV2 and the second hydraulic circuit K2. A second check valve RV2red connected in series with the check valve RV2 increases safety, such that this brake system is also usable for level 3 or level 4 vehicles. The pressure reduction P_reduction for the hydraulic components of the second hydraulic circuit K2 is performed here via the outlet valve ZAV1.

The hydraulic system illustrated in FIG. 6 corresponds in turn to the hydraulic system illustrated in FIG. 5, but has an additional circuit isolation valve BP3 for a third hydraulic circuit K2a. The wheel brake cylinders RZ3 and RZ4 are assigned to the front axle. Thus, in the event of failure of one wheel brake cylinder RZ and of one switching valve SV, a three-circuit system with 75% braking action would still be available in the case of the double fault of wheel brake cylinder RZ and switching valve SV, whereby the brake system is suitable for a level 4 or level 5 vehicle.

The open-loop and closed-loop control unit ECU is connected in the conventional manner directly to the hydraulic control unit HCU, which includes all hydraulic functions such as valves and pressure supply device(s) DV, DV1, DV2. This means that all electrical connections to the sensors, for example pressure transducer DG, solenoid valves and motor 12, can be easily implemented.

LIST OF REFERENCE DESIGNATIONS

• ECU Electrical control unit
• RV1 Check valve 1
• RV2 Check valve 2
• RV2 red. Check valve 2 redundant
• RF Resetting spring
• RZ 1-4 Wheel cylinders
• SV 1-4 Switching valves
• DV Electromotive pressure provision unit
• HDV Auxiliary pressure supply
• HL 1-3 Hydraulic line connections
• VB Reservoir
• ZAV1/2 Central outlet valve
• BP1/2 Circuit isolation valve
• FV Infeed valve from master brake cylinder SHZ into brake circuit BK
• SV 1-4 Switching valve to wheel cylinder RZ
• DG Pressure transducer p=f (v)
• PP1 Infeed valve
• TV Isolation valve
• 10 Redundant electrical connection, possibly with redundant coil
• 11 Redundant connection to motor for 2×3 phase winding
• 12 Redundant connection for 2×3 phase motor
• 13 Electrical plug connector for on-board electrical system connection
• 17 Magnet coils
• 18 Ball valve

Claims

1. A hydraulic system, comprising the following:

at least two hydraulic circuits with hydraulic circuit lines,

at least one hydraulic component per respective hydraulic circuit, wherein each hydraulic component is connectable via a respectively assigned switching valve to the respective hydraulic circuit or to the hydraulic circuit line of the respective hydraulic circuit, wherein pressure build-up and pressure reduction in a respective hydraulic component are performed via the respectively assigned switching valve,

at least one pressure supply device, wherein a pressure build-up in both hydraulic circuits is enabled by means of at least one pressure supply device,

at least one circuit isolation valve, which serves for selectively shutting off or opening up a hydraulic connecting line that connects the two hydraulic circuits,

at least one outlet valve by means of which a reservoir is connectable to at least one hydraulic circuit for pressure reduction directly or via a circuit isolation valve, and

a hydraulic connection of a pump of the pressure supply device to the respective hydraulic circuit, wherein either a controlled infeed valve is provided for selectively shutting off and opening up the hydraulic connection, or a check valve is provided for preventing a return flow from the respective hydraulic circuit via the hydraulic connection into the pressure supply device or the pump of the pressure supply device,

wherein pressure reduction in at least one hydraulic component is performed either by means of the at least one pressure supply device or via an outlet valve in a manner dependent on a state of the hydraulic system and/or on closed-loop pressure control.

2.-28. (canceled)