Safety-critical system, in particular electromechanical parking brake system for a motor vehicle, and method for operating such a system

Abstract

Safety-critical system, in particular an electromechanical parking brake system for a motor vehicle, with a device (V) for electrically actuating the safety-critical system and with an electronic control unit (ECU), wherein the device (V) has at least two connections (A1, A4; A2, A3), at least one switch (S1, S2; S3, S4) and an operating element (B) by means of which at least two operating states for the system can be selected, by means of which switch positions of the at least one switch (S1, S2; S3, S4) are determined, wherein at least one current direction element (D1, D2; D3, D4) is provided, so that for at least one of the at least two operating states, a unidirectional current flow occurs between the at least two connections (A1, A4; A2, A3), wherein the unidirectional current flow between the at least two connections (A1, A4; A2, A3) for one operating state in the direction from the first to the second connection (A1, A4;A2, A3) and for a further operating state in the opposite direction from the second to the first connection (A4, A1; A3, A2), characterized in that the at least two connections (A1, A4; A2, A3) of the device (V) are electrically connected to the electronic control unit (ECU), wherein each of the connections (A1, A4; A2, A3) is assigned an input circuit (ES1, ES4; ES2, ES3) which is designed to set a predetermined potential for the connection (A1, A4; A2, A3) assigned to it.

Description

[0001] The invention relates to a safety-critical system, in particular an electromechanical parking brake system for a motor vehicle, comprising a device for electrically actuating the safety-critical system and comprising an electronic control unit, wherein the device has at least two connections, at least one switch, and an operating element by means of which at least two operating states for the system can be selected and are determined by the switching positions of the at least one switch, wherein at least one current direction element is provided so that a unidirectional current flow occurs between the at least two connections for at least one of the at least two operating states. The unidirectional current flow between the at least two connections can occur in the direction from the first to the second connection for one operating state and in the opposite direction from the second to the first connection for a further operating state.Or the unidirectional current flow between the at least two terminals can occur in the direction from the first to the second terminal or vice versa for one operating state and a bidirectional or no current flow can occur between the at least two terminals for a further operating state.

[0002] A switching device for an electric parking brake is known from EP 1 447 830 A1. For secure wired coding of three different switching states, this device has two stages of coupled switches, via which six connecting lines can be switched into three different connection patterns. The connection patterns assigned to the various actions or states differ in all connection pairs of the connecting lines, so that each connection pattern can be identified based on a correct connection pair.

[0003] Furthermore, such a device is known from DE 199 62 556 A1. In this device, too, the electrical connection is made via six switching lines, via which three different switching states can be queried. However, compared to the device known from EP 1 447 830 A1, this device additionally features a circuit with current direction elements, resulting in a unidirectional current flow between the terminals for each switching state.

[0004] A disadvantage is that the manufacture and use of the known devices require a high level of technical and thus economic effort. This is primarily because, firstly, a total of six switches must be coupled and actuated to switch the three different connection patterns; secondly, a total of six electrical connections must be provided and a total of six electrical cables laid to connect to an electronic control unit; and thirdly, a correspondingly high level of circuitry and software effort is required to reliably query the connection patterns for the electronic control unit due to the total of six electrical connections.

[0005] Such a device is also known in the prior art from US Pat. No. 5,473,203 A. This device comprises a switch unit connected to an alternating current source via two input terminals and comprising two push buttons, each of which is assigned a diode, so that output signals corresponding to the switching positions / combinations of the two push buttons are provided at two output terminals. This can result in four different output signals: a zero signal, a positive half-wave signal, an alternating full-wave signal, and a negative half-wave signal. These analog output signals are provided to an evaluation unit for discrimination or differentiation, which generates discrete signals corresponding to the operating states of the switch unit.

[0006] Therefore, the invention is based on the object of further developing a safety-critical system as described above, which is improved with regard to the aforementioned disadvantages and has a high level of redundancy and fault tolerance.

[0007] For this purpose, it is provided that the at least two terminals of the device are electrically connected to the electronic control unit, each of the terminals being assigned an input circuit which is designed to set a predetermined potential for the terminal assigned to it.

[0008] The invention is characterized by the advantage that the operating states selected by means of the control element can be safely and reliably determined or recognized based on different potentials that arise at the connections (e.g. either "low" or "high"). The effort and susceptibility to errors that arise when using the switching device known from US 5,473,203 A by providing an analog input signal and the subsequent discrimination or differentiation of the resulting analog output signals are eliminated. This is because the at least one current direction element causes a unidirectional current flow between the at least two connections for at least one operating state, as a result of which different potentials arise at the at least two connections for each operating state.

[0009] The electronic control unit can therefore control or regulate the system in accordance with the operating state selected on the control element.

[0010] Furthermore, it can be provided that an evaluation circuit is superordinate to the input circuits, which evaluation circuit provides control signals for the input circuits, by means of which the predetermined potential is set at the associated terminals.

[0011] Advantageously, the at least one switch has at least two switching positions, with either a unidirectional or a bidirectional current flowing between the at least two terminals in each switching position. This ensures that only defined potentials can be established at the at least two terminals, which are thus predetermined so that they can be precisely determined or detected.

[0012] Furthermore, at least two switches can advantageously be connected in series. Thought experiment: Assuming two switches, each with two switching positions, are connected in series, and two current direction elements are provided, one bidirectional current flow and two opposing unidirectional current flows can occur between two terminals, which already precisely distinguishes three operating states.

[0013] If, to further increase system reliability, at least one switch is designed to be at least simply redundant, the result—continuing the previous thought experiment—is a system according to the invention that is redundantly constructed, comprises four connections, four switches, and four current-directing elements, and can distinguish between three operating states. This particularly highlights the significant advantage over the use of the switching devices known from EP 1 447 830 A1 and DE 199 62 556 A1.

[0014] Furthermore, the invention relates to a method for operating a safety-critical system according to the invention, in particular an electromechanical parking brake system for a motor vehicle. A predetermined potential is set cyclically at the terminals.

[0015] For this purpose, the evaluation circuit can be designed to output a predetermined pattern of control signals per cycle.

[0016] Furthermore, it can be provided that the evaluation circuit evaluates the signals emitted at the terminals on the basis of the predetermined pattern of control signals in the same cycle.

[0017] It can also be provided that when all cycles to be completed to determine an operating state have been processed, their joint evaluation takes place in order to recognize the operating state selected on the control element.

[0018] The evaluation of the potentials resulting at the connections is carried out to determine whether there is a match with the operating state selected on the control element in order to be able to carry out error detection, error evaluation and error monitoring if necessary.

[0019] The invention is explained in more detail below with reference to the drawings. They show: Fig. 1a to 1d show a first embodiment of a device according to the invention, Fig. 2 schematically shows a safety-critical system with a device according to the invention according to Fig. 1a to 1d, Fig. 3 schematically shows the structure of an evaluation circuit for a safety-critical system according to Fig. 2, Fig. 4a to 4c Evaluation tables for operating states of a safety-critical system according to Fig. 2, Fig. 5a to 5d show a second embodiment of a device according to the invention, Fig. 6a to 6d show a third embodiment of a device according to the invention.

[0020] For a first embodiment of a device V according to the invention for electrically actuating a safety-critical system according to Fig. 1a, two terminals A1 and A4 are initially considered. For electrically connecting terminals A1 and A4, two switches S1 and S2 are provided in series, each with two switching positions. To determine the switching positions of the two switches S1 and S2, the two switches S1 and S2 are operatively coupled to a control element B, which allows the following three operating states to be selected for the system: (i.) For a first operating state, the two switches S1 and S2 are located as in Fig. 1a, in its upper switching position, so that an electrical connection is established via a current direction element D1 (e.g. diode) which allows a unidirectional current flow only in the direction from terminal A1 to terminal A4 and blocks a current flow in the direction from terminal A4 to terminal A1. (ii.) For a second operating state, the switch S2 is in its lower switching position, so that regardless of the switching position in which the switch S1 is located, an electrical connection exists via a current direction element D2 (e.g. diode) which allows a unidirectional current flow only in the direction from terminal A4 to terminal A1 and blocks a current flow in the direction from terminal A1 to terminal A4. (iii.) For a third operating state, switch S2 is in its upper switching position and switch S1 is in its lower switching position, so that there is a direct electrical connection between terminals A1 and A4, which allows a bidirectional current flow, i.e. both in the direction from terminal A4 to terminal A1 and in the direction from terminal A1 to terminal A4.

[0021] Furthermore, the device V according to the invention has Fig. 1a has two terminals A2 and A3, for the electrical connection of which two switches S3 and S4 and two current-directing elements D3 and D4 (e.g. diodes) are provided. The components S3, S4 and D3, D4 connected between the terminals A2 and A3 are not only identical to the components S1, S2 and D1, D2 connected between the terminals A1 and A4, but are also connected in the same way as shown in Fig. 1a. The switches S3 and S4 are also operatively coupled to the control element B in such a way that the switch S3 is connected in parallel with the switch S1 and the switch S4 is connected in parallel with the switch S2.

[0022] Overall, the device V according to the invention is characterized by Fig. 1a is characterized by a simple redundant structure, through which three different operating states for a safety-critical system can be selected via only four connections A1, A2, A3 and A4.

[0023] Fig. 1b to 1d each show an equivalent circuit diagram for the three operating states that are suitable for the device according to the invention according to Fig. 1a are eligible, namely: (i.) Fig. Figure 1b shows the first operating state, referred to as “neutral”, which only allows a unidirectional current flow via the current direction elements D1 and D3 in the direction from terminal A1 to terminal A4 or from terminal A2 to terminal A3. (ii.) Fig. Figure 1c shows the second operating state, designated “Apply”, which only allows a unidirectional current flow via the current direction elements D2 and D4 in the direction from terminal A4 to terminal A1 or from terminal A3 to terminal A2. (iii.) Fig. Figure 1d shows the third operating state, called “Release,” which allows bidirectional current flow between terminals A1 and A4 and terminals A2 and A3, respectively.

[0024] A safety-critical system for a possible application of the device V according to the invention is an electromechanical parking brake (EPB) system for a motor vehicle. Since a driver operates the EPB using an electrical switching device rather than a mechanical handbrake lever, it is essential to continuously monitor not only the switching device itself but, above all, the electrical lines leading from its terminals for faults such as open circuits or short circuits.

[0025] For an EPB, for example, a toggle switch could be used as control element B, which, for example, under the effect of a spring arrangement, Fig. 1a, which corresponds to the first operating state, "Neutral." If control element B is operated from its basic position on its left side, this corresponds to the second operating state, "Apply," which can, for example, mean activation of the EPB. If control element B is operated from its basic position on its right side, this corresponds to the third operating state, "Release," which can, for example, mean release of the EPB.

[0026] In Fig. 2 is a safety-critical system with a device V according to the invention according to Fig. 1a to 1d are shown schematically. The four terminals A1, A2, A3 and A4 are electrically connected to an electronic control unit (ECU) via unspecified lines. The ECU evaluates the signals emitted by the device V according to the invention at the terminals A1, A2, A3 and A4 by means of an evaluation circuit AS in order to recognize an operating state selected on the control element B and to control or regulate the system in accordance with the operating state. In addition to the evaluation circuit AS, the system further comprises input circuits ES1, ES2, ES3 and ES4, which are preferably, as shown in Fig. 2, are part of the ECU. The evaluation circuit AS is superordinate to the input circuits ES1, ES2, ES3, and ES4 and provides control signals X1, X2, X3, and X4 for each of them.

[0027] Each of the terminals A1, A2, A3 and A4 is assigned an input circuit ES1, ES2, ES3 and ES4. The input circuits ES1, ES2, ES3 and ES4 each have an identical structure, Fig. 3 shows schematically an input circuit ES... assigned to a terminal A...

[0028] An input circuit ES... is designed to set a predetermined potential, either "Low" or "High", for its assigned terminal A... This is done by means of the control signal X... provided to it by the evaluation circuit AS, which controls an electronic switching element T (e.g. transistor or relay). If the control signal X... has the status "On", the electronic switching element T assumes its closed state, in which terminal A... is connected to "High", i.e. a positive potential, e.g. the supply voltage of the ECU, via a low-ohm resistor element R1; if, on the other hand, the control signal X... has the status "Off", the electronic switching element T assumes its blocked state, in which terminal A... is connected to "Low", i.e. a negative potential or zero, e.g. ground, via a high-ohm resistor element R2.

[0029] A predetermined potential is set at each of the terminals A1, A2, A3, and A4 cyclically. For this purpose, the evaluation circuit AS outputs a predetermined pattern of control signals X1, X2, X3, and X4 per cycle. The evaluation circuit AS then evaluates the signals output at terminals A1, A2, A3, and A4 in the same cycle and stores them before continuing with the next cycle. Once all cycles required to determine an operating state have been completed, they are evaluated together to identify the operating state selected at control element B. A good compromise between high reliability on the one hand and high evaluation speed on the other is achieved by setting the potential "High" at only one of the terminals A1, A2, A3, or A4 per cycle, while the other terminals remain at the potential "Low."In this case, i.e. in the case of a device V according to the invention with four connections A1, A2, A3 and A4, exactly four cycles must be processed to detect the operating state and then evaluated, as can be seen from the evaluation tables according to . Fig. 4a to 4c. In detail: (i.) Fig. Figure 4a shows the evaluation table for detecting the "Neutral" operating state. Four cycles are processed, with only one control signal with the status "On" being output per cycle - here in the order X1, X2, X3, X4. Accordingly, the potential "High" is set at the assigned terminal in each cycle - here in the order A1, A2, A3, A4. In addition, the potential "High" is set at terminal A4 in the first cycle and at terminal A3 in the second cycle. This is because (according to Fig. 1b) in the first cycle, the current direction element D1 blocks a current flow from terminal A4 to terminal A1 and in the second cycle, the current direction element D3 blocks a current flow from terminal A3 to terminal A2. (ii.) Fig. Figure 4b shows the evaluation table for detecting the "Apply" operating state. Four cycles are processed, with only one control signal with the status "On" being output per cycle - here in the order X1, X2, X3, X4. Accordingly, the potential "High" is set at the assigned terminal in each cycle - here in the order A1, A2, A3, A4. In addition, the potential "High" is set at terminal A2 in the third cycle and at terminal A1 in the fourth cycle. This is because (according to Fig. 1c) in the third cycle, the current direction element D4 blocks a current flow from terminal A2 to terminal A3 and in the fourth cycle, the current direction element D2 blocks a current flow from terminal A1 to terminal A4. (iii.) Fig. Figure 4c shows the evaluation table for detecting the "Release" operating state. Four cycles are processed, with only one control signal with the status "On" being output per cycle - here in the sequence X1, X2, X3, X4. Accordingly, the potential "High" is set at the assigned terminal in each cycle - here in the sequence A1, A2, A3, A4. In addition, the potential "High" is set at terminal A4 in the first cycle, at terminal A3 in the second cycle, at terminal A2 in the third cycle, and at terminal A1 in the fourth cycle. This is because (according to Fig. 1d) no current direction element acts between terminals A1 and A4 and terminals A2 and A3.

[0030] If deviations from the "Low" / "High" potentials specified for terminals A1, A2, A3, and A4 in the evaluation tables occur, precise error detection, error evaluation, and error monitoring can be performed within the ECU. Some examples are given using the evaluation table for detecting the "Neutral" operating state according to Fig. 4a considers:

[0031] The error “Connector A1 shorted to ground” is detected if the potential at connections A1 and A4 is “Low” and not “High” in the first cycle; the error “Connector A4 shorted to ground” is detected if the potential at connection A4 is “Low” and not “High” in the fourth cycle; the error “Connector A1 shorted to supply voltage” is detected if the potential at connections A1 and A4 is “High” and not “Low” in the second cycle; the error “Connector A4 shorted to supply voltage” is detected if the potential at connection A4 is “High” and not “Low” in the fourth cycle.

[0032] Depending on the results of the error monitoring, the ECU can initiate suitable measures, such as issuing acoustic and / or visual and / or haptic warnings to the driver in the case of an EPB, transitioning the safety-critical system to a defined safe operating state, and storing the detected errors for diagnostic or workshop purposes. Ideally, the individual circuits in the ECU are not only implemented as hardware, but the ECU also includes microcomputers, as is common today, on which the intended functions can be implemented as software. In addition, the ECU can be provided to communicate with electronic control units of other systems, e.g. in the case of an EPB, with the electronically controlled service brake system of the vehicle.

[0033] Fig. Figure 5a shows a second embodiment of a device V according to the invention, for which three terminals A1, A3, and A4 are initially considered. Two switches S1 and S2, each having two switching positions, are provided for electrically connecting terminals A1 and A4 or A3. To determine the switching positions of the two switches S1 and S2, the two switches S1 and S2 are operatively coupled to a control element B, by which the following three operating states for the system can be selected: (i.) For a first operating state, the two switches S1 and S2 are located as in Fig. 5a, in its upper switching position, so that an electrical connection exists via a current direction element D1, which allows a unidirectional current flow only in the direction from terminal A1 to terminal A4 and blocks a current flow in the direction from terminal A4 to terminal A1. (ii.) For a second operating state, the switch S2 is in its lower switching position, so that, regardless of the switching position in which the switch S1 is located, there is an electrical connection via a current direction element D2 which allows a unidirectional current flow only in the direction from terminal A4 to terminal A1 and blocks a current flow in the direction from terminal A1 to terminal A4. (iii.) For a third operating state, switch S2 is in its upper switching position and switch S1 is in its lower switching position, so that there is a direct electrical connection between terminals A1 and A3, which allows a bidirectional current flow, i.e. both in the direction from terminal A3 to terminal A1 and in the direction from terminal A1 to terminal A3.

[0034] Furthermore, the device V according to the invention has Fig. 5a has a terminal A2, for the electrical connection of which to the terminal A3 or A4 two switches S3 and S4 as well as two current direction elements D3 and D4 are provided, as in Fig. 5a. The switches S3 and S4 are operatively coupled to the control element B in such a way that the switch S3 is connected in parallel with the switch S1 and the switch S4 is connected in parallel with the switch S2. Thus, the device V according to the invention is also characterized according to Fig. 5a is characterized by a simple redundant structure, through which three different operating states for a safety-critical system can be selected via only four connections A1, A2, A3 and A4.

[0035] Fig. 5b to 5d each show an equivalent circuit diagram for the three operating states that are applicable to the device according to the invention according to Fig. 5a are eligible, namely: (i.) Fig. Figure 5b shows the first operating state, referred to as “neutral”, which only allows a unidirectional current flow via the current direction elements D1 and D3 in the direction from terminal A1 to terminal A4 or from terminal A2 to terminal A3. (ii.) Fig. Figure 5c shows the second operating state, designated “Apply”, which only allows a unidirectional current flow via the current direction elements D2 and D4 in the direction from terminal A4 to terminal A1 or from terminal A3 to terminal A2. (iii.) Fig. Figure 5d shows the third operating state, called “Release,” which allows bidirectional current flow between terminals A1 and A3 and terminals A2 and A4, respectively.

[0036] The difference to the first embodiment according to Fig. 1a to 1d consists in the fact that, for the third operating state, designated "Release," the terminals A1, A2, A3, and A4 are crossed in relation to the other two operating states, such that A1 is connected to A3 and A2 to A4. The coupling thus established between the operating states enables improved error monitoring of the "Release" operating state.

[0037] In Fig. Figure 6a shows a third embodiment of a device V according to the invention, for which two terminals A1 and A4 are initially considered. Two switches S1 and S2, each having two switching positions, are provided for electrically connecting the terminals A1 and A4. To determine the switching positions of the two switches S1 and S2, the two switches S1 and S2 are operatively coupled to a control element B, by means of which the following three operating states for the system can be selected: (i.) For a first operating state, the two switches S1 and S2 are as in Fig. 6a, in its upper switching position, so that an electrical connection exists via a current direction element D1, which allows a unidirectional current flow only in the direction from terminal A4 to terminal A1 and blocks a current flow in the direction from terminal A1 to terminal A4. (ii.) For a second operating state, the switch S2 is in its lower switching position, so that, regardless of the switching position in which the switch S1 is located, there is an electrical connection via a current direction element D2 which allows a unidirectional current flow only in the direction from terminal A1 to terminal A4 and blocks a current flow in the direction from terminal A4 to terminal A1. (iii.) For a third operating state, switch S2 is in its upper switching position and switch S1 is in its lower switching position, so that there is a direct electrical connection between terminals A1 and A4, which allows a bidirectional current flow, i.e. both in the direction from terminal A4 to terminal A1 and in the direction from terminal A1 to terminal A4.

[0038] Furthermore, the device V according to the invention has Fig. 6a has two terminals A2 and A3, for the electrical connection of which two switches S3 and S4 as well as two current direction elements D3 and D4 are provided. The components S3, S4 and D3, D4 connected between the terminals A2 and A3 are not only identical to the components S1, S2 and D1, D2 connected between the terminals A1 and A4, but are also connected in the same way as in Fig. 6a. Switches S3 and S4 are also operatively coupled to control element B in such a way that switch S3 is connected in parallel with switch S1 and switch S4 is connected in parallel with switch S2.

[0039] Overall, the device V according to the invention is characterized by Fig. 6a is characterized by a simple redundant structure, through which three different operating states for a safety-critical system can be selected via only four connections A1, A2, A3 and A4.

[0040] Fig. 6b to 6d each show an equivalent circuit diagram for the three operating states that are applicable to the device according to the invention according to Fig. 6a are eligible, namely: (i.) Fig. Figure 6b shows the first operating state, referred to as “neutral”, which only allows a unidirectional current flow via the current direction elements D1 and D3 in the direction from terminal A4 to terminal A1 or from terminal A2 to terminal A3. (ii.) Fig. Figure 6c shows the second operating state, designated “Apply”, which only allows a unidirectional current flow via the current direction elements D2 and D4 in the direction from terminal A1 to terminal A4 or from terminal A3 to terminal A2. (iii.) Fig. Figure 6d shows the third operating state, called “Release,” which allows bidirectional current flow between terminals A1 and A4 and terminals A2 and A3, respectively.

[0041] The difference to the first embodiment according to Fig. 1a to 1d consists in the fact that the current direction elements D1 and D2 are arranged antiparallel to each other, whereby decoupling is achieved under the operating conditions.

[0042] Finally, it should be noted that it is of course at the discretion of the person skilled in the art to make modifications to the embodiments within the scope of the patent claims, which applies in particular to the number of switches, the number of their switching positions and their redundancy, which results in the number of operating states that can be selected for the system.

Claims

[1] Safety-critical system, in particular an electromechanical parking brake system for a motor vehicle, with a device (V) for electrically actuating the safety-critical system and with an electronic control unit (ECU), wherein the device (V) has at least two connections (A1, A4; A2, A3), at least one switch (S1, S2; S3, S4) and an operating element (B), by means of which at least two operating states for the system can be selected, by means of which switching positions of the at least one switch (S1, S2; S3, S4) are determined, wherein at least one current direction element (D1, D2; D3, D4) is provided, so that for at least one of the at least two operating states a unidirectional current flow takes place between the at least two connections (A1, A4; A2, A3), wherein the unidirectional current flow between the at least two connections (A1, A4; A2, A3) for an operating state in the direction from the first to the second connection (A1, A4;A2, A3) and for a further operating state in the opposite direction from the second to the first connection (A4, A1; A3, A2), ; characterized by that the at least two terminals (A1, A4; A2, A3) of the device (V) are electrically connected to the electronic control unit (ECU), each of the terminals (A1, A4; A2, A3) being assigned an input circuit (ES1, ES4; ES2, ES3) which is designed to set a predetermined potential for the terminal (A1, A4; A2, A3) assigned to it. [2] Safety-critical system, in particular an electromechanical parking brake system for a motor vehicle, with a device (V) for electrically actuating the safety-critical system and with an electronic control unit (ECU), wherein the device (V) has at least two connections (A1, A4; A2, A3), at least one switch (S1, S2; S3, S4) and an operating element (B), by means of which at least two operating states for the system can be selected, by means of which switching positions of the at least one switch (S1, S2; S3, S4) are determined, wherein at least one current direction element (D1, D2; D3, D4) is provided, so that for at least one of the at least two operating states, a unidirectional current flow takes place between the at least two connections (A1, A4; A2, A3), wherein the unidirectional current flow between the at least two connections (A1, A4; A2, A3) for an operating state in the direction from the first to the second connection (A1, A4;A2, A3) or vice versa and for a further operating state a bidirectional or no current flow occurs between the at least two terminals (A1, A4; A2, A3); characterized by that the at least two terminals (A1, A4; A2, A3) of the device (V) are electrically connected to the electronic control unit (ECU), each of the terminals (A1, A4; A2, A3) being assigned an input circuit (ES1, ES4; ES2, ES3) which is designed to set a predetermined potential for the terminal (A1, A4; A2, A3) assigned to it. [3] System according to claim 1 or 2, characterized by that the electronic control unit (ECU) controls or regulates the system in accordance with the operating state selected on the control element (B). [4] System according to one of claims 1 to 3, characterized bythat the at least one switch (S1, S2; S3, S4) has at least two switching positions, wherein in each switching position either a unidirectional or a bidirectional current flow occurs between the at least two terminals (A1, A4; A2, A3). [5] System according to one of claims 1 to 4, characterized by that at least two switches (S1, S2; S3, S4) are connected in series. [6] System according to one of claims 1 to 5, characterized by that the at least one switch (S1, S2; S3, S4) is designed to be at least simply redundant. [7] System according to one of claims 1 to 6, characterized by that the input circuits (ES1, ES2, ES3, ES4) are superordinated to an evaluation circuit (AS), which provides control signals (X1, X2, X3, X4) for the input circuits (ES1, ES2, ES3, ES4), by means of which the predetermined potential is set at the assigned terminals (A1, A2, A3, A4). [8] Method for operating a safety-critical system according to one of claims 1 to 7, characterized by that the setting of a predetermined potential at the terminals (A1, A2, A3, A4) takes place cyclically. [9] Method for operating a safety-critical system according to claim 7, characterized by that the setting of a predetermined potential at the terminals (A1, A2, A3, A4) takes place cyclically, wherein the evaluation circuit (AS) outputs a predetermined pattern of control signals (X1, X2, X3, X4) per cycle. [10] Method according to claim 9, characterized by that the evaluation circuit (AS) evaluates the signals emitted at the terminals (A1, A2, A3, A4) on the basis of the predetermined pattern of control signals (X1, X2, X3, X4) in the same cycle. [11] Method according to claim 10, characterized bythat when all cycles to be completed to determine an operating state have been processed, they are jointly evaluated in order to recognize the operating state selected on the control element (B). [12] Method according to claim 10 or 11, characterized by that the potentials resulting at the terminals (A1, A2, A3, A4) are evaluated to determine whether there is a match with the operating state selected on the control element (B).

Images