BRAKING SYSTEM WITH REDUNDANT PARKING BRAKE CONTROL

Description

[0001] The invention relates to a brake system for a motor vehicle comprising a first parking brake actuator and a second parking brake actuator and a first control unit and a second control unit.

[0002] Braking systems often have two control units for a hydraulic service brake, with the first control unit implementing the control for pressure build-up in the hydraulic service brake in fault-free operation and the second control unit implementing a stability program (ESC). In Highly redundant systems, such as those required for autonomous driving, also use two separate control units, with all functions implemented in a first control unit, and a second control unit providing reduced functionality in the event of a fault. A different distribution of functionality across two control units is also possible.

[0003] The two parking brake actuators are typically arranged on the wheels of a vehicle axle, for example the rear axle, and are controlled either by the first control unit or by the second control unit.

[0004] According to the current state of the art, a transmission pawl is used in addition to the parking brake, which can hold the vehicle permanently stationary. If a single component of the parking brake actuator control unit fails, such as the microprocessor, the power supply, or the driver, both parking brake calipers are no longer available. However, the transmission pawl still holds the vehicle safely stationary. However, the costs for such a transmission pawl are exceptionally high. Particularly in the course of vehicle electrification, transmissions are being adapted to the requirements of the electric motors used, whereby eliminating the transmission pawl can result in significant cost savings across the entire system.

[0005] However, simply removing the gear pawl is not preferred for the reasons mentioned above, as if the parking brake calipers fail, the vehicle could roll away uncontrollably.

[0006] WO 2019 / 197555 A1 discloses a hydraulic motor vehicle brake system that provides electrical redundancy by means of two functional units including control units. The two disclosed parking brakes EPB1 and EPB2 can be redundantly controlled by both control units. The motor vehicle brake system can perform stability control functions, brake booster functions, and basic braking functions, which also utilize the parking brake actuators.

[0007] DE 10 2016 015 544 A1 also discloses a redundant braking system with two parking brake actuators. The ECU therein has two processor units 202, 204, but the ECU only has one common driver circuit. The ECU has a multiplexer for selectively controlling the parking brake actuators by the two processors.

[0008] A hydraulic automotive brake system with redundancy is also known from DE 10 2017 003 650 A1. The control of two parking brake actuators is distributed across two control units. The parking brake actuators are activated in the event of a malfunction in order to map control functions.

[0009] It is therefore an object of the present invention to provide a braking system which, without the provision of a gear pawl, redundantly and thus safely prevents the uncontrolled rolling away of the vehicle.

[0010] The problem is solved by a braking system according to claim 1, wherein a driver for controlling at least the first and / or the second parking brake actuator is provided on the first control unit and the second control unit. In particular, the first driver of the first control unit is designed to control at least the first parking brake actuator, and the second driver of the second control unit is designed to control the second parking brake actuator. The first and second parking brake actuators are therefore controllably connected to the respective drivers of the associated control unit(s), and the driver is configured to control the at least one parking brake actuator.

[0011] The first control unit can be configured to build up brake pressure for a hydraulic service brake in a fault-free situation. The second control unit can be configured to take over the control of building up brake pressure for the hydraulic service brake if a fault occurs in the first control unit.

[0012] The first control unit further comprises a first arbitration unit configured to receive first parking brake request data and to determine from the received first parking brake request data whether a parking brake action should be performed. Parking brake request data can be data relevant for applying and / or releasing the parking brake. Typical parking brake request data includes a signal from a parking brake switch, an external actuation signal, vehicle speed data from wheel speed sensors or other sources, sensor data for door opening, the status of the vehicle key (e.g., key-out), ignition status, accelerator pedal position, and many more.

[0013] The second control unit has a second arbitration unit, which is also configured to receive parking brake request data and to determine from the received parking brake request data whether a parking brake action should be performed. This second parking brake request data of the second arbitration unit can be selected from the same group of data as the first parking brake request data, wherein the second parking brake request data of the second arbitration unit can be at least partially identical to or different from the first parking brake request data of the first arbitration unit. The result of the second arbitration unit is supplied to the first arbitration unit on the input side as part of its parking brake request data, and the result of the first arbitration unit is transmitted to the driver of the first and / or second control unit for controlling the first and / or second parking brake actuator.By splitting the control of the first and second parking brake actuators between two control units, redundancy is achieved. If one control unit fails, at least one parking brake actuator is still operational and can prevent the vehicle from rolling away. This eliminates the need for a transmission pawl, thus enabling cost savings. The independent arbitration units of the first and second control units, which are connected in series according to the invention, result in a single decision point despite the split between the two control units. This completely eliminates control errors that can arise from contradictory control, and increases the availability of the overall system.

[0014] In a preferred embodiment of the invention, a parking brake switch is provided, the switching state of which is supplied to the first arbitration unit and / or the second arbitration unit as part of the first and / or second parking brake request data. In order to supply the switching state to both arbitration units, the parking brake switch can be designed, for example, as a double switch. A mechanically actuatable element is internally coupled to two electrical switches, each of which is connected to an arbitration unit to supply a signal to the latter. The two internal electrical switches can be galvanically isolated. In a further preferred embodiment of the invention, the driver of the first control unit is configured only to control the first parking brake actuator, and the driver of the second control unit is configured only to control the second parking brake actuator.In this case, the result of the first arbitration unit is transmitted to the driver of the first and second control units to control the first and second parking brake actuators, so that both drivers can control their correspondingly assigned parking brake actuators according to the result of the first arbitration unit. If one of the control units fails, the control capability of the parking brake actuator connected to the other control unit remains available. Since only one parking brake actuator is available, this does lead to reduced slope holding capability, but this is sufficient to meet legal requirements and standards, so that the transmission pawl can be omitted in this case too. This embodiment is a particularly cost-effective variant, as only the minimum number of control lines is required.

[0015] In an alternative embodiment of the invention, the drivers of the first control unit and the second control unit are each configured to control the first and second parking brake actuators. Both parking brake actuators are thus controlled by both control units. If one control unit fails, the controllability of both parking brake actuators is maintained. This results in full slope-holding capability, as long as one of the parking brake actuators itself has not failed. Thus, the vehicle can be held safely even on steep slopes in the event of a fault. This embodiment therefore represents a particularly safe variant.

[0016] In a further preferred embodiment of the invention, both control units determine the state of the respectively assigned parking brake actuators and transmit the determined state to the other control unit. The states can include clamped, released, unknown, or other states. In particular, the states of the two parking brake actuators can be combined into an overall state in the first and / or second control unit. This allows the parking brake functions and any associated driver information messages to respond accordingly. For example, flashing warning lights for errors or permanently illuminated indicator lights for successful application of both electronic brake calipers can be activated.

[0017] In a further preferred embodiment of the invention, the first control unit and the second control unit are connected to each other via a separate communication line and / or via a vehicle bus, and the control units are configured to communicate via this communication line. A separate communication line is independent of a vehicle bus. This ensures that the two control units can exchange all the information necessary for proper operation.

[0018] In a particularly preferred embodiment, the first control unit and the second control unit exchange availability information, in particular mutually, with the second control unit assuming a failure of the first control unit if the availability information indicates no availability and / or no availability information is received. Since the control units are thus aware of the availability of the respective other control unit, they can react accordingly if a control unit fails.

[0019] In a particularly preferred embodiment of the invention, the second arbitration unit is configured to transmit the result of the arbitration to the driver of the second control unit for controlling the at least one parking brake actuator in the event of a failure of the first control unit. If the second control unit does not receive any availability information from the first control unit or receives an indication from the first control unit that the first control unit is unavailable, the second control unit directly controls the parking brake actuators connected thereto via its own driver. Thus, the second control unit can reliably control at least one parking brake actuator even in the event of a complete failure of the first control unit.The second control unit can be connected to an additional redundant switch, an alternative human-machine interface, such as an alternative switch that the driver can operate via the on-board computer, whose data is fed to the second arbitration unit as second parking brake request data. Furthermore, an automatic condition can be implemented in the arbitration unit, which, for example, applies the parking brake when the ignition is deactivated or releases the parking brake when driving off.

[0020] In a preferred embodiment of the invention, at least one parking brake actuator is controllably connected to the first and second control units. The first and second control units are then configured to transfer authorization to control the parking brake actuator, which is controllably connected to the first and second control units, by exchanging a token. The token can then be transferred as soon as a fault is detected in the first control unit, in the control path, or in one of the two parking brake actuators. The control unit with the token controls the parking brake actuators as if it were the only control unit in the network. This prevents both control units from attempting to access a parking brake actuator simultaneously and potentially making contradictory control attempts.In a preferred embodiment of the invention, the first and / or the second control unit is configured to control the parking brake actuator only when the control unit itself has the token and the other control unit does not have the token. This ensures that only one of the two control units can be active at a time, while the other control unit cannot perform any activity. In particular, possible overlaps during the transfer of the token are thus avoided, since access can only take place once the token transfer has been fully completed. This prevents a short circuit from occurring, for example, when there is a command to apply the parking brake (apply request) from the first control unit and a simultaneous command to release it (release request) from the second control unit.

[0021] In a particularly preferred embodiment of the invention, during a power-on process, for example, booting up the control units after the motor vehicle's ignition is switched on, the first or second control unit receives the token authorizing it to control the parking brake actuator, which is controllably connected to the first and second control units. Accordingly, the other control unit does not receive a token. Thus, it is clearly defined from the outset which of the control units is authorized to access the parking brake actuators.

[0022] In a preferred embodiment of the invention, four wheel speed sensors are provided, each assigned to one of the four wheels of the motor vehicle, with the first or the second control unit receiving data from all four wheel speed sensors and the other control unit receiving data from only two wheel speed sensors. The wheel speed sensors can be used to determine when the motor vehicle is at a standstill, in order to only apply the parking brake when the vehicle is at a standstill. This prevents a dangerous situation from arising due to incorrect activation of the parking brakes while driving. Due to the redundant control of the parking brakes, it is sufficient if only two of the four speed sensors are available for the second control unit, since in the rare event of a control unit failure, determining the standstill using two wheel speed sensors is sufficient.

[0023] In a particularly preferred embodiment of the invention, a multiplexer for the data from two wheel speed sensors is provided. In a fault-free situation, the multiplexer feeds the data from the two wheel speed sensors to the control unit, which receives data from all four wheel speed sensors. Only in the event of a failure of this control unit does it feed the data from the two wheel speed sensors to the control unit, which receives data from only two wheel speed sensors. Thus, the control unit responsible for controlling the parking brake actuators always has at least information about two wheel speed sensors, allowing the vehicle's standstill to be verified.

[0024] In another particularly preferred embodiment of the invention, the two wheel speed sensors of the multiplexer are assigned to wheels arranged diagonally to each other. Such a distribution of the monitored wheels allows for particularly reliable detection of the vehicle's standstill.

[0025] The object is also achieved by a method according to the invention for controlling a brake system according to claim 15, with two parking brake actuators and two control units, wherein a first arbitration unit of the first control unit receives first parking brake request data and determines from the received first parking brake request data whether a parking brake action should be carried out, and a second arbitration unit of the second control unit receives parking brake request data and determines from the received second parking brake request data whether a parking brake action should be carried out, wherein the result of the second arbitration unit is fed to the first arbitration unit on the input side as first parking brake request data and wherein the result of the first arbitration unit is transmitted to a driver of the first and / or the second control unit for controlling the parking brake actuators.

[0026] The preferred embodiments described above for the brake system according to the invention also form preferred embodiments for the method according to the invention.

[0027] Further features, advantages, and possible applications of the invention will become apparent from the following description of exemplary embodiments and the drawings. All described and / or illustrated features, both individually and in any combination, are part of the subject matter of the invention, regardless of their summary in the claims or their references. Figure 1 shows a schematic representation of a first embodiment of the invention, Figure 2 shows a schematic representation of a second embodiment of the invention, Figure 3 shows a schematic representation of the communication paths of the embodiment of the Figure 1 and Figure 2 , Figure 4shows a diagram of a token exchange according to the invention, Figure 5 shows the distribution of the wheel speed sensor signals of an embodiment of the invention, Figure 6 shows the distribution of the wheel speed sensor signals of another embodiment of the invention,

[0028] In the Figure 1 In the illustrated embodiment of the invention, a first control unit 2 is designed as the main control unit (main ECU), which controls a hydraulic brake unit 6, which is designed as the service brake of a motor vehicle. The first control unit 2 can, in particular, issue commands for building up pressure in the hydraulic brake unit 6. The first control unit 2 is also configured to control a first electronic parking brake (EPB) with a corresponding parking brake actuator 4 and is connected to it. The first control unit 2 has no direct connection to the second electronic parking brake for controlling it.

[0029] The second control unit 3 (Secondary ECU) is configured to control a second electronic parking brake with the corresponding parking brake actuator 5 and is connected to it. The second control unit 3 has no direct connection to the first electronic parking brake for controlling it.

[0030] The second control unit 3 also has a redundant hydraulic control 8, which can be used to control the hydraulic braking device 6 in the event of a failure of the first control unit 2. During fault-free operation, the redundant hydraulic control 8 is inactive.

[0031] A communication line 7 connects the first control unit 2 and the second control unit 3 to ensure secure communication between the two control units 2, 3.

[0032] If one of the control units 2, 3 fails, at least one of the two electronic parking brake actuators 4, 5 can always be activated. This ensures at least a minimal slope holding capability.

[0033] Figure 2 shows an alternative embodiment of the invention. Identical components are identified by the same reference numerals as in the first embodiment of the Fig. 1The first control unit 2, which is designed to control the hydraulic brake unit 6, is designed to control both parking brakes with the associated parking brake actuators 4, 5 and is controllably connected to them. The second control unit 3 is also connected to both electronic parking brakes with the associated parking brake actuators 4, 5 and is designed to control the two parking brake actuators 4, 5. In this embodiment, too, a communication line 7 is provided, which enables the exchange of information between the first control unit 2 and the second control unit 3. The communication line 7 is designed as a separate communication line 7, but can also be designed, for example, as a vehicle bus. The second control unit 3 is in turn suitable for controlling 8 the hydraulic brake unit 6 for redundancy reasons.In this embodiment, even if one of the two control units 2, 3 fails, both parking brake actuators 4, 5 are fully operational, so that full slope holding capability can be provided.

[0034] Figure 3 shows schematically the structure of the two control units 2, 3 and the corresponding communication paths.

[0035] A second arbitration unit 10 is provided in the second control unit 3, which determines, based on the provided parking brake request data 11b, whether an EPB (Electronic Parking Brake Request) is required, i.e., whether activation of the parking brake actuators 4, 5 is necessary. At least the signal of a parking brake switch (SAR - Static Apply Release) and a possible external parking brake command (XAR - External Apply Release) are supplied to the second arbitration unit 10 as parking brake request data 11b. The result of the second arbitration 12 is transmitted via the communication line 7 to the first control unit 2, where it is supplied to the first arbitration unit 9 as part of its parking brake request data 11a.

[0036] At least the signal from a parking brake switch (SAR) and a possible external parking brake command (XAR) are also supplied to the first arbitration unit 9 as parking brake request data 11a. However, it is also possible to supply the signal from the parking brake switch and / or a possible external parking brake command to only one of the two arbitration units 9, 10, since in this case, too, the series connection of the two arbitration units 9, 10 ensures that all parking brake request data 11 are taken into account. The first arbitration unit 9 determines from all parking brake request data 11a, including the result 12 of the second arbitration, whether an EPB request is required. This result is transmitted to the first driver 14 of the first control unit 2, which forms a mechatronic subsystem for controlling parking brake actuators.The result is also transmitted to the second driver 15 of the second control unit 3, which also forms a mechatronic subsystem for controlling parking brake actuators.

[0037] In the first embodiment of the Figure 1 The first driver 14 is connected to the first parking brake actuator 4 only via a control line 17, and the second driver 15 is connected to the second parking brake actuator 5 only via a control line 18. The cross connections 19, 20 do not exist in this embodiment.

[0038] The determined EPB request is thus executed on both electronic parking brake actuators 4, 5.

[0039] If an error occurs in one of the two control units 2, 3, the system remains at least partially functional. In the event of a total failure of the second control unit 3, the first control unit 2 does not receive a result 12 from the second arbitration unit 10 via the communication line 7. However, the first arbitration unit 9 can perform an arbitration based on the remaining parking brake request data 11a. In this case, the result 13 of the arbitration can also be transmitted at least to the driver 14 for controlling the first parking brake actuator 4.

[0040] If, however, the first control unit 2 fails, the first control unit 2 notifies the second control unit 3 via the communication line 7. This can occur either through an explicit notification or by not sending availability information. The second control unit 3 assumes that the first control unit 2 has failed if it does not receive any availability information from the first control unit 2 via the communication line 7. InIn this case, the second control unit 3 also performs an arbitration in the second arbitration unit 10 based on the parking brake request data 11b and, however, does not transmit this arbitration result 12 to the first control unit 2, but rather forwards the result directly to the driver 15 as a redundant parking brake control 16. The driver 15 can then control at least the second parking brake actuator 5 via the control line 18. In this case, too, at least a reduced hand-holding capability is ensured.

[0041] In the embodiment of the Figure 2The first control unit 2 is connected to the first driver 14 via a control line 19 and is additionally connected to the second electronic parking brake and the associated parking brake actuator 5. The second control unit 3 is additionally connected to its driver 15 via a control line 20 and to the first parking brake actuator 4. Thus, each parking brake actuator 4, 5 can be controlled by both control units 2, 3, so that even if one of the two control units 4, 5 fails, both parking brake actuators 4, 5 are available.

[0042] To prevent a parking brake actuator 4, 5 from being controlled simultaneously by two drivers 14, 15, and in particular from being controlled inconsistently, only one of the two control units 2, 3 is authorized to actually control the electronic parking brake actuators 4, 5. In the case of inconsistent control, a parking brake actuator 4, 5 would otherwise be controlled via the first driver 14 with a first polarity and via the second driver 15 with the opposite polarity. This would directly connect the two poles of the power supply, resulting in a short circuit. Such a short circuit could damage both control units simultaneously and thus lead to a double failure. Authorization is implemented using an exchangeable token.

[0043] The token check can already take place at the output of the first arbitration unit 9, and the first arbitration unit 9 can only transmit the arbitration result 13 to the first driver 14 if the first control unit 2 itself possesses the token. However, if the second control unit 3 possesses the token, the first arbitration unit 9 can only transmit the arbitration result 13 to the second driver 15 of the second control unit 3. Alternatively, the arbitration result 13 can always be transmitted by the arbitration unit 9 to both drivers 14, 15 of the first control unit 2 or the second control unit 3. A check to determine whether the control unit itself possesses the token then only takes place in the driver 14, 15 itself. The driver 14, 15 accordingly controls the parking brake actuators 4, 5 via the control line 17, 18, 19, 20 only if its own control unit has the token.

[0044] Figure 4shows an example of the token transfer in a timing diagram. In both the first control unit 2 and the second control unit 3, a token state 21, 22 is implemented as a binary variable, which indicates whether the respective control unit has the token. The token state 21, 22 can therefore only assume the values ​​'0' or '1'. From the beginning until time t1, the first control unit 2 has the token, and the token state 21 therefore has the value '1'. The second control unit 3 does not have a token, and the token state 22 therefore has the value '0'. At time t1, the first control unit 2 detects an error and therefore transfers the token to the second control unit 3. To do this, the first control unit 2 sets its own token state 21 to '0' and sends a corresponding message to the second control unit 3 via the communication line 7.At a time t 2 , the second control unit 3 receives the corresponding message via the communication line 7 and sets its own token state to '1'.

[0045] At a time t 3 , the first control unit 2 determines that it is functioning correctly again and accepts the token. The first control unit 2 therefore sets its own token state 21 to '1' and sends a corresponding message to the second control unit 3 via communication channel 7. At a time t 4 , the second control unit 3 receives the corresponding message and sets its own token state 22 to '0'. Between times t 3 and t 4 , both the token state 21 of the first control unit 2 and the token state 22 of the second control unit 3 have the value '1' for a short period of time. In order to avoid double access to the parking brake actuators 4, 5 during this period, a driver 14, 15 can only access the parking brake actuators 4, 5 if its own control unit 2, 3 has the token, ie the token state 21, 22 has the value '1' and the token state 21, 22 of the other control unit 2, 3 has the value '0'.In the period between t 3 and t 4, none of the drivers can access the parking brake actuators 4, 5.

[0046] To prevent parking brake actuators from being activated while the vehicle is moving, which could cause a dangerous situation, a check is made before the parking brake actuators 4, 5 are applied to determine whether the vehicle is stationary. Wheel speed sensor data 23 are used for this purpose. In order to be able to determine the vehicle's standstill in both the first control unit and the second control unit 3, two wheel speed sensor data 23 are distributed via a multiplexer 24. A corresponding architecture is described in Figure 5, in which the wheel speed sensor data from two wheels of the vehicle are transmitted directly to the first control unit 2, and the wheel speed sensor data 23 from the remaining two wheels of the vehicle are transmitted directly to the second control unit 3. The second control unit 3 has a multiplexer 24, which can transmit the signal from the two wheel speed sensors either to the corresponding computing unit of the second control unit 3 or to the first control unit 2. For this purpose, the multiplexer 24 can have a direct connection (hard-wired) to the first control unit 2. The signals from the wheel speed sensors are then present at the first control unit 2 as if the wheel speed sensors were connected directly to the first control unit 2. The multiplexer 24 is designed such that, in the absence of power, i.e. when its own control unit 2, 3 is defective, it forwards the wheel speed data to the other control unit 2, 3.

[0047] An alternative embodiment is shown in Figure 6 , in which the wheel speed signals of all four wheels first arrive at the first control unit 2. Two wheel speed sensors are in turn forwarded to the second control unit 2 via the multiplexer 24.

[0048] In both variants, in the error-free case, all four wheel speed sensor data are made available to the first control unit 2, since in the error-free case, this unit actually controls the parking brake actuators 4, 5. In the rare case of an error, two wheel speed sensor data 23 are also available to the second control unit 3 to determine whether the vehicle is stationary.

[0049] The braking system according to the invention ensures that even in the event of a failure of one of the control units, at least a reduced hand-holding capability is available, so that a transmission pawl is no longer necessary and can therefore be omitted. This ensures that there is always a "single point of decision" to rule out possible control errors. List of reference symbols

[0050] 1 Brake system 2 First control unit 3 Second control unit 4 First parking brake actuator 5 Second parking brake actuator 6 Hydraulic brake unit 7 Communication path 8 Redundant hydraulic control 9 First arbitration unit 10 Second arbitration unit 11a, b first and second parking brake request data 12 Arbitration result first arbitration unit 13 Arbitration result second arbitration unit 14 First driver 15 Second driver 16 Redundant parking brake control 17 Control line first driver to first parking brake 18 Control line second driver to second parking brake 19 Control line first driver to second parking brake 20 Control line second driver to first parking brake 21 Token state first control unit 22 Token state second control unit 23 Speed ​​sensor data 24 Multiplexer t 1 Time of token submission t 2 Time of token acceptance t 3 Time of token acceptance t 4 Time of transfer of token

Claims

1. Braking system for a motor vehicle having a first parking brake actuator (4) and a second parking brake actuator (5) and a first control device (2) and a second control device (3) which each have a driver (14, 15) for driving at least the first and / or the second parking brake actuator (4, 5), wherein the first control device (2) has a first arbitration unit (9) which is set up to receive first parking brake request data (11a) and to ascertain from the received parking brake request data (11a) whether a parking brake action should be carried out, wherein the second control device (3) has a second arbitration unit (10) which is set up to receive second parking brake request data (11b) and to ascertain from the received parking brake request data (11b) whether a parking brake action should be carried out, wherein a result of the second arbitration unit (10) is fed to the input end of the first arbitration unit (9) as part of the first parking brake request data (11a) and wherein a result of the first arbitration unit (9) is transmitted to the driver (14, 15) of the first and / or the second control device (2, 3) for driving the first and / or the second parking brake actuator (4, 5).

2. Braking system according to Claim 1, characterized in that a parking brake switch is provided, the switching state of which is fed to the first arbitration unit (9) and / or the second arbitration unit (10) as part of the first and / or the second parking brake request data (11a, 11b).

3. Braking system according to Claim 1 or 2, characterized in that the driver (14) of the first control device (2) is set up only to drive the first parking brake actuator (4) and the driver (15) of the second control device (3) is set up only to drive the second parking brake actuator (5).

4. Braking system according to Claim 1 or 2, characterized in that the drivers (14, 15) of the first control device (2) and the second control device (3) are each set up to drive the first and the second parking brake actuator (4, 5).

5. Braking system according to one of the preceding claims, characterized in that both control devices (2, 3) determine the state of the respectively associated parking brake actuators (4, 5) and transmit the determined state to the respective other control device (3, 2), wherein, in particular in the first and / or the second control device (2, 3), the states of the two parking brake actuators (4, 5) are combined to form an overall state.

6. Braking system according to one of the preceding claims, characterized in that the first control device (2) and the second control device (3) communicate with one another via a separate communication line (7) and / or via a vehicle bus.

7. Braking system according to one of the preceding claims, characterized in that the first control device (2) and the second control device (3), in particular mutually, exchange availability information (21, 22), wherein the second control device (3) assumes that the first control device (2) has failed if the availability information (21, 22) does not indicate availability and / or no availability information (21, 22) is received.

8. Braking system according to one of the preceding claims, characterized in that the second arbitration unit (10) is set up to transmit the result of the arbitration to the driver (15) of the second control device (3) for driving the at least one parking brake actuator (5) if the first control device (2) fails.

9. Braking system according to one of the preceding claims, characterized in that at least one parking brake actuator (4, 5) is connected in a driveable manner to the first and the second control device (2, 3), wherein the first and the second control device (2, 3) are set up to transfer the authorization to drive the parking brake actuator (4, 5) that is connected in a driveable manner to the first and the second control device (2, 3) by exchanging a token (21, 22).

10. Braking system according to Claim 9, characterized in that, during a switch-on process, the first or the second control device (2, 3) receives the token (21, 22) which authorizes driving of the parking brake actuator (4, 5) that is connected in a driveable manner to the first and the second control device (2, 3), and the other control device (3, 2) does not receive a token (21, 22).

11. Braking system according to Claim 9 or 10, characterized in that the first and / or the second control device (2, 3) are / is set up to drive the parking brake actuator (4, 5) only when the control device (2, 3) itself has the token (21, 22) and the other control device (3, 2) does not have the token (21, 22).

12. Braking system according to one of the preceding claims, characterized in that four wheel speed sensors (23) are provided, which are each associated with one of four wheels of the motor vehicle, wherein the first or the second control device (2, 3) receives data from all four wheel speed sensors (23) and the other control device receives data from only two wheel speed sensors (23).

13. Braking system according to Claim 12, characterized in that a multiplexer (24) is provided for the data from two wheel speed sensors (23), which multiplexer, if there is no fault, feeds the data from the two wheel speed sensors (23) to the control device (2, 3) that receives data from all four wheel speed sensors (23) and, only if this control device (2, 3) fails, feeds the data from the two wheel speed sensors (23) to the control device (2, 3) that receives data from only two wheel speed sensors (23).

14. Braking system according to Claim 13, characterized in that the two wheel speed sensors (23) of the multiplexer (24) are associated with wheels arranged diagonally in relation to one another.

15. Method for controlling a braking system (1) with two parking brake actuators (4, 5) and two control devices (2, 3), wherein a first arbitration unit (9) of the first control device (2) receives first parking brake request data (11a) and ascertains from the received first parking brake request data (11a) whether a parking brake action should be carried out, and a second arbitration unit (10) of the second control device (3) receives second parking brake request data (11b) and ascertains from the received second parking brake request data (11b) whether a parking brake action should be carried out, wherein a result of the second arbitration unit (10) is fed to the input end of the first arbitration unit (9) as part of the first parking brake request data (11a) and wherein a result of the first arbitration unit (9) is transmitted to a driver (14, 15) of the first and / or the second control device (2, 3) for driving the first and / or the second parking brake actuator (4, 5).