Method for operating a braking system with increased safety in the fallback level and braking system with increased safety in the fallback level

Abstract

The invention relates generally to a method for operating a braking system with increased safety in the fallback level and to such a braking system for a motor vehicle. The braking system can, in particular, comprise a braking system that operates without operating fluids. The method for operating the braking system provides for the control of wheel brake modules of the motor vehicle in a normal operating level by a central control electronics unit and the control of the wheel brake modules in a fallback level, wherein the fallback level is designed as a dual-circuit system.

Description

[0001] The invention generally relates to a method for operating a braking system with increased safety in the fallback mode and to such a braking system for a motor vehicle. The braking system can, in particular, comprise a braking system that does not require operating fluids.

[0002] "Brake-by-wire" braking systems are becoming increasingly popular in automotive technology. These systems operate without operating fluids, such as brake fluid.

[0003] Such braking systems may include an electric brake pedal, often referred to as an e-pedal. The wheel brakes may be designed as electromechanical (dry) brakes. The brake pedal is configured to detect a driver's braking request or braking command using a sensor and generate a corresponding actuation signal.

[0004] The detected braking command can be used to determine a target braking torque or target braking pressure for the wheel brakes. The driver's braking command signal can be transmitted to a central control unit, which takes over the electrical control of the wheel brakes.

[0005] With such braking systems, the driver is decoupled from direct access to the wheel brakes, since the control is carried out solely electrically or electronically by means of appropriate control devices.

[0006] A disadvantage of such braking systems is that there is no option to provide the driver with a mechanical and / or hydraulic override that would be activated in the event of a failure of the electronic control device. Such systems are known as "hydraulic fallback systems." On the other hand, it is necessary to be able to switch to a fallback system in the event of a control device failure in order to maintain essential functions of the braking system.

[0007] This can result in the entire control path from pedal actuation to application of the braking force being executed redundantly at least once, so that a single error cannot lead to a failure of the wheel brakes or to the legally prescribed minimum braking effect being undercut.

[0008] In this sense, redundancy means the additional presence of functionally identical or comparable components, parts, or systems, for example, the presence of at least two connections, e.g., data lines, or at least two corresponding control devices. This ensures the continued safe operation of the braking system as a whole in the event of a component, part, or system failure. This does not affect the fact that certain functions, such as additional functions that serve convenience, can be omitted at the redundancy level, and only the basic functions are implemented in the same or comparable manner.

[0009] Therefore, known approaches to architectures of braking systems can have a redundancy level, so that, for example, when a primary control unit (“ECU”) of the primary control functions (“Veh Primary”) is switched off, another control unit or level is available (“Veh Secondary”), which then takes over the control, possibly to a reduced extent.

[0010] However, in such architectures it is necessary that this single fallback path must already be completely error-free.

[0011] What is desirable is a braking system which, on the one hand, meets the applicable safety requirements, including with regard to possible driverless driving, and which, on the other hand, also offers increased safety with regard to the fallback level.

[0012] It would be advantageous if test operation could also be enabled, in which, for example, a primary control device could be switched off in a targeted manner in order to test the functionality in the fallback level.

[0013] The inventors have taken on this task.

[0014] This object is achieved surprisingly simply by a method for operating a braking system, in particular for a motor vehicle, and a correspondingly designed braking system according to one of the independent claims. Preferred embodiments and further developments of the invention can be found in the respective subclaims and the figures.

[0015] The invention therefore comprises, in a first aspect, a method for operating a braking system, in particular for a motor vehicle, with preferably four electrically controllable wheel brake modules, which can be equally assigned to two different axles of the motor vehicle, with the following steps: - Determining actuation information describing a braking request by a brake actuation unit, wherein the braking request can preferably be detected independently of one another by at least one first pedal sensor or FA pedal sensor and a second pedal sensor or RA pedal sensor, - Generation of braking torque requirements RQT_FA*, RQT_RA* corresponding to the actuation information by a central control electronics, - Generation of braking torque requirements RQT_FA corresponding to the actuation information by at least one FA brake control unit which is assigned to the wheel brake modules of a front axle or which is assigned to two diagonally arranged wheel brake modules, - Generation of braking torque requirements RQT_RA corresponding to the actuation information by at least one RA brake control unit which is assigned to the wheel brake modules of a rear axle or which is assigned to the two remaining diagonally arranged wheel brake modules, - Control of the wheel brake modules of the braking system according to a normal operating level with the braking torque request RQT_FA*, RQT_RA*, or - Controlling the wheel brake modules assigned to the FA brake control unit according to a fallback level with the braking torque request RQT_FA, and / or controlling the wheel brake modules assigned to the RA brake control unit according to the fallback level with the braking torque request RQT_RA.

[0016] In a first aspect, the invention thus provides a method for operating a braking system, in particular for a motor vehicle, which comprises a dual-circuit fallback path. The braking system can be designed in particular for or as part of a service brake.

[0017] In a further aspect of the invention, various braking system architectures are proposed, purely by way of example, which have such a dual-circuit fallback path and which are suitable for implementing the aforementioned method for operating a braking system. These braking system architectures will be discussed in more detail below.

[0018] In the sense of the invention, a motor vehicle means a vehicle with axles, wherein at least one of these axles comprises steerable wheels and, in addition, the drive of the wheels of at least one axle can be adjusted to suit the specific wheel.

[0019] The braking system can comprise electromechanical wheel brakes, also referred to as EMB ("EMB" = electromechanical brake), whereby preferably all wheel brakes of the motor vehicle can be designed as electromechanical or electrically controllable wheel brakes. Each wheel brake can be assigned to a wheel brake module.

[0020] The electromechanical wheel brakes can be designed as electromechanical disc brakes, in which an application force can be generated by means of an electric motor, a primary gear, and a rotation / translation gear. The application force refers to the force with which the brake pads are pressed against the brake disc. During operation, this then generates a corresponding braking torque at the wheel in question. Depending on the design and control concept, the control can be selected such that either a predefined, defined application force or a predefined, defined braking torque is set according to the requested deceleration.

[0021] The electromechanical wheel brakes can also be designed as electromechanical drum brakes, in which the motor / transmission unit actuates a spreading module that presses the brake pads against the brake drum with a spreading force determined by the desired deceleration, thus generating a corresponding braking torque. Depending on the design and control concept, the control can be configured to set a defined spreading force or braking torque according to the desired deceleration.

[0022] In the braking system according to the invention, for example, the two brakes assigned to the front axle can be designed as electromechanical disc brakes, and the two brakes assigned to the rear axle can be designed as electromechanical drum brakes. However, all brakes can also be designed as electromechanical disc brakes or as electromechanical drum brakes.

[0023] According to a further development of the invention, it is also possible and envisaged to use the braking system according to the invention together with hydraulically actuated wheel brakes, for example in the fallback level.

[0024] The method according to the invention provides that in addition to a central brake control unit, hereinafter referred to as central control electronics, a fallback level is provided, which can be divided into two parts.

[0025] In the braking system according to the invention, a brake actuation unit can be provided for this purpose, which is configured to detect a driver's braking request and to determine corresponding actuation information which corresponds to the driver's braking requirements.

[0026] According to the invention, the actuation information can be detected independently of one another by at least one first and one second sensor or pedal sensor, hereinafter referred to as FA pedal sensor ("FA" = "front axle") and RA pedal sensor ("RA" = "rear axle"), wherein the pedal sensors can be combined in the brake actuation unit. Preferably, the same braking request is detected independently by both pedal sensors, thus providing complete redundancy in detecting a driver's braking request.

[0027] According to embodiments of the invention, the at least two pedal sensors can be based on the same or different measuring principles. In a preferred embodiment of the invention, both pedal sensors each comprise at least two different measuring principles, for example, a force sensor that detects the force with which the driver presses the pedal and a displacement sensor that measures the distance the driver presses the pedal. The error patterns for these different pedal sensors are different, so that, for example, a jammed pedal can be detected by force being exerted on the pedal without it moving.

[0028] The central control electronics can be configured to generate the braking torque request based on the actuation information using stored control algorithms. The braking torque request can be axle-specific or wheel-specific. Axle-specific braking torque requests are also referred to below as RQT_FA* for the front axle and RQT_RA* for the rear axle. From these braking torque requests, corresponding wheel-specific braking commands RQT_xA* can be generated, which can be used to control and operate wheel brake actuators, for example.

[0029] According to one embodiment of the invention, it is also provided that the central control electronics already generates wheel-individual braking commands RQT_xA*.

[0030] The wheel brakes can be part of the electrically controllable wheel brake module, which can include additional components, such as a wheel-mounted control unit ("WCU"). The braking system can advantageously comprise at least two such wheel brake modules assigned to one axle, with both axles, and particularly preferably all axles, of the motor vehicle each comprising two such wheel brake modules. The wheel brake modules can be designed to be electrically controllable.

[0031] The wheel brake modules can also be configured to control the wheel brakes, for example, the wheel brake actuators, according to the braking torque requirements, for example, by applying the appropriate electrical voltage to the actuators. The conversion of the braking torque requirements into corresponding wheel-specific braking commands, for example, setting the specific voltage, can be performed by the wheel-based control devices.

[0032] However, it is also possible to combine these control devices for the wheel brakes of one axle and provide them as a so-called axle controller. According to a preferred embodiment of the invention, two such axle controllers are provided.

[0033] The division of the fallback level according to the invention can be achieved most advantageously by assigning at least one brake control unit to at least each axle of the motor vehicle equipped with wheel brake modules according to the invention. Accordingly, at least one brake control unit, hereinafter referred to as the FA brake control unit, can be assigned to the front axle, and another brake control unit, hereinafter referred to as the RA brake control unit, can be assigned to the rear axle.

[0034] The FA brake control unit and the RA brake control unit can be configured to generate braking torque requests based on the actuation information of the brake actuation unit, based on stored control algorithms. These braking torque requests, hereinafter referred to as RQT_FA for the front axle and RQT_RA for the rear axle, can therefore also be axle-specific. According to one embodiment of the invention, it is also provided that the brake control units can already generate wheel-specific braking commands RQT_xA.

[0035] The brake actuation unit, in particular the at least two pedal sensors, can be electrically or signal-wise connected to the brake control units, so that actuation information can be transmitted directly to the brake control units. The actuation information can preferably be transmitted as digital signals, whereby appropriate converter modules, e.g., A / D converters, can be provided for data conversion.

[0036] According to a preferred embodiment of the invention, the FA pedal sensor can be connected to the FA brake control unit, and the RA pedal sensor can be connected to the RA brake control unit. The actuation information can thus be detected independently of one another and transmitted independently of one another to the respective brake control units. In this way, redundancy can be ensured with regard to the detection of the braking request.

[0037] The brake control units can also be connected to the central control electronics via signaling. This allows the actuation information from the pedal sensors to be transmitted via the brake control units to the central control electronics.

[0038] According to the invention, at least one central control electronics unit can be provided for the central generation of braking torque requests and at least two brake control units, each assigned to an axle of the motor vehicle, for the independent generation of braking torque requests. In this way, the fallback level can be divided into two parts and distributed between the two axles.

[0039] In the preferred embodiment of the invention described above, the brake control units are assigned to the wheel brake modules of the two different axles of the motor vehicle, i.e. two wheel brake modules of the front axle and two wheel brake modules of the rear axle, so that in the fallback level, the wheel brakes assigned to the two axles can be controlled independently of one another by the brake control units via the two pedal sensors.

[0040] According to a further embodiment of the invention, however, two brake control units can also be provided, each of which can control two wheel brake modules of different axles, and wherein these two wheel brake modules can each be arranged diagonally. Accordingly, the first pedal sensor or the FA pedal sensor can be signal-connected to a first brake control unit or the FA brake control unit, which can be signal-connected to two diagonally opposite wheel brake modules, and the second pedal sensor or the RA pedal sensor can be connected to a second brake control unit or the RA brake control unit, which can be connected to the two remaining opposite wheel brake modules.The FA brake control unit can, for example, be configured to control the two wheel brake modules VL (front left) and HR (rear right), and the second RA brake control unit can be configured to control the two remaining wheel brake modules VR (front right) and HL (rear left). In this way, a dual-circuit fallback path according to the invention can also be implemented.

[0041] The method according to the invention can therefore comprise the following steps: - generating braking torque requests (RQT_FA) corresponding to the actuation information by at least the first brake control unit or the FA brake control unit, which is assigned to two wheel brake modules of a first axle or two wheel brake modules arranged diagonally opposite one another on two different axles, and, - Generation of braking torque requests (RQT_RA) corresponding to the actuation information by at least the second brake control unit or the RA brake control unit, which is assigned to two wheel brake modules of a second axle or the two remaining diagonally arranged wheel brake modules.

[0042] For simplification purposes, the axle-related division with an FA brake control unit as the first and an RA brake control unit as the second brake control unit is explained below, whereby these explanations should also apply to two brake control units in the sense of the invention, in which the assignment and signal connection of the brake control units to the wheel brake modules can be made diagonally as described above.

[0043] This allows the braking system to switch back to two separate, independently operating control paths in the fallback level in the event of a lack of braking torque requests from the central control electronics, for example due to a failure, defect, or even shutdown of the central control electronics. In such a case, the driver's braking request detected at the brake pedal can lead to a braking torque request RQT_FA for the vehicle wheels on the front axle and its implementation at the assigned wheel brake modules. Independently of this, the separately detected braking request can lead to a braking torque request RQT_RA for the vehicle wheels on the rear axle and its implementation at the assigned wheel brake modules.

[0044] The invention therefore offers the advantage that, especially with regard to possible driverless driving, the fallback level offers increased safety, as it creates further redundancy through the division into two parts.

[0045] The essential advantage of the method according to the invention is that in the absence of braking torque requests from the central control electronics, for example as a result of an emergency stop or shutdown, only the higher-order control functions are switched off and the braking system can fall back to a safe two-circuit basic brake with basic function and slip control.

[0046] This can also enable and support test operation, for example, in which the central control electronics can be switched off in a targeted manner in order to test the functionality in the fallback level.

[0047] For the signaling connection between the pedal sensors and the brake control units, the braking system in an advantageous embodiment of the invention can comprise at least one first brake request signal line between the FA pedal sensor and the FA brake control unit and at least one second brake request signal line between the RA pedal sensor and the RA brake control unit. For further increased operational reliability, one or both brake request signal lines can also be duplicated, i.e., redundant.

[0048] Furthermore, at least one data line can be provided between the at least one central control electronics unit and the FA brake control unit, and at least one data line can be provided between the at least one central control electronics unit and the RA brake control unit. For further increased operational reliability, these data lines can also be duplicated, i.e., redundant.

[0049] In summary, the method according to the invention can provide for at least partial control of the wheel brake modules in a normal operating level or in a fallback level.

[0050] A normal operating level refers to a braking system operating mode in which at least the essential components of the braking system operate faultlessly and / or are fully or at least sufficiently functional. In other words, at the normal operating level, the components required for the braking system fulfill their intended functions. The normal operating level is therefore the typically intended or preset operating mode of the braking system. In this mode, higher-level control functions can be implemented by the central control electronics. Therefore, at the normal operating level, not only the basic functions but also additional functions, such as ESP, ESC, or standstill functions, can be provided.

[0051] The fallback level can be selected if the normal operating level is not available without errors or properly, for example, if essential components are not functioning properly. In the fallback level, a minimum braking effect can be achieved, while at least the basic functions of the brake or service brake can continue to be performed. In the invention, the basic function of the brake can also include the anti-skid control (ABS).

[0052] In the normal operating level, the driver's braking command can be redundantly made available to the central control electronics via the pedal sensors and the brake control units. This can arbitrate all control functions to determine the desired braking torque requirements for the wheel brake modules or the wheel brakes and transmit these to the brake control units for activation. In the fallback level, the driver's braking command remains available via two channels to the axle-specific brake control units, each with its own operating mode independent of the other axle. In this fallback level, external communication can advantageously be completely dispensed with. In the fallback level, a basic braking function can be available, as well as optional ABS (skid control) locally for each axle separately.

[0053] For this purpose, the wheel brake module can include additional devices and components, such as wheel speed sensors. These can be connected to the brake control units in a known manner. This can prevent unwanted destabilization.

[0054] According to a preferred embodiment of the invention, the decision logic for the operating mode of the braking system can be integrated into the brake control units, i.e., the FA brake control unit and / or the RA brake control unit. The brake control units can include corresponding control functions or algorithms for this purpose. Starting from the normal operating level as the preferred operating mode of the braking system, the method according to the invention provides for switching to the fallback level if the normal operating level is not available or only available with a limited range of functions.

[0055] The method according to the invention can provide for the wheel brake modules to be activated in the normal operating level if - Braking torque requests RQT_FA* and RQT_RA* exist and actuation information from at least one FA and / or RA pedal sensor is available, and if - there is no error message from the central control electronics, and if - the braking torque requirements RQT_FA* and RQT_RA* do not exceed a predefined distance from the corresponding braking torque requirements RQT_FA and RQT_RA.

[0056] If, during operation of the motor vehicle or the braking system, actuation information describing the braking request is available, i.e. a driver specifies a braking request by pressing the pedal, the braking torque request RQT_FA* and RQT_RA* of the central control electronics is initially used to control the wheel brake modules.

[0057] The brake control units can check whether an error message is present in the central control electronics. An error message can be generated by the central control electronics, for example, if input data is missing or incomplete, or if the stored algorithms detect a lack of plausibility. If an error message is present, the brake control units switch to the fallback level.

[0058] The brake control units can also check whether the braking torque requests RQT_FA* and RQT_RA* of the central control electronics do not deviate, or do not deviate significantly, from the corresponding braking torque requests RQT_FA and RQT_RA generated by the brake control units themselves. In other words, the braking torque requests generated by the central control electronics and the brake control units themselves can be compared.

[0059] If the braking torque requests RQT_FA* and RQT_RA* generated by the central control electronics do not deviate by a predefined value from the braking torque requests RQT_FA and RQT_RA generated by the brake control units themselves, the braking torque requests RQT_FA* and RQT_RA* can be passed on to the respective wheel brakes according to the normal operating level.

[0060] This predefined distance thus represents a threshold. This is a particularly advantageous way to prevent "underbraking" by the central control electronics and to install a so-called "safety barrier" to prevent insufficient braking. The predefined value for the distance, or "safety barrier," can be defined particularly conveniently on a customer-specific basis and stored in the brake control units.

[0061] The threshold can be quite high, for example, 0.5 g / 1 g of braking torque. This means that if the central control electronics fails to receive a braking torque request (RQT_FA* and RQT_RA*), the driver must increase the pressure on the brake pedal of the brake actuation unit by 0.5 g / 1 g of braking torque. This allows a system-specific, higher difference between the values ​​of the braking torque requests (RQT_FA and RQT_RA) and the braking torque requests (RQT_FA* and RQT_RA*) to be stored, which can be used, for example, to enable recuperation.

[0062] Recuperation or regenerative braking via the drive can be specified by the central control electronics, which results in the braking torque requirements RQT_FA* and RQT_RA* being lower than the braking torque requirements RQT_FA and RQT_RA. The higher threshold ensures that the system does not immediately switch to the fallback level, but rather that recuperation can be used until the threshold is reached. In a further development of the invention, a corresponding signal from the central control electronics is also provided, which can indicate recuperative braking to the brake control units. Since this signal can also be subject to errors, the threshold should therefore be set accordingly.

[0063] The method according to the invention can therefore provide for activation of the wheel brake modules in the fallback level if - Actuation information from at least one FA or HA pedal sensor is available, but no brake torque requests RQT_FA* and RQT_RA* exist from the central control electronics, or if - if the actuation information is available from the actuation unit, an error message is issued by the central control electronics, or if - when actuation information is available from the actuation unit, there is no bus signal on the data line, or if - the braking torque requirements RQT_FA* and RQT_RA* exceed a predefined distance from the corresponding braking torque requirements RQT_FA and RQT_R.

[0064] Accordingly, the method according to the invention provides for applying the braking torque requests RQT_FA or RQT_RA from the brake control units to the wheel brakes in the fallback level if actuation information from at least one pedal sensor is available, but no braking torque requests RQT_FA* and RQT_RA* exist from the central control electronics. This can be the case, for example, if the central control electronics is disconnected from the power supply or if the data line between the central control electronics and the brake control unit is not functioning properly.

[0065] The fallback level can also be selected if there is an error message from the central control electronics, or if there is no bus signal on the data line when actuation information is available from the actuation unit.

[0066] Furthermore, the fallback level can also be selected if the braking torque requirements RQT_FA* and RQT_RA* exceed a predefined distance from the corresponding braking torque requirements RQT_FA and RQT_RA. As already explained, this is intended to ensure that "underbraking" does not occur, i.e., if the braking torque requirements specified by the central control electronics deviate from the braking torque requirements of the brake control units by a value that is greater than the predefined value or threshold.

[0067] The method according to the invention may further comprise at least one of the following steps: - Sending the actuation information independently from the FA pedal sensor to the FA brake control unit via the first brake request signal line and / or from the RA pedal sensor to the RA brake control unit via the second brake request signal line, - Transmitting the actuation information independently of each other via the FA and RA brake control units through the data line to the at least one central control electronics, - Sending the braking torque requests RQT_FA* and RQT_RA* independently of each other via the data lines to the FA and RA brake control units.

[0068] Sending actuation information independently from the pedal sensors via physically separate signal and data lines to the assigned brake control units enables maximum safety even at the fallback level. If one of the two control paths fails, the redundantly configured other control path retains the same functions, allowing actuation information to be sent independently to two different axles and their associated brake control units and wheel brakes. This ensures that even if a component fails at the fallback level, the wheel brake modules of at least the unaffected axle of the vehicle remain functional. This allows a prescribed minimum braking effect to be achieved, even if there is a functional impairment at the fallback level.

[0069] According to an advantageous embodiment of the method, the transmission of the actuation information is therefore also provided independently of one another or physically separately via the respective FA and RA brake control unit by data lines to the at least one central control electronics.

[0070] Advantageously, the braking torque requests RQT_FA* and RQT_RA* can also be sent from the central control electronics independently of each other via the data lines to the FA or RA brake control unit.

[0071] The generation of the braking torque requests RQT_FA* and RQT_RA* by the central control electronics can be carried out according to stored central control algorithms, wherein the central control algorithms can preferably comprise at least one anti-skid control or one anti-lock control.

[0072] According to a further preferred embodiment of the invention, a further data bus is provided, which can connect the central control electronics to a higher-level vehicle computer. In this way, additional control parameters can be made available to the central control electronics, which can be used to generate the braking torque requests RQT_FA* and RQT_RA*.

[0073] This makes it possible, for example, to use the method according to the invention for or in conjunction with driverless driving, whereby, for example, braking commands can then be transmitted via the higher-level vehicle computer to the central control electronics and from there to the brake control units. The generation of the braking torque requests RQT_FA* and RQT_RA* can thus be based at least partially on signals transmitted to the central control electronics via the data bus.

[0074] A parking brake button can also be very advantageously integrated into the braking system according to the invention and, for example, connected to the data bus. The method according to the invention thus makes it possible for actuation information from the parking brake button to be taken into account for controlling the wheel brake modules when the central control electronics is controlled via the parking brake button.

[0075] In the fallback operating level, the wheel brakes can be controlled solely by the brake actuation unit without further communication via the data bus.

[0076] The axle-specific braking torque requests RQT_FA, RQT_RA can be generated by the brake control units according to local control algorithms, which can be stored in the brake control units. For cost reasons, the local control algorithms can have a reduced range of functions compared to the central control algorithms of the central control electronics and, for example, only include anti-skid control.

[0077] According to a further development of the invention, it can also be provided to divide the central control electronics into two separate partitions, which can each be assigned to an axle, for example an FA partition and an RA partition, and which can generate the braking torque requirements independently of one another.

[0078] This enables the FA partition to generate the braking torque requests RQT_FA* and send them via the data line to the FA brake control unit, as well as the RA partition to generate the braking torque requests RQT_RA* and send them via the data line to the RA brake control unit. This allows increased safety through redundancy to be provided even at the normal operating level.

[0079] The FA brake control unit and / or the RA brake control unit can each be signal-connected to an FA axle controller or a RA axle controller, or even integrated into them. The axle controllers can be configured to generate wheel-specific braking commands RQT_xA*, RQT_xA from the braking torque requirements and transmit them to the individual wheel brake modules. An axle controller can also be a pure software solution, for example, implemented in the brake control unit.

[0080] According to a further embodiment of the invention, the FA axle controller and / or the RA axle controller can also be designed as a wheel-proximate control unit, i.e., as a so-called WCU (wheel-mounted control unit), so that, for example, two FA wheel controllers and / or two RA wheel controllers are provided, which are directly assigned to the corresponding wheel brake modules. In this case, the associated FA brake control unit and / or the RA brake control unit can also be divided and assigned to each vehicle wheel individually. It goes without saying that in this case, the data lines can be split accordingly.

[0081] As already explained, as an alternative or in addition to the axle-specific braking torque requests RQT_FA*, RQT_RA* or RQT_FA, RQT_RA, corresponding wheel-specific braking commands RQT_xA*, RQT_xA can also be generated and transmitted. This allows the wheel brakes to be controlled directly and individually. It goes without saying that the brake control units can also be configured to compare the braking commands RQT_xA* from the central control electronics with the locally generated braking commands RQT_xA. The decision logic for the comparison can be configured in a similar way to that for the braking torque requests. Instead of the axle-specific braking torque requests, the wheel-specific braking commands RQT_xA* and the corresponding wheel-specific braking commands RQT_xA can also be compared with each other.

[0082] According to one embodiment of the invention, the transmission of a braking request in the form of actuation information from the FA and RA pedal sensors to the central control electronics is carried out solely via the braking request signal line to the FA and RA brake control units, and from there via the additional data line. In other words, at least one pedal sensor, preferably both pedal sensors, are not directly connected to the central control electronics in terms of signaling. This reduces the complexity of assembling the braking system.

[0083] In another embodiment of the invention, it is provided to lead a data line directly from an FA or HA pedal sensor to the central control electronics instead of to the corresponding FA and HA brake control unit.

[0084] According to a further development of the invention, an additional data line can also be provided between the FA and HA brake control units, which enables data exchange between the FA and HA brake control units in the fallback operating level. This enables data communication between the brake control units independently of the data connection to the central control electronics. In this way, it is possible to improve the control of the wheel brakes, since information about the respective other axle

[0085] In a further aspect, the invention comprises a braking system, in particular for a motor vehicle, wherein the braking system is designed to carry out a method as explained above.

[0086] According to one embodiment of an architecture, the braking system may comprise: - four electrically controllable wheel brake modules, each comprising a wheel brake, - at least one brake actuation unit, wherein the brake actuation unit has at least one FA pedal sensor and one HA pedal sensor, each of which is designed to independently detect actuation information of the brake actuation unit describing the braking request, - at least one first FA brake control unit, which is assigned to the wheel brake modules of a front axle, and - at least one second rear axle brake control unit, which is assigned to the wheel brake modules of a rear axle, - wherein the FA pedal sensor is connected at least to the FA brake control unit via at least one first brake request signal line, - wherein the rear axle pedal sensor is connected at least to the rear axle brake control unit via at least one second brake request signal line, and - at least one central control electronics which is connected to the FA brake control unit via at least one data line and to the HA brake control unit via at least one data line.

[0087] According to a preferred embodiment of the invention, at least one of the FA and HA pedal sensors in the braking system, particularly preferably both pedal sensors, are not directly connected to the central control electronics via signaling. This simplifies installation in the motor vehicle.

[0088] According to a preferred embodiment of the invention, the central control electronics can comprise an FA partition and an RA partition, wherein the FA partition can be configured to generate a braking torque request RQT_FA* independently of the RA partition and to send it to the FA brake control unit via a data line, and wherein the RA partition is configured to generate a braking torque request RQT_RA* independently of the FA partition and to send it to the RA brake control unit via the data line.

[0089] The FA brake control unit and / or the RA brake control unit can each be signal-connected to and / or integrated into an FA axle controller or an RA axle controller.

[0090] The central control electronics can be connected to a vehicle computer via at least one data bus.

[0091] According to a further preferred embodiment of the invention, a parking brake button can be provided, which can be connected to the central control electronics via a data line. The central control electronics can be configured to be controlled by the parking brake button.

[0092] According to yet another preferred embodiment of the invention, an additional signal line can be provided between the central control electronics and the FA brake control unit and / or the HA brake control unit. This signal line can also have an emergency stop switch.

[0093] According to yet another preferred embodiment of the invention, the FA brake control unit and the HA brake control unit can each have two different power supplies or can each have different power supplies. This ensures that, in the event of a power supply failure, at least one brake control unit can continue to be supplied with power.

[0094] According to yet another preferred embodiment of the invention, the same also applies to the at least two pedal sensors, which accordingly can also have a different voltage supply.

[0095] Further details of the invention emerge from the description of the illustrated embodiments and the appended claims.

[0096] The drawings show: Fig. 1 shows a schematic plan view of an example of an architecture of a braking system according to the invention for a motor vehicle, Fig. 2 shows another example of an architecture of a braking system according to the invention in a schematic plan view, Fig. 3 shows yet another example of an architecture of a braking system 10 according to the invention in a schematic plan view with an emergency stop switch, Fig. 4 shows yet another example of an architecture of a braking system 10 according to the invention in a schematic plan view, which has a lower redundancy, Fig. 5 shows yet another example of an architecture of a braking system 10 according to the invention in a schematic plan view with a two-part brake control unit, Fig. 6 shows yet another example of an architecture of a braking system 10 according to the invention in a schematic plan view with an additional data line, Fig. 7 the underlying method for operating the braking system according to the architecture of Fig. 1 schematically in a flow diagram, Fig. 8 the underlying method for operating the braking system according to the architecture of Fig. 2 schematically in a flow diagram, Fig. 9 the underlying method for operating the braking system according to the architecture of Fig. 4 schematically in a flow diagram, and Fig. 10 shows yet another example of an architecture of a braking system 10 according to the invention with a hydraulic system in a schematic plan view with an additional data line.

[0097] In the following detailed description of preferred embodiments, for the sake of clarity, like reference numerals designate substantially similar parts in or on these embodiments. However, to better illustrate the invention, the preferred embodiments illustrated in the figures are not always drawn to scale.

[0098] The invention relates to a method for operating a braking system 10, in particular for a motor vehicle 1, with four electrically controllable wheel brake modules 11, 12, 13, 14, which are assigned to two different axles 2, 3 of the motor vehicle 1, with the following steps: - Determining actuation information describing a braking request by a brake actuation unit 20, wherein the braking request can preferably be detected independently of one another by at least one first pedal sensor or FA pedal sensor 21 and a second pedal sensor or RA pedal sensor 22, - Generation of braking torque requests (RQT_FA*, RQT_RA*) corresponding to the actuation information by a central control electronics 70, - generating braking torque requests (RQT_FA) corresponding to the actuation information by at least one FA brake control unit 30), which is assigned to the wheel brake modules 11, 12 of a front axle 2, or which is assigned to two diagonally arranged wheel brake modules 11, 12, 13, 14, - generating braking torque requests (RQT_RA) corresponding to the actuation information by at least one RA brake control unit 40, which is assigned to the wheel brake modules 13, 14 of a rear axle 3, or which is assigned to the two remaining diagonally arranged wheel brake modules 11, 12, 13, 14, - Controlling the wheel brake modules 11, 12, 13, 14 of the braking system 10 according to a normal operating level with the braking torque request (RQT_FA*, RQT_RA*), or - Controlling the wheel brake modules 11, 12, 13, 14 according to a fallback level with the braking torque request (RQT_FA), and / or controlling the wheel brake modules 11, 12, 13, 14 according to the fallback level with the braking torque request (RQT_RA).

[0099] Fig. 1 shows in a schematic plan view an example of a possible architecture for a braking system 10 which is suitable for carrying out the above-mentioned method.

[0100] In the example of Fig. 1, the wheel brake modules 11, 12, 13, and 14 each comprise electromechanical disc brakes as wheel brakes 15, 16, 17, and 18. Alternatively, the wheel brakes can also be designed as electromechanical drum brakes. Combinations are also possible, including in conjunction with hydraulically actuated wheel brakes.

[0101] The method according to the invention provides that in addition to the central control electronics 70, which enables operation of the braking system 10 in a normal operating level, a fallback level is provided which is divided into two parts.

[0102] The braking system 10 in the embodiment of the Fig. 1 comprises a brake actuation unit 20 which is configured to detect a driver's braking request and to determine corresponding actuation information which corresponds to the driver's braking requirements.

[0103] The actuation information is recorded independently by an FA pedal sensor 21 and an RA pedal sensor 22. These two pedal sensors 21, 22 are combined in the brake actuation unit 20.

[0104] The central control electronics 70 is configured to generate the braking torque request based on the actuation information using stored control algorithms. The braking torque request can be axle-specific or wheel-specific.

[0105] The wheel brakes 15, 16, 17, and 18 are each part of the wheel brake module 11, 12, 13, and 14. In the example shown, the braking system 10 comprises two wheel brake modules 11, 12 on the front axle 2 and two further wheel brake modules 13, 14 on the rear axle 3, each of which is assigned to a vehicle wheel. The wheel brake modules 11, 12, 13, and 14 are electrically controllable.

[0106] The division of the fallback level according to the invention is achieved, among other things, by assigning a brake control unit 30, 40 to at least each axle 2, 3 of the motor vehicle 1. As can be seen from the Fig. 1, a brake control unit, hereinafter referred to as FA brake control unit 30, is assigned to the front axle 2, and another brake control unit, hereinafter referred to as RA brake control unit 40, is assigned to the rear axle.

[0107] The FA brake control unit 30 and the RA brake control unit 40 are configured to generate the braking torque requests RQT_FA, RQT_RA based on stored control algorithms based on the actuation information of the brake actuation unit 20.

[0108] Furthermore, two axle controllers 31, 41 are provided, each assigned to an axle. These FA axle controllers 31 and RA axle controllers 41 are signal-connected to the corresponding FA brake control unit 30 and RA brake control unit 40, respectively. The axle controllers 31, 41 are configured to generate wheel-specific braking commands RQT_xA*, RQT_xA from the braking torque requirements and transmit them to the individual wheel brake modules. In the example of the Fig. 1 the respective brake control units and associated axle controllers are structurally combined in one module.

[0109] The two pedal sensors 21, 22 are electrically or signal-wise connected to the brake control units 30, 40, so that actuation information can be transmitted to the brake control units 30, 40. The actuation information is transmitted as digital signals.

[0110] As in the example of Fig. 1, the FA pedal sensor 21 is connected to the FA brake control unit 30 via a brake request signal line 90, and the RA pedal sensor 22 is connected to the RA brake control unit 40 via another brake request signal line 91. The actuation information can therefore be detected independently of one another and transmitted independently of one another to the respective brake control units 30, 40.

[0111] The brake control units 30, 40 are also signal-connected to the central control electronics 70. In this way, the actuation information from the pedal sensors 21, 22 can be transmitted via the brake control units 30, 40 to the central control electronics 70.

[0112] In the example of Fig. 1, a central control electronics unit 70 is provided for the central generation of braking torque requests RQT_FA*, RQT_RA* and at least two brake control units 30, 40, each assigned to an axle 2, 3 of the motor vehicle 1, for the independent generation of braking torque requests RQT_FA, RQT_RA. In this way, the fallback level can be divided into two parts and distributed between the two axles 2, 3.

[0113] This allows the braking system 10 to switch back to two separate, independently operating control paths in the fallback level in the event of a lack of braking torque requests RQT_FA*, RQT_RA* from the central control electronics 70. In such a case, the driver's braking request detected at the brake pedal can lead to a braking torque request RQT_FA for the vehicle wheels of the front axle 2 and its implementation at the associated wheel brake modules 11, 12. Independently of this, the separately detected braking request can lead to a braking torque request RQT_RA for the vehicle wheels of the rear axle 3 and its implementation at the associated wheel brake modules 13, 14.

[0114] For the signal connection between the pedal sensors 21, 22 and the brake control units 30, 40, the brake system 10 can comprise two separate brake request signal lines 90, 91.

[0115] Slip control can take place independently on the two brake control units 30, 40.

[0116] In the embodiment of the Fig. 1, a data line 92 is also provided between the central control electronics 70 and the FA brake control unit 30, and another data line 93 is provided between the at least one central control electronics 70 and the RA brake control unit 40. For further increased operational reliability, these data lines 92, 93 can also be duplicated, i.e., redundant.

[0117] In the embodiment of the Fig. 1 shows, purely by way of example, wheel speed sensors 35, 36, 45, 46, which are each assigned to a vehicle wheel and are designed to measure the respective wheel speed during operation and to transmit it to the FA or RA brake control unit 30, 40 associated with axle 2, 3.

[0118] In the embodiment of the Fig. 1, the central control electronics 70 is configured with two separate partitions 70a, 70b, each of which is assigned to an axle 2, 3 and which are configured to independently generate the braking torque requirements for the corresponding wheel brake modules 11, 12, 13, 14 of the respective axles 2, 3. The division into two partitions is, as shown below, not mandatory for the invention and thus represents only one possible embodiment.

[0119] Partition 70a is in the Fig. 1 is signal-connected to the FA brake control unit 30 via the data line 92 and the partition 70b is signal-connected to the RA brake control unit 40 via the data line 93.

[0120] In the embodiment of the Fig. 1, the two brake control units 30, 40 are connected to two different power supplies 80, 81, so that if a power supply 80, 81 fails, at least one brake control unit 30, 40 of an axis 2, 3 remains functional even in the fallback level.

[0121] The two partitions 70a, 70b can also be equipped with or include an autopilot function (“Auto 1”, “Auto 2”), as shown in Fig. 1. These functions can be designed to independently generate the braking torque requirements RQT_FA*, RQT_RA* for the wheel brakes of each axle 2, 3.

[0122] Due to the complete axle-specific separation of the control, coupled functions that require a different coordinated control of the wheel brakes of different axles 2, 3 are not possible. Such braking systems 10 can therefore be used, for example, in slow-moving transport vehicles, where such stability control can be dispensed with.

[0123] Fig. 7 shows a schematic overview of the procedure for operating a braking system as in Fig. 1 shown.

[0124] The example of Fig. Figure 1 thus shows a very consistently divided, dual-circuit braking system, which can also be operated in a dual-circuit state at the normal operating level ("safe state"). Both the pedal sensors 21, 22 and the partitions 70a, 70b of the central control electronics 70 each operate an axle independently of one another, and both subsystems are independent of each other.

[0125] The Fig. 1 thus represents only one embodiment of a braking system according to the invention for a specific application area. In contrast, the architecture of the Fig. 2 a particularly preferred embodiment of the invention. Fig. Figure 2 thus shows a particularly preferred example of the architecture of a braking system 10 according to the invention in a schematic plan view. In this exemplary embodiment, the central control electronics 70 is not divided into partitions and is also connected to the FA and RA brake control units 30, 40 via only a single data line 92, which can provide assembly and cost advantages. In addition, the central control electronics 70 is connected to a parking brake button 72 via another data line 94 or another data bus.

[0126] In the normal operating level, the central control electronics 70 operates the braking system 10 in a single circuit, and in the fallback level, the two brake control units 30, 40 operate the braking system 10 in a dual circuit.

[0127] This data line 94 can also be used very conveniently to connect the central control electronics 70 to a higher-level vehicle computer (not shown).

[0128] The method according to the invention provides for controlling the wheel brake modules 11, 12, 13, 14 in a normal operating level and in a fallback level. The method for operating a brake system according to Fig. 2 is in Fig. 8 is shown schematically in an overview and comprises two control paths, with a normal path 5 indicating the normal operating procedure and a control path 6 indicating the fallback level.

[0129] In the normal operating mode, the control is based on the braking torque requirements RQT_FA*, RQT_RA* of the central control electronics 70. By a decision logic, which is in the Fig. 8 is identified by the reference number 7, these braking torque requests RQT_FA*, RQT_RA* are compared with the braking torque requests RQT_FA, RQT_RA, which are generated directly by the brake control units 30, 40.

[0130] Decision logic 7 is therefore used to switch between the normal operating level and the fallback level. Decision logic 7 is implemented in the brake control units (30, 40) using appropriate control algorithms.

[0131] If the braking torque requirements RQT_FA, RQT_RA are higher than the braking torque requirements RQT_FA*, RQT_RA* by a predefined value or threshold, these braking torque requirements RQT_FA, RQT_RA are used to control the wheel brake modules in the fallback level. This allows the invention to implement a "safety barrier," i.e., a safety threshold. This threshold can be very high, e.g., 0.5 g / 1 g of corresponding braking torque.

[0132] This also makes it possible to decelerate through recuperation without being overridden by the “safety barrier”.

[0133] During normal operation, the central control electronics 70 can arbitrate the normal braking function with other control functions, thus also generating braking torque requests RQT_FA*, RQT_RA* from other functions and transmitting them to the wheel brake modules 11, 12, 13, 14. The individual wheel brakes 15, 16, 17, 18 can also be controlled individually.

[0134] In addition, dynamic braking can also be realized using the parking brake button 72.

[0135] If the central control electronics 70 is detected as being switched off, which can be detected by the decision logic, the system then switches over to the two FA and RA brake control units 30, 40, and the braking torque requirements RQT_FA, RQT_RA directly generated in the FA and RA brake control units 30, 40 are used to control the wheel brake modules without a threshold in accordance with the fallback level.

[0136] This can be detected by a missing bus signal on the corresponding data line 92, 93, or by an additional voltage level that is fed from an emergency stop switch 71 to the FA and RA brake control units 30, 40 and interrupts this level when switched. There may also be an error message from the central control electronics 70, which can be detected. An emergency stop switch 71 can, as in the example of Fig. 3, are integrated into the architecture.

[0137] The rule path 6 of the fallback level is in the architecture as in Fig. 2 and Fig. 8, dual-circuit and diverse design, so that in the event of a failure of the signals from the central control electronics 70, the higher-order control functions are switched off and the braking system falls back to a safe dual-circuit basic brake with basic function and slip control.

[0138] The term “diverse” here means that the two fallback paths or circuits are different modules that can include different hardware and software components so that a systematically caused simultaneous failure can be avoided.

[0139] The method for operating the braking system therefore provides for controlling the wheel brake modules 11, 12, 13, 14 in the normal operating level when - braking torque requests (RQT_FA*, RQT_RA*) exist and actuation information from at least one FA and / or RA pedal sensor 21, 22 is available, and if - there is no error message from the central control electronics 70, and if - the braking torque requirements (RQT_FA*, RQT_RA*) do not deviate from the corresponding braking torque requirements (RQT_FA, RQT_RA) by a predefined value.

[0140] The method for operating the braking system 10 therefore provides for controlling the wheel brake modules 11, 12, 13, 14 in the fallback level when - actuation information from at least one FA or HA pedal sensor 21, 22 is available, but no braking torque requests (RQT_FA*, RQT_RA*) exist from the central control electronics 70, or if - if actuation information is available from the actuation unit, an error message is present from the central control electronics 70, or if - when actuation information is present from the actuation unit, there is no bus signal on the data line 92, 93, or if - the braking torque requirements (RQT_FA*, RQT_RA*) exceed a predefined distance from the corresponding braking torque requirements (RQT_FA, RQT_RA).

[0141] Fig. Figure 3 shows yet another example of the architecture of a braking system 10 according to the invention in a schematic plan view. In this embodiment, the brake control unit 30, 40 is integrated into the respective axle controller 31, 41, and both components are designed as a single module.

[0142] In this embodiment, an emergency stop switch 71 is provided, which is connected to the FA and RA brake control units 30, 40 via a signal line 95.

[0143] Furthermore, the data lines 92, 93 between the central control electronics 70 and the FA and RA brake control units 30, 40 are duplicated, i.e. redundant, which further increases the reliability.

[0144] Fig. Figure 4 shows yet another example of the architecture of a braking system 10 according to the invention in a schematic plan view. In this embodiment, the second pedal sensor 22 is not connected to a brake control unit, but rather to the central control electronics 70. Additionally, a data line 96 is provided between the FA brake control unit 30 and the RA brake control unit 40.

[0145] The method underlying this architecture for operating the braking system 10 is described in Fig. 9 is shown schematically in an overview and also comprises two control paths, with a normal path 5 indicating the normal operating procedure and a control path 6 indicating the fallback level. It can be seen that the normal path 5 of the normal operating procedure is largely analogous to the normal operating procedures outlined above, with the exception that a brake request signal line is routed directly from a pedal sensor to the central control electronics 70.

[0146] A "safety barrier" with a predefined value or threshold can also be stored, since the RA brake control unit 40 can also receive braking torque requests RQT_FA, RQT_RA from the FA brake control unit 30 via data line 96 and braking torque requests RQT_FA*, RQT_RA* via data line 92. Accordingly, the corresponding comparison can be performed analogously by the decision logic 7 for both brake control units 30, 40. However, a difference from the aforementioned architectures becomes apparent in the fallback level. The fallback level is no longer fully redundant, since in the example, the RA brake control unit 40 can only be controlled via data line 96. Although all four wheel brakes 15, 16, 17, 18 can still be controlled, if there is an additional error in the pedal sensor 21 assigned to the other axle, the fallback level would fail.Therefore, this architecture represents a possible, but not a preferred, embodiment of the invention.

[0147] Fig. Figure 5 shows yet another example of the architecture of a braking system 10 according to the invention in a schematic plan view. In this exemplary embodiment, the FA brake control unit 30 and the associated axle controller 31 are divided into two parts and are each directly assigned to a wheel brake module 11, 12.

[0148] The associated data lines 92, 93, and 95 are split accordingly. Additionally, a further data line 97 is provided, which enables data exchange between the two FA brake control units 30. In this way, actuation information from the pedal sensor 21 can be transmitted to both FA brake control units 30.

[0149] Fig. Figure 6 shows yet another example of the architecture of a braking system 10 according to the invention in a schematic plan view. In this embodiment, an additional data line 98 is provided between the FA brake control units 30 and RA brake control units 40, enabling direct communication.

[0150] Fig. 10 shows yet another example of an architecture of a braking system 10 according to the invention in a schematic plan view with a hydraulic system.

[0151] The normal operating procedure is analogous to that in Fig. 6. The braking torque requests RQT_FA*, RQT_RA* are generated by the central control electronics 70 and transmitted to the brake control units.

[0152] The hydraulically actuated wheel brakes 11, 12, 13, 14 in this case are then controlled in a known manner during normal operation by the brake control units, for which purpose, among other things, an actuator 8 and a modulator 9 are provided. In the fallback level, which can be detected analogously by the decision logic 7, the braking system 10 then falls back to two separate control paths with the actuator 8 and the modulator 9, which then control the wheel brakes independently of the axle according to the respective pedal sensor input.

[0153] Normal braking functions can be implemented in the normal operating level and a local, axle-related ABS in the fallback level. List of reference symbols: 1 motor vehicle 2 front axle 3 rear axle 5 Normal path 6 Relapse path 7 Decision logic 8 Actuator 9 Modulator 10 Braking system 11 Wheel brake module 12 Wheel brake module 13 Wheel brake module 14 Wheel brake module 15 Wheel brake 16 Wheel brake 17 Wheel brake 18 Wheel brake 20 Brake actuation unit 21 Pedal sensor 22 Pedal sensor 30 FA brake control unit 31 FA axis controllers 35 Wheel speed sensor 36 Wheel speed sensor 40 Brake control unit 41 rear axle controller 45 Wheel speed sensor 46 Wheel speed sensor 70 Central control electronics 70a FA partition 70b RA partition 71 Emergency stop switch 72 Parking brake button 80 Power supply 81 Power supply 90 Brake request signal line 91 Brake request signal line 92 data line 93 Data line 94 data line 95 Signal line 96 data line 97 Data line 98 data line

Claims

[1] Method for operating a braking system (10), in particular for a motor vehicle (1), with preferably four, in particular electrically controllable, wheel brake modules (11, 12, 13, 14), which are uniformly assigned to two different axles (2, 3) of the motor vehicle (1), with the following steps: - Determining actuation information describing a braking request by a brake actuation unit (20), wherein the braking request can be detected independently of one another by at least one FA pedal sensor (21) and one RA pedal sensor (22), - Generation of braking torque requests (RQT_FA*, RQT_RA*) corresponding to the actuation information by a central control electronics (70), - generating braking torque requests (RQT_FA) corresponding to the actuation information by at least one FA brake control unit (30) which is assigned to the wheel brake modules (11, 12) of a front axle (2) or which is assigned to two diagonally arranged wheel brake modules (11, 12, 13, 14), - generating braking torque requests (RQT_RA) corresponding to the actuation information by at least one RA brake control unit (40) which is assigned to the wheel brake modules (13, 14) of a rear axle (3) or which is assigned to the two remaining diagonally arranged wheel brake modules (11, 12, 13, 14), - controlling the wheel brake modules (11, 12, 13, 14) of the braking system (10) according to a normal operating level with the braking torque requirements (RQT_FA*, RQT_RA*), or - controlling the wheel brake modules (11, 12, 13, 14) assigned to the FA brake control unit (30) according to a fallback level with the braking torque requirements (RQT_FA), and / or controlling the wheel brake modules (11, 12, 13, 14) assigned to the RA brake control unit according to the fallback level with the braking torque requirements (RQT_RA). [2] A method for operating a braking system (10) according to the preceding claim, wherein the braking system (10) further comprises: - at least one first brake request signal line (90) between the FA pedal sensor (21) and the FA brake control unit (30), preferably two such brake request signal lines (90), - at least one second brake request signal line (91) between the RA pedal sensor (22) and the RA brake control unit (40), preferably two such brake request signal lines (91), - at least one data line (92) between the at least one central control electronics unit (70) and the FA brake control unit (30) and at least one data line (93) between the at least one central control electronics unit (70) and the HA brake control unit (40), preferably two such data lines (92, 93) in each case. [3] A method according to any one of the preceding claims, comprising the following step - Switching between the normal operating level and the fallback level by a decision logic (7), wherein the decision logic (7) is preferably integrated into the FA and / or RA brake control unit (30, 40). [4] A method according to any one of the preceding claims, comprising the following step: - Control of the wheel brake modules (11, 12, 13, 14) in the normal operating level, if - braking torque requirements (RQT_FA*, RQT_RA*) exist and actuation information from at least one FA and / or RA pedal sensor (21, 22) is available, and if - there is no error message from the central control electronics (70), and if - the braking torque requirements (RQT_FA*, RQT_RA*) do not deviate from the corresponding braking torque requirements (RQT_FA, RQT_RA) by a predefined value. [5] A method according to any one of the preceding claims, further comprising the following step: - Control of the wheel brake modules (11, 12, 13, 14) in the fallback level, if - actuation information from at least one FA or HA pedal sensor (21, 22) is available, but no braking torque requests (RQT_FA*, RQT_RA*) exist from the central control electronics (70), or if - if actuation information is available from the actuation unit, an error message from the central control electronics (70) is present, or if - when actuation information is present from the actuation unit, there is no bus signal on the data line (92, 93), or if - the braking torque requirements (RQT_FA*, RQT_RA*) exceed a predefined distance from the corresponding braking torque requirements (RQT_FA, RQT_RA). [6] Method according to one of the preceding claims, further comprising at least one of the following steps: - sending the actuation information independently of one another from the FA pedal sensor (21) to the FA brake control unit (30) via the first brake request signal line (90) and / or from the RA pedal sensor (22) to the RA brake control unit (40) via the second brake request signal line (91), - transmitting the actuation information independently of each other via the FA and RA brake control units (30, 40) through the data line (92, 93) to the at least one central control electronics unit (70), - Sending the braking torque requests (RQT_FA*, RQT_RA*) independently of each other via the data lines (92, 93) to the FA and RA brake control units (30, 40). [7] A method according to any one of the preceding claims, further comprising the following step: - Generation of the braking torque requirements (RQT_FA*, RQT_RA*) according to central control algorithms stored in the central control electronics (70). [8] Method according to one of the preceding claims, wherein the central control electronics (70) is connected to a vehicle computer via a data bus (94), and wherein the generation of the braking torque requests (RQT_FA*, RQT_RA*) is based at least partially on signals which are transmitted to the central control electronics (70) via the data bus (94). [9] Method according to the preceding claim, wherein the data bus (94) is connected to a parking brake button (72), and wherein the central control electronics (70) can be controlled via the parking brake button (72). [10] A method according to any one of the preceding claims, further comprising the following step: - Generation of the braking torque requirements (RQT_FA, RQT_RA) according to stored local control algorithms by the brake control units (30, 40). [11] Method according to one of the preceding claims, wherein the central control electronics (70) comprises an FA partition (70a) and an RA partition (70b) which independently generate the braking torque requests (RQT_FA*, RQT_RA*), further comprising the step: - Generation of the braking torque requests (RQT_FA*) by the FA partition (70a) and sending them via the data line (92) to the FA brake control unit (30), - Generation of the braking torque requests (RQT_RA*) by the RA partition (70b) and sending via the data line (93) to the RA brake control unit (40). [12] Method according to one of the preceding claims, wherein the FA brake control unit (30) and / or the HA brake control unit (40) are designed in two parts and are each directly assigned to a wheel brake module (11, 12, 13, 14). [13] A method according to any one of the preceding claims, further comprising the following step: - Transmitting the actuation information from the FA and HA pedal sensors (21, 22) to the central control electronics (70) solely via the brake request signal line (90, 91) to the FA and HA brake control units (30, 40) and from there via the further data line (92, 93). [14] Method according to one of the preceding claims, wherein in the fallback level the control of the wheel brakes (15, 16, 17, 18) is carried out solely by the brake actuation unit (20) without further communication via the data bus. [15] Method according to one of the preceding claims, wherein an additional data line (96, 98) is further provided between the FA and HA brake control units (30, 40), which enables data exchange between the FA and HA brake control units (30, 40). [16] Braking system (10), in particular for a motor vehicle (1), wherein the braking system (10) is designed to carry out a method according to one of the preceding claims. [17] Braking system (10), in particular according to the preceding claim, comprising: - four preferably electrically controllable wheel brake modules (11, 12, 13, 14), each comprising a wheel brake (15, 16, 17, 18), - at least one brake actuation unit (20), wherein the brake actuation unit (20) has at least one FA pedal sensor (21) and one HA pedal sensor (22), which are each designed to independently detect actuation information of the brake actuation unit (20) describing the braking request, - at least one FA brake control unit (30) which is assigned to the wheel brake modules (11, 12) of a front axle (2) or which is assigned to the two remaining diagonally arranged wheel brake modules (11, 12, 13, 14), and - at least one rear axle brake control unit (40) which is assigned to the wheel brake modules (13, 14) of a rear axle (3) or which is assigned to the two remaining diagonally arranged wheel brake modules (11, 12, 13, 14), - wherein the FA pedal sensor (21) is connected at least to the FA brake control unit (30) via at least one first brake request signal line (90), - wherein the rear axle pedal sensor (22) is connected at least to the rear axle brake control unit (40) via at least one second brake request signal line (91), and - at least one central control electronics unit (70) which is connected to the FA brake control unit (30) via at least one data line (92, 93) and to the HA brake control unit (40) via at least one data line (92, 93). [18] Braking system (10) according to one of the preceding claims 16 or 17, wherein the central control electronics (70) comprises an FA partition (70a) and an RA partition (70b), and wherein the FA partition (70a) is configured to generate a braking torque request (RQT_FA*) independently of the RA partition (70b) and to send it to the FA brake control unit (30) via the data line (92), and wherein the RA partition (70b) is configured to generate a braking torque request (RQT_RA*) independently of the FA partition (70a) and to send it to the RA brake control unit (40) via the data line (93). [19] Braking system (10) according to one of the preceding claims 16 to 18, wherein a further data line (94) is provided between the central control electronics (70) and a higher-level vehicle computer, and wherein the central control electronics (70) is configured to be able to be controlled by the vehicle computer. [20] Braking system (10) according to one of the preceding claims 16 to 19, wherein a parking brake button (72) is connected to the central control electronics (70) via the further data line (94), and wherein the central control electronics (70) is configured to be able to be controlled by the parking brake button (72). [21] Brake system (10) according to one of the preceding claims 16 to 20, wherein an additional signal line (95) is provided between the central control electronics (70) and the FA brake control unit (30) and / or the HA brake control unit (40), and wherein the signal line (95) is connected to an emergency stop switch (73) for signaling purposes. [22] Brake system (10) according to one of the preceding claims 16 to 21, wherein the FA brake control unit (30) and the HA brake control unit (40) each have two different voltage supplies (80, 81).

Images