ENHANCED OPERATING SAFETY BRAKING SYSTEM

Abstract

A braking system for a motor vehicle comprising at least two electrically actuated parking brakes (FP1, FP2), each intended to be positioned at a wheel, means for controlling the parking brakes, and at least two parking brake control units (ECU1, ECU2), each control unit (ECU1, ECU2) being configured to control at least one parking brake upon receiving an instruction from the control means and, in the event of a failure of one of the control units, to control both parking brakes (FP1, FP2). [Fig. 4]

Description

Title of the invention: BRAKING SYSTEM WITH ENHANCED OPERATIONAL SAFETY TECHNICAL FIELD AND PREVIOUS ART

[0001] The present invention relates to the braking system of a motor vehicle with enhanced operational safety

[0002] Motor vehicles are equipped with a braking system comprising a brake at each wheel.

[0003] The braking system provides service braking, which allows the vehicle to slow down and / or stop. Service braking is generally activated by pressing a brake pedal. Service braking can be managed automatically by a control unit, for example, when automatic speed control is desired.

[0004] The braking system also provides parking braking, which is intended to immobilize the vehicle when parked. The parking brake can also be used as an emergency brake. In accordance with ECE Regulation R 13-H, the parking braking system must keep the loaded vehicle stationary on an 8% incline.

[0005] Generally, the braking system includes a parking brake on each rear wheel. The parking brake is usually integrated into the service brake.

[0006] Until recently, the parking brake was operated by the driver who pulled on a brake lever connected directly to the rear wheel brakes by a cable; the greater the pull, the greater the level of parking braking.

[0007] Increasingly, the parking brake is activated by pressing a button which sends a signal to the control unit, which then activates electric motors located at the rear wheels. The electric motor ensures that either the brake pads are pressed against a brake disc in the case of a disc brake, or the brake linings are pressed against a drum in the case of a drum brake.

[0008] The prior art braking system includes an electronic control unit or ECU (Electronic Control Unit in Anglo-Saxon terminology) integrating a parking brake controller, which controls the two electric parking brakes.

[0009] In the event of a malfunction of the electronic control unit, the electric parking brakes can no longer be operated. The driver is alerted and must immediately take their vehicle to a mechanic for inspection. Description of the invention

[0010] It is therefore an object of the present application to provide a braking system comprising at least two electric parking brakes with increased operational safety.

[0011] The stated purpose above is achieved by a motor vehicle braking system comprising at least two electric parking brakes and two electronic control units, each electronic control unit being configured to manage at least one electric parking brake in an operating mode.

[0012] In the present application, "manage" means to control the activation of the parking brake according to a control signal, for example provided by the actuation of a control button.

[0013] Thanks to the invention, in the event of failure of one of the electronic control units, the braking system includes a functional electronic control unit to manage at least one of the electric parking brakes.

[0014] The invention offers an increased level of safety suitable for new vehicles. It results from the implementation of two electronic control units

[0015] In one embodiment, each control unit independently controls a single electric parking brake.

[0016] In another embodiment, each control unit is capable of managing both electric parking brakes in the event of a failure of the other control unit. In one embodiment, under normal operating conditions, each control unit manages one parking brake. In another embodiment, one of the control units manages both parking brakes under normal operating conditions.

[0017] Very advantageously, the two control units communicate with each other, which allows each control unit to know the operating state of the other control unit and thus allows the braking system to change its operating mode to compensate for the malfunction of the other control unit.

[0018] Preferably, means are provided to isolate the faulty control unit and thus avoid the superposition of signals emitted by the faulty unit and the unit which manages the two parking brakes as a backup.

[0019] The present invention relates to a braking system for a motor vehicle comprising at least two electrically actuated parking brakes, each intended to be positioned at a wheel, and control means for the parking brakes, at least two parking brake control units, each control unit being configured to control at least one parking brake upon receiving an instruction from the control means, and in case of failure of the other control unit to control at least one of the parking brakes upon receiving an instruction from the control means.

[0020] In one embodiment, each control unit includes software for controlling a parking brake, the software of the two control units being identical.

[0021] Each control unit can be configured to control a single parking brake and the software environment can be configured so that the instructions issued by each software are transmitted only to the associated parking brake.

[0022] Alternatively, each control unit is configured to control a single parking brake, and the software environment is configured so that the parking brake, which is not controlled by said software, is declared for said software as unavailable.

[0023] In another embodiment, each control unit is configured to control both parking brakes, said system comprising means of communication between the two control units, so that each of the control units is informed of the operating status of the other control unit.

[0024] Advantageously, the means of communication are configured to establish the periodic sending of messages between the two control units.

[0025] The first control unit can be configured to control both parking brakes and the second control unit can be configured to control both parking brakes, when the first control unit is considered to be faulty.

[0026] Alternatively, the first control unit is configured to control one parking brake and the second control unit is configured to control the other parking brake, and each of the control units is configured to control both parking brakes when the other control unit is considered to be faulty.

[0027] For example, each control unit includes a first electrical connection to one of the parking brakes that it controls in normal operation, and the braking system includes switching means, so as to establish a second electrical connection between the non-faulty control unit and the electric parking brake normally controlled by the faulty control unit.

[0028] Preferably, the braking system includes means for isolating the faulty control unit.

[0029] The means of communication may include a private multiplexing network of the LIN bus, CAN bus, SPI bus or I2C bus type.

[0030] The present invention also relates to a method of operating a braking system according to the invention:

[0031] - in normal operation each control unit controls a parking brake, and an exchange of information is established between the first control unit and the second control unit so that each control unit is informed of the operating status of the other control unit,

[0032] - in the event of failure of one of the control units, the other control unit controls both parking brakes.

[0033] The present invention also relates to a method of operating a braking system according to the invention, in which:

[0034] - in normal operation the first control unit controls both brakes parking, and an exchange of information is established between the first and second control units so that each control unit is informed of the operating status of the other control unit,

[0035] - in the event of failure of the first control unit, the second unit of The control operates both parking brakes. BRIEF DESCRIPTION OF THE FIGURES

[0036] The following description will be better understood with the aid of the attached drawings, in which: - [[Fig.1]] is a schematic representation of a motor vehicle equipped with a braking system, - [Fig.2] is a schematic representation of an example of an embodiment of the control part of the parking brake system according to the first embodiment, - [Fig.3] is a schematic representation of another example of an embodiment of the control part of the parking brake system according to the first embodiment, - [Fig.4] is a schematic representation of the connection between the control units and the parking brakes according to the second embodiment. - [Fig. 5] is a schematic representation of an example of an embodiment of the parking brake system control section according to a second embodiment. - [Fig. 6] is a schematic representation of another example of an embodiment of the parking brake system control section according to the second embodiment. DETAILED DESCRIPTION OF EMBODIMENTS

[0037] In the description that follows, the activation of a parking brake and the activation of the parking brake actuator are synonymous.

[0038] In the present application, "normal operation" or "normal state" of the braking system means a state in which both control units are functional and can safely control the parking brake(s).

[0039] The term "failure operation" or "failure state" of a control unit means a state in which a control unit is considered no longer capable of safely controlling the parking brake(s).

[0040] In [Fig.1], we can see a vehicle V, represented schematically, comprising a braking system S including brakes F equipping each wheel.

[0041] Hydraulic brakes generally provide service braking. Alternatively, the service brake and parking brake are electric brakes. For example, an electric brake provides both service and parking braking for at least one axle.

[0042] The braking system also includes a parking braking device comprising at least a first parking brake FP1 at the right rear wheel and a second parking brake FP2 at the left rear wheel.

[0043] The FP1 and FP2 parking brakes are electric parking brakes.

[0044] Advantageously the parking brake is integrated into the service brake.

[0045] Each electric parking brake includes an actuator equipped with an electric motor and means for converting the rotational movement of the electric motor into a translational movement applying the brake pads against the brake disc or the brake linings against the drum.

[0046] The braking system advantageously includes an ABS and / or ESP (slip control and / or trajectory control) computer.

[0047] According to the invention, the braking system comprises two electronic control units or ECUs (Electronic control unit in Anglo-Saxon terminology) ECU1 and ECU2, also referred to as microcontrollers, intended in particular to control the actuation of the parking brakes FP1 and FP2.

[0048] In one embodiment, the two control units may belong to a central vehicle control unit.

[0049] Figure 2 shows an example according to a first embodiment of the control part of a parking braking system of an SL braking system

[0050] The braking system SI also includes means C providing information on the right and left rear wheels, for example, one or more sensors (WSS or Wheel Speed ​​Sensor), whose signals are transmitted to the control units. Furthermore, it includes means B for controlling the parking brakes. In one example, this is a button or lever in the passenger compartment operated by the user, through which the user sends a command to activate the parking and / or emergency braking. Activation is then manually controlled. In another example, activation is automatic and is triggered, for example, when the ignition is switched off.

[0051] Each ECU1, ECU2 control unit includes software for controlling and managing the parking brake actuators or controllers, designated SFW1, SFW2 respectively.

[0052] In addition, each ECU1, ECU2 control unit includes an interface software SFWT, SFW2' which manages the parking brake application control information and transmits it to the SFW1, SWF2 software respectively.

[0053] According to the first embodiment, in normal operation each control unit ECU1, ECU2 manages a parking brake independently.

[0054] In this example, the ECU1 control unit manages the parking brake of the right rear wheel and the ECU2 control unit manages the parking brake of the left rear wheel.

[0055] In this example, the SFW1 and SFW2 control software are identical, and in this example, the SFW1 and SFW2 software are configured to activate the parking brake of the right rear wheel respectively left.

[0056] Each SFW 1 and SFW2 software includes several input ports and several output ports.

[0057] In the example of [Fig. 2], each software program has an input port INI that transmits information relating to the right wheel, and an input port IN2 that transmits information relating to the left wheel. Each software program also has an input port IN3 that receives the parking brake activation / deactivation instructions provided by the software SFW1', SFW2', and an input port IN4 for information on the power consumption of the right rear wheel parking brake actuator motor and an input port IN5 for information on the power consumption of the right rear wheel parking brake actuator motor. It will be understood that the software programs may have other input ports.

[0058] Each software also includes an output port OUT1 for controlling the right wheel parking brake actuator and an output port OUT2 for controlling the left wheel parking brake actuator, and an output port OUT3 for the activation status of the parking brake system.

[0059] In this embodiment, the input port IN5 and the output port OUT2 of the SFW 1 and SFW2 software, which are configured for the control of the right parking brake, are disabled.

[0060] Furthermore, the SFW1 software receives information on the right and left wheels supplied to ports INI and IN2 and, from this information and the order to activate or deactivate the right parking brake supplied on port IN3, generates instructions to the right parking brake.

[0061] The SFW2 software is intended to control the left parking brake. In order for the SFW2 software to send correct instructions to the left parking brake, the Information on inputs INI and IN2 is swapped, so that INI receives information about the left wheel and IN2 receives information about the right wheel. The resulting instructions will therefore be adapted to the left parking brake.

[0062] In this example, the SFW1 and SFW2 software programs are capable of managing both parking brakes but are only used for one parking brake. It is therefore possible to use existing software implemented in a control unit that manages two parking brakes. Alternatively, the software programs are written to manage only one brake, in which case their size is reduced.

[0063] An example of the operation of the SI braking system will now be described.

[0064] In normal operation, when the user applies a braking command When the parking brakes are engaged, both electric parking brakes are activated. For example, the user presses button B located in the passenger compartment, and a command is sent to the two control units, ECU1 and ECU2. This instruction, via the SFW1' and SFW2' software, is sent to the IN3 input of each of the SFW1 and SFW2 software programs. Furthermore, the software programs receive information from the right and left wheels at the INI and IN2 inputs. From this data, a command is generated and sent by each software program to each brake actuator via the OUT2 output port.

[0065] Information about the electrical current value in the motor of each actuator is sent to the software via input port IN4, allowing the software to determine whether the parking brake is engaged or not. This information is returned via output port OUT2 to the SFW1', SFW2' software, which informs the user that the parking brake is active, for example, by means of an indicator light.

[0066] When a parking brake command is sent to both control units and a failure occurs in control unit ECU1, no instruction is sent to the right-hand wheel parking brake. Control unit ECU2 functions normally and activates the left-hand parking brake. Conversely, if control unit ECU2 fails, the left-hand parking brake is not activated. If control unit ECU1 functions normally, the right-hand parking brake is activated.

[0067] According to an advantageous embodiment, the SI braking system includes means of communication between the two control units so that each control unit is informed of the failure of the other control unit and that the non-failing control unit can possibly adapt its control and the clamping force applied by the parking brake that it manages.

[0068] Each parking brake being configured to ensure the immobilization of the vehicle on its own, according to this example, by activating only one parking brake the immobilization of the vehicle is ensured.

[0069] Thanks to the invention, in the event of failure of one of the control units, the immobilization of the vehicle is ensured and the safety of the occupants of the vehicle and of the people around is ensured.

[0070] The user is unaware that only one of the parking brakes is engaged and that one of the control units is faulty. A message indicating the fault of one of the control units can be sent to the user in the form of a warning signal requesting that a check be carried out at a garage. Alternatively, the vehicle can be immobilized until a garage check has been performed.

[0071] Alternatively and preferably, it is planned to check the operating status of the control units upon restart and if no fault is detected, the braking system is considered functional and the user can use their vehicle normally.

[0072] In [Fig.3], another example of the control part of the parking brake system of a braking system S2 can be seen according to the first embodiment.

[0073] The two control software programs SFW1 and SFW2 are identical. They are configured to be able to control both parking brakes.

[0074] In this example, the interface software SFW1', which cooperates with the SFW1 software controlling the right parking brake actuator, is configured to inform the SFW1 software that the left parking brake actuator is unavailable. This information, designated UNVL, is provided to the SFW1 software via an input port IN4. Thus, the SFW1 software only controls the right parking brake actuator.

[0075] Similarly, the interface software SFW2', which cooperates with the SFW2 software controlling the left parking brake actuator, is configured to inform the SFW2 software that the right parking brake actuator is unavailable. This information, designated UNVR, is provided to the SFW2 software via an input port IN4. Thus, the SFW2 software only controls the left parking brake actuator.

[0076] In this example all outputs OUT1 and OUT2 to the actuators are active, however only the outputs corresponding to the brake declared as available by the software SFW1' or SFW2' are used.

[0077] The operation of the braking system is similar to that of the S2 system.

[0078] In this first embodiment, if one of the control units fails, only one of the parking brakes is activated. Each parking brake can, on its own, immobilize the vehicle on a slope, for example, up to 8%. However, certain dynamic safety functions, which are only available when both parking brake actuators are operational, are not available.

[0079] The SI and S2 braking systems have the advantage of using the same software to control the parking brake actuators. However, a braking system in which each software program is adapted to control either the left or the right parking brake would not fall outside the scope of the present invention.

[0080] In addition, since the control units are intended to manage only one parking brake, their computing power can be reduced compared to control units that continuously manage two parking brakes.

[0081] Furthermore, since in normal operation each parking brake is controlled by its own control unit, there is no delay between the start of the right parking brake motor and the left parking brake motor.

[0082] Figure 4 shows a schematic representation of the connections between the control units and the parking brakes according to a second embodiment. In this second embodiment, the control units ECU 1 and ECU 2 are such that they can control both parking brakes simultaneously. The braking system according to the second embodiment has an H-shaped connection structure between the two control units and the two parking brakes, the connections being operational depending on the operating state of each of the control units.

[0083] The S3 parking braking system further includes communication means 2 between the two control units, enabling each control unit to know the operating status of the other control unit. Thus, control unit ECU2 is directly informed of a failure of control unit ECU1 and can take over.

[0084] Conversely, if the ECU1 control unit is informed of a failure of the ECU2 control unit, it can emit a preventive warning signal.

[0085] The means of communication 2 between the two control units are for example a private multiplexing network of the type Local Interconnected Network or LIN bus (Local Interconnect Network in Anglo-Saxon terminology), a CAN bus (Control Area Network in Anglo-Saxon terminology), a synchronous serial data bus or SPI bus (Serial Peripheral Interface in Anglo-Saxon terminology) or I2C bus (Inter-Integrated Circuit in Anglo-Saxon terminology).

[0086] The means of communication ensure a periodic exchange of messages between the control units allowing a periodic verification of the operating status of the two control units.

[0087] The braking system preferably includes switching means 4 to bypass the faulty control unit and allow the other control unit to manage the actuators.

[0088] As with the first embodiment, the SFW1 and SFW2 control software are advantageously identical.

[0089] Preferably, the braking system according to the second embodiment includes means 6 for isolating the faulty control unit and preventing instructions issued by the faulty control unit from overlapping with instructions issued by the replacement control unit. For example, the isolation means include an isolation switch, advantageously a transistor, and even more advantageously a MOSFET transistor.

[0090] In [Fig.5], we can see an example of the control part of a parking braking system of an S3 braking system according to a second embodiment also comprising two control units ECU 1 and ECU2.

[0091] The S3 parking brake system is configured so that one of the ECU1 control units manages the parking brakes under normal operating conditions, and in the event of a failure of ECU1, ECU2 takes over and manages both parking brakes. One of the control units thus forms a backup control unit.

[0092] An example of the operation of the S3 braking system will now be described.

[0093] Under normal operating conditions, the ECU1 control unit is considered to be functioning. When the user presses the parking brake button, the command is sent to the SFW1' interface software, which forwards the request to the SFW1 control software for the left and right wheel brake actuators. The brake actuators are activated, and feedback is sent to the SFW1 software, which informs the SFW1' software, which then sends a signal to the user, for example, by illuminating an indicator light.

[0094] In [Fig.5], the cross symbolizes the fact that in normal operation only the ECU1 control unit controls the parking brakes.

[0095] Periodically, the two control units ECU1 and ECU2 communicate with each other, allowing each to know the operating status of the other control unit. This communication also takes place outside of braking phases.

[0096] If a fault occurs in the ECU1 control unit, the ECU2 control unit takes control and ensures the activation of both parking brake actuators and the ECU1 control unit is isolated to prevent signals from being sent to the actuators by both the ECU2 and ECU1 control units.

[0097] This embodiment has the advantage of fully ensuring braking safety, since even in the event of a failure, parking braking by both parking brakes is ensured normally. However, it presents a large number of connections due to the connection between each control unit and the two parking brakes and between the two control units.

[0098] An alert signal can be sent to the user informing them of the failure of the ECU1 unit.

[0099] Preferably, during a restart if the failure of the ECU1 control unit is no longer detected, the braking system resumes its initial configuration, and it is the ECU1 control unit that controls the parking brake.

[0100] If the failure of the ECU1 control unit persists, an information message may be sent to the user requesting that a brake system check be carried out.

[0101] In [Fig.6], another example of the control part of a parking brake system of a braking system S4 can be seen according to the second embodiment which differs from the system S3 in that in normal operating mode, each control unit ECU1, ECU2 controls one parking brake, and in failure mode of one of the control units ECU1, ECU2, the other control unit controls both parking brakes.

[0102] In normal operation, both control units ECU1 and ECU2 function normally. When the user presses the parking brake button, the command is sent to software SFW1' and SFW2', which forward the request to software SFW1 and SFW2, respectively, which control the brake actuators for the left and right wheels. The brake actuators are activated, and feedback is sent to software SFW1 and SFW2, which inform software SFW1' and SFW2'. These, in turn, send a signal to the user, for example, by illuminating an indicator light. The operation of control units ECU1 and ECU2 without fault is similar to that shown in Figures 2 and 3. In [Fig. 6], crosses symbolize the fact that in normal operation, the control units only control one brake.

[0103] Periodically, the two control units ECU1 and ECU2 exchange data, allowing each to know the operating status of the other control unit, i.e., whether it is available or unavailable. This communication also occurs outside of braking phases. Information exchanges take place, for example, every 10 ms. For instance, in the case of CAN communication between the control units, a data transfer rate of 500 kbps can be established.

[0104] If a failure occurs in either of the ECU1, ECU2 control units, the other control unit takes control of both brake actuators and manages the actuation of the parking brake actuators, and the faulty control unit is isolated to prevent signals from being sent to the actuators by both the ECU2 and ECU1 control units.

[0105] The S4 braking system has the advantage of ensuring complete braking safety, since even in the event of a failure, parking braking by the two parking brakes is maintained normally. However, it has a large number of connections due to the connection between each control unit and the two parking brakes, and between the two control units themselves.

[0106] Furthermore, since in normal operation each parking brake is controlled by its own control unit in the S4 system, there is no delay between the start of the right parking brake motor and the left parking brake motor.

[0107] The second embodiment has the advantage of maintaining all safety functions, both static and dynamic, since both parking brakes are normally activated even if one of the control units fails. Furthermore, it has the advantage of preventing the vehicle from becoming immobilized, as it allows the parking brakes to be released even if one of the control units is faulty.

[0108] A braking system comprising four electric parking brakes does not fall outside the scope of the present invention. In one example, the braking system comprises two control units, each controlling and managing two electric parking brakes, and in the event of a failure of one of the control units, the braking system is configured so that the other control unit manages only two parking brakes in a manner similar to the first embodiment, or controls all four parking brakes in a manner similar to the second embodiment.

[0109] The present invention applies equally to hydraulic service brakes equipped with an electric parking brake EPB (or electrical parking brake in Anglo-Saxon terminology) and to electric brakes providing service and / or parking braking EMB (or electro-mechanical brake in Anglo-Saxon terminology).

[0110] In the case of autonomous vehicles, i.e. a motorized vehicle capable of operating without human intervention, the information of failure of one of the control units is sent to the central controller of the vehicle which will make a decision to emit a signal and / or to immobilize the vehicle. References

[0111] 2: means of communication 4: Switching means 6: means of insulation C: means of providing information; V: vehicle S, SI, S2, S3, S4: braking systems F: brakes FP1: First parking brake FP2: Second parking brake ECU1, ECU2: Electronic control units B: control methods SFW1, SFW2: Control and management software SFW1', SFW2': interface software INI, IN2, IN3, IN4, IN5: input ports 0UT1, 0UT2, 0UT3: output port UN VL: Left parking brake unavailable information. UNVR: Right parking brake unavailable information.

Claims

Demands

1. A motor vehicle braking system comprising at least two electrically actuated parking brakes (FP1, FP2) intended to be positioned at each wheel, parking brake control means, at least two parking brake control units (ECU1, ECU2), each control unit (ECU1, ECU2) being configured to control at least one parking brake upon receiving an instruction from the control means, and in the event of failure of the other control unit to control at least one of the parking brakes upon receiving an instruction from the control means, wherein each control unit (ECU1, ECU2) comprises a parking brake control software (SFW1, SFW2) and wherein the software (SFW1, SFW2) of the two control units (ECU1, ECU2) are identical.

2. Braking system according to claim 1, wherein each control unit (ECU1, ECU2) is configured to control a single parking brake (FP1, FP2), and wherein the software environment is configured so that the instructions issued by each software (SFW1, SFW2) are transmitted only to the associated parking brake.

3. Braking system according to claim 1, wherein each control unit (ECU1, ECU2) is configured to control a single parking brake (FP1, FP2), and wherein the software environment is configured so that the parking brake, which is not controlled by said software, is declared for said software as unavailable.

4. Braking system according to claim 1, wherein each control unit (ECU1, ECU2) is configured to control the two parking brakes (FP1, FP2), said system comprising communication means (2) between the two control units (ECU1, ECU2), such that each of the control units (ECU1, ECU2) is informed of the operating state of the other control unit (ECU2, ECU1).

5. A braking system according to the preceding claim, wherein the communication means (2) are configured to establish the periodic sending of messages between the two control units (ECU1, ECU2).

6. Braking system according to claim 4 or 5, wherein the first control unit (ECU1, ECU2) is configured to control both parking brakes (FP1, FP2) and wherein the second control unit is configured to control both parking brakes, when the first control unit is considered to be faulty.

7. Braking system according to claims 4 and 5, wherein the first control unit is configured to control one parking brake and the second control unit is configured to control the other parking brake, and wherein each of the control units is configured to control both parking brakes when the other control unit is considered to be faulty.

8. Braking system according to claim 7, wherein each control unit has a first electrical connection to one of the parking brakes which it controls in normal operation, and wherein the braking system has switching means (4), so as to establish a second electrical connection between the non-faulty control unit and the electric parking brake normally controlled by the faulty control unit.

9. Braking system according to any one of claims 4 to 8, wherein the braking system comprises means for isolating the faulty control unit.

10. Braking system according to any one of claims 4 to 9, wherein the communication means (2) comprise a private multiplexing network of the LIN bus, CAN bus, SPI bus or I2C bus type.

11. Method of operating a braking system according to claim 7: - in normal operation each control unit controls one parking brake, and an exchange of information is established between the first control unit and the second control unit so that each control unit is informed of the operating state of the other control unit, - in the event of failure of one of the control units, the other control unit controls both parking brakes.

12. A method of operating a braking system according to claim 6, wherein: - in normal operation the first control unit controls both parking brakes, and an exchange of information is established between the first and second control units so that each control unit is informed of the operating state of the other control unit, - in the event of failure of the first control unit, the second control unit controls both parking brakes.

Images