Method for operating a brake system and brake system

Abstract

The invention relates to a method for operating a brake system (1) with a primary brake actuator (2) with a first control device (15) and a secondary brake actuator (3) with a second control device (16), the primary brake actuator (2) being driven starting from a first brake setting (6a, 11a). The first control device (15) and the second control device (16) and / or further control device (10, 21) are connected to each other via a communication means (7). With the second control device (16) and / or further control device (10, 21) it is checked whether a signal from the first control device (15) is received at the second control device (16) and / or further control device (10, 21) or whether a signal received at the second control device (16) and / or further control device (10, 21) from the first control device (15) has an error. If the signal is missing or erroneous, actuation of the secondary brake actuator (3) based on the second brake setting (6b, 11b) is disengaged or prevented (FIG. 1).

Description

[Technical Field]

[0001] Background technology German Patent Application No. 102009001135 discloses a method for operating a hydraulic vehicle brake system with an electromechanical brake booster and a wheel slip controller. The invention proposes operating the vehicle brake system by means of the brake booster in situations where the brake pedal is not operated, for example to limit the vehicle speed or to regulate the distance to a vehicle traveling ahead, or when parking. [Prior art documents] [Patent documents]

[0002] [Patent Document 1] German Patent Application Publication No. 102009001135 Summary of the Invention [Problem to be solved by the invention]

[0003] Disclosure of the Invention The present invention relates to a method for operating a brake system comprising a primary brake actuator with a first control device and a secondary brake actuator with a second control device, both of which are driven starting from a first brake setting. [Means for solving the problem]

[0004] The first control device and the second and / or further control device are connected to each other via a communication means. The second and / or further control device is used to check whether the second and / or further control device has received a signal from the first control device or whether the signal received by the second and / or further control device from the first control device has an error. If the signal from the first control device is missing or has an error, the actuation of the secondary brake actuator based on the second brake setting is released or prevented.

[0005] This has the advantage that in a by-wire brake system including a first brake pressure generator, such as an electrically operated plunger or brake booster, and a second brake pressure generator, such as a hydraulic assembly known as an ESP assembly, the interaction of the two brake pressure generating units is optimized. It is particularly important here that the two units can communicate with each other and that there is an appropriate fallback level if such communication is not possible or should be disabled, so that the vehicle can still be adequately braked. This improves the safety of the brake system. This is especially important in by-wire brake systems that do not provide a mechanical-hydraulic fallback level based on driver braking force for driver braking. If a communication problem is identified, the activation of the secondary brake actuator can be intentionally released or prevented. This allows for situation-specific operation of the two brake actuators.

[0006] In the present invention, the primary brake actuator is driven based on a first brake pressure setting via a first characteristic curve corresponding to the relationship between the first brake pressure setting and the internal control variable to be adjusted in the primary brake actuator, in particular the rod travel, transmission power, or motor current. The fact that the primary brake actuator can be driven based on a first brake pressure setting and the secondary brake actuator can be driven based on a second brake pressure setting has the advantage that, even in the event of a communication failure, the two brake actuators can be used based on their respective directly supplied brake pressure settings, and that the respective brake pressure settings can be used if the communication system fails or if the signal is erroneous. This increases the overall availability of the brake actuators and results in more reliable implementation of the brake pressure settings and thus redundancy of the brake system.

[0007] In another feature of the method, an error detection is performed using the second control device and / or another control device, and a corresponding alternative reaction is initiated. Error detection can individually omit a response to a detected communication problem. If it is determined during error detection that the primary brake actuator is still fault-free, there is no need to stop the activation of the primary brake actuator, which is provided for normal pressure generation, since there is a communication failure. However, if error detection reveals a problem with or around the primary brake actuator, the secondary brake actuator can be additionally utilized in a manner appropriate to the situation.

[0008] Advantageously, for error detection, the brake pressure adjusted by the primary brake actuator based on the first brake setting is read in by the second control device or by another control device. The read-in brake pressure is used by the second control device or by another control device to perform a plausibility check of the brake pressure for the second brake setting present in the second control device or by another control device. This has the advantage that the plausibility check of the pressure generated by the primary brake actuator based on the first brake setting can be performed by the secondary brake actuator based on the second brake setting received therein. This makes it possible to cope with communication failures.

[0009] In a further advantageous embodiment of the method, the plausibility check can be carried out on the basis of a second characteristic curve and / or a characteristic map that defines the relationship between the brake pressure and the second brake setting. By providing a characteristic curve that allows the target brake pressure to be achieved independently of the first brake setting by means of a second brake setting in the secondary brake actuator or in a separate brake control device, fault safety is increased.

[0010] In another configuration, the first and second brake settings are identical. In particular, the first and second brake settings are derived from the same source. This has the advantage that the first and second brake settings are identical quantities, but are supplied in duplicate in different paths of independent brake actuators. The reliability of the brake system can therefore be increased by appropriate validation.

[0011] Furthermore, it is advantageous if the pressure or expected pressure is not identified during the plausibility check, a first error state is set in the scope of the error identification, indicating a defect in the primary brake actuator. Thus, an error around the primary braking coefficient can be associated based on the execution of a plausibility check whether there is no pressure or whether there is an insufficient pressure.

[0012] Furthermore, the first error condition can additionally indicate an error in the environment of the communication means or an error in the communication device of the primary brake actuator, which allows not only to identify a defective primary brake actuator but also to confirm the first error condition that the communication means is not functioning.

[0013] In an advantageous configuration, if no pressure is identified within the plausibility check, the secondary brake actuator's actuation is released as an alternative reaction (304) based on the second brake setting (6b, 11b) by the secondary brake actuator taking over the brake pressure regulation completely. Alternatively, the secondary brake actuator's actuation is released as an alternative reaction by at least partially taking over the brake pressure regulation if no expected pressure is identified, in particular if no expected pressure is identified within the tolerance range of the characteristic curve between pressure and brake setting. This allows the secondary brake actuator's actuation as an alternative reaction to always be released to the required extent.

[0014] In another embodiment, if the validation check identifies an expected pressure, in particular an expected pressure within the tolerance range of the characteristic curve between pressure and brake setting, then within the scope of the error detection a second error state is set, indicating an error in the communication means (7). This has the advantage that it is also possible to identify that the error is due to a communication problem only, while the primary brake actuator is still functional.

[0015] In an advantageous configuration, the pressure regulation by the secondary brake actuator is prevented in this case as a fallback reaction, and the pressure regulation by the primary brake actuator continues, so that the operation of the primary brake actuator to generate braking pressure as normal can continue. The secondary brake actuator does not take over in this situation.

[0016] The invention further relates to a braking system comprising a primary brake actuator with a first control device and a secondary brake actuator with a second control device, and further comprising a further control device, the control device being configured to perform the method according to any one of claims 1 to 11.

[0017] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a schematic diagram showing a brake system. [Figure 2] FIG. 2 shows characteristic curves used in a braking system. [Figure 3] 1 is a flowchart illustrating a method. [Figure 4] FIG. 10 illustrates two pressure-volume relationships for the primary brake actuator. DETAILED DESCRIPTION OF THE INVENTION

[0019] Embodiments of the invention FIG. 1 shows a schematic diagram of a vehicle brake system 1. The brake system 1 comprises a primary brake actuator 2 and a secondary brake actuator 3. The primary brake actuator 2 can be, for example, an electromechanical brake actuator 2 that can generate braking pressure in the vehicle's wheel brakes using hydraulic fluid. The electromechanical brake actuator 2 can also be provided in the form of an electromechanical brake booster device. The primary brake actuator 2 can also be understood as an electrically operated plunger piston that can also generate braking pressure in the connected wheel brakes. Unlike a brake booster, in such a plunger system, the electrically operated plunger and the driver do not simultaneously operate the wheel brakes, at least during normal operation. Rather, the driver generates a brake setting / demand by applying a load to a pedal simulator, which then realizes this brake setting in the wheel brakes via the electrically operated plunger.

[0020] The hydraulic pressure can be generated, for example, in a master brake cylinder of a braking system of a motor vehicle. A secondary brake actuator 3 is usually arranged hydraulically downstream of such a master brake cylinder. Such a secondary brake actuator 3 can be, for example, the hydraulic mechanism of a brake pressure modulation unit. A brake pressure modulation unit can be understood to be, for example, an ESP system.

[0021] The brake system 1 is capable of providing both driver-dependent and driver-independent braking pressure.

[0022] If the brake settings 11a, 11b are driver-independent, they are formed by a system 10 of the vehicle. In this case, a system-specific braking request is usually realized. Examples of such systems are, in particular, a hill-climbing assistance system, a traffic jam assistance system or an autonomous driving system. However, a braking operation by the driver, for example via the brake pedal, can also be taken into account, although this is not directly converted into a braking action. The system 10 here can be a system 10 arranged in parallel to the brake system 1, for example a driver assistance system with appropriate distance and environment detection sensor devices, or a higher-level system 10, for example a vehicle overall control system which includes the brake system and the driver assistance system or is connected to and communicates with the brake system and the driver assistance system via communication means.

[0023] If the brake settings 6a, 6b are driver-dependent, the brake pressure provided by the primary brake actuator 2 or the brake pressure provided by the secondary brake actuator 3 depends on the driver's operation of an operating element 4, for example the brake pedal 4, which is then converted into a corresponding brake pressure by means of the primary brake actuator 2 and / or the secondary brake actuator 3. The driver's brake demand settings 6a, 6b can also be effected via other operating elements 4, such as a jog dial, a slider or a lever.

[0024] The brake setting via the operating element 4 may be in the form of a magnitude of the actuation of the operating element 4 by the driver and is calculated by the control unit 5 by means of a suitable sensor device. The quantity for calculating the driver setting may be, for example, a displacement distance and / or an actuation force. The quantity for calculating the driver setting may also be a quantity derived from the displacement distance and / or the actuation force or a quantity that can be derived from the displacement distance and / or the actuation force.

[0025] The control unit 5 transfers the driver-dependent braking settings to the controllers 15 and 16 of the primary brake actuator 2 and the secondary brake actuator 3, respectively, i.e. in the form of a driver setting 6a to the controller 15 of the primary brake actuator 2 and in the form of a driver setting 6b to the controller 16 of the secondary brake actuator 3. The braking settings 6a and 6b are identical quantities and are supplied to each of the primary brake actuator 2 and the secondary brake actuator 3 for redundancy purposes.

[0026] The further system 10 transfers driver-independent brake settings 11a and 11b to the respective controllers 15, 16 of the primary brake actuator 2 and the secondary brake actuator 3, i.e. in the form of a driver setting 11a to the controller 15 of the primary brake actuator 2 and in the form of a driver setting 11b to the controller 16 of the secondary brake actuator 3. The brake settings 11a and 11b are also identical quantities and are supplied to each of the primary brake actuator 2 and the secondary brake actuator 3 for redundancy purposes.

[0027] Both the case of driver-dependent braking settings 6a, 6b and the case of driver-independent braking settings 11a, 11b will be referred to below as braking settings.

[0028] The control device 15 of the primary brake actuator 2 and the control device 16 of the secondary brake actuator 3 are connected to each other via a communication system 7, for example a communication bus 7. Via such a communication system 7, the involved brake actuators 2, 3 can directly exchange signals with each other. Here, for example, the primary brake actuator 2 can directly transmit an error condition 8 to the secondary brake actuator 3. If the primary brake actuator 2 transmits the error condition 8 to the secondary brake actuator 3, for example, the secondary brake actuator 3 can take over and / or continue the braking that was previously performed by or with the primary brake actuator 2. This function is also referred to as hydraulic boost compensation (HBC). Here, the brake settings 6a, 11a present in the primary brake actuator 2 can also be transmitted to the secondary brake actuator 3 via the communication system 7, so that the secondary brake actuator 3 can take over the brake pressure adjustment accordingly.

[0029] However, if communication via the communication system 7 is interrupted or an error occurs in this communication, the braking settings can no longer be reliably transferred along this path.

[0030] For this purpose, the control device 16 of the secondary brake actuator 3 includes a monitoring function that can detect a breakdown in communication via the communication system 7 or that can identify that an erroneous signal has been transmitted via the communication system 7. An erroneous signal is understood to mean a signal that falls outside a set validity value range established for a predetermined quantity. Similarly, a signal may have an error if its state is characterized or defined as invalid (e.g., by a set bit or index). In this way, the secondary brake actuator 3 can deduce problems in communication with the primary brake actuator 2.

[0031] There can be several causes for the lack of reception of information or the reception of an erroneous signal at the secondary brake actuator 3. On the one hand, a failure of the primary brake actuator 2 may have occurred, which makes it impossible to transmit information. On the other hand, the communication system 7 itself may have an error or have failed, for example due to a mechanical disconnection.

[0032] Error identification, ie mapping to a failure in the communication system or a failure in the primary brake actuator 2, cannot be done on the individual bus connections alone.

[0033] In the following, a method is described that allows such error identification.

[0034] It is initially assumed that the primary brake actuator 2 is solely responsible for pressure formation or pressure regulation, and that the brake settings 6a, 11a or 6b, 11b are supplied to the primary brake actuator 2 and the secondary brake actuator 3, respectively. Here, it can be seen that the brake settings are supplied directly to the primary brake actuator 2 and the secondary brake actuator 3.

[0035] In a first step 301, the control device 16 of the secondary brake actuator 3 monitors whether information is received from the primary brake actuator 2 via the communication system 7 at all or whether an erroneous signal is received via the communication system 7.

[0036] If the signal from the primary brake actuator 2 is missing or if this signal has an error, the brake system transitions to an operating mode in which the drive for adjusting the brake pressure of the secondary brake actuator 3 based on the brake setting 6b, 11b supplied to the secondary brake actuator 3 is released or blocked.

[0037] First, in the event of a communication failure or an erroneous signal, the drive of the secondary actuator 3 can be released (step 301a). For this purpose, the secondary actuator 3 can detect the brake pressure 13 present in the brake system 1 and compare it with the brake settings 6b, 11b. This can be done based on a characteristic curve 17, as will be explained further in the following paragraphs, and therefore a description of the characteristic curve 17 will be omitted here. If the brake pressure 13 deviates, possibly taking into account tolerances, from the brake pressure expected based on the brake settings 6b, 11b and the characteristic curve 17, the missing brake pressure can be applied by the secondary brake actuator. Since the pressure 13 is constantly read and present in the control device 16 of the secondary actuator, the brake pressure corresponding to the second brake setting 6b, 11b can be constantly adjusted thereby. In this case, it may remain unclear whether communication via the communication system 7 is no longer possible or whether error-free communication with the secondary actuator is no longer possible.

[0038] In other words, each brake actuator 2, 3 generates a brake pressure with a specific brake setting 6a, 11a or 6b, 11b supplied to it. The secondary brake actuator 3 can then adjust the desired brake pressure taking into account the measured prevailing brake pressure 13. In this case, the primary brake actuator 2 generates the brake pressure by controlling an internal variable of the primary brake actuator 2. Another characteristic curve can be used to describe the brake setting 6a, 11a in relation to the actuation variable of the primary brake actuator. The actuation variable here can be, for example, the rod distance of the primary brake actuator (e.g., the output rod of the primary brake actuator), the transmission force, or the motor current. The adjustable internal variable is directly related to the generated pressure, as shown by the example of two pressure-volume characteristic curves 18, 19 in FIG. 4. The volume V shifted during braking is proportional to the rod distance s according to the relationship V=A*s, where A is the area of ​​the cylinder whose volume is shifted. The two pressure-volume characteristic curves shown are for example for the front and rear wheels, respectively, the front and rear brakes being connected to respective brake cylinders operated by a primary brake actuator 2 .

[0039] The next method step 302 can be performed immediately after a communication failure or a signal with an error has been detected, ie it can follow after step 301 or after the already mentioned step 301a.

[0040] Since the signal from the primary brake actuator 2 has not been received by the secondary brake actuator 3, or since an erroneous signal has been received by the secondary brake actuator 3, in a next step 302 an additional monitoring can be carried out in the form of a plausibility check of the prevailing brake pressure 13 with the brake settings 6b, 11b supplied to the secondary brake actuator 3. This monitoring is also carried out on the control device 16 of the secondary brake actuator 3. This monitoring serves to check at what point in the brake system 1 an error exists, in other words to identify the error.

[0041] In the control device 16 of the secondary brake actuator 3, the brake pressure 13 generated by means of the primary brake actuator 2 is monitored. Here, the brake pressure generated by means of the primary brake actuator 2 can be determined by means of a pressure sensor 12 in the brake system 1, which can detect the pressure 13 available in the master brake cylinder or at another suitable location in the brake system 1. Thus, for example, an ESP pilot pressure sensor supplies a corresponding signal to the master brake cylinder.

[0042] The detected brake pressure can then be compared in the control device 16 of the secondary brake actuator 3 with an existing (driver-dependent or driver-independent) brake setting 6b, 11b. This comparison can be carried out, for example, using a characteristic map or characteristic curve 17 that is pre-stored in the vehicle. The characteristic map or characteristic curve 17 in question does not necessarily have to be permanently stored in the vehicle but can also be updated during operation or at specific intervals, for example, at power-on or during inspection. Similarly, adaptation of such characteristic curves or characteristic maps can also be carried out via the selection of the vehicle's operating mode. Thus, for example, the vehicle can be operated in sport mode and comfort mode via a selection switch in the vehicle.

[0043] An example of a characteristic curve 17 is shown in Figure 2. This shows the profile of the characteristic curve 17 of the brake pressure 13 depending on the brake settings 6a, 6b, 11a, 11b. The brake pressure 13 increases as the brake settings 6a, 6b, 11a, 11b increase. This characteristic curve 17 may be set to be the same for the driver-dependent brake settings 6a, 6b and the driver-independent brake settings 11a, 11b, or may be different. Only one characteristic curve 17 is shown here by way of example.

[0044] The above-mentioned plausibility check is carried out on the basis of a characteristic curve 17, which shows the relationship between the brake settings 6a, 6b, 11a, 11b and the desired pressure 13, as illustrated in Fig. 2. The plausibility check can be carried out in such a way that pressures within a certain tolerance range around the characteristic curve are still evaluated as acceptable, and only in the region 14 below the characteristic curve are they evaluated as unacceptable.

[0045] If, during the next plausibility check in step 303, it is found that no pressure 13 is measured, or alternatively that an acceptable pressure 13 is not measured despite the presence of a brake setting 6b, 11b with a target brake pressure to be adjusted, then a fault in the environment of the primary brake actuator 2 is assumed. In other words, if no pressure or insufficient pressure is available, then it should be assumed that there is a defect in the primary brake actuator 2. Here, errors in the bus communication 7 or in the communication device of the primary brake actuator 2 are also detected. This is because, in the event of a defect in the environment of the primary brake actuator 2, the primary brake actuator 2 itself must send a corresponding error message via its communication device and the bus communication 7 to the secondary brake actuator 3, in particular its control device 16.

[0046] In the following step 304, a corresponding alternative reaction can be initiated. In this alternative reaction, if no brake pressure is present, the pressure buildup is completely taken over by the secondary brake actuator 3. However, in the alternative reaction when an unacceptable brake pressure is present based on the characteristic curve 17 and its tolerance range, the secondary brake actuator 3 at least partially takes over the brake pressure buildup or brake pressure regulation, and the brake pressure 13 present according to the characteristic curve 17 is adjusted or controlled according to the brake settings 6b, 11b supplied to the secondary brake actuator 3. To adjust the brake pressure 13, the secondary brake actuator can adjust the brake pressure signal 13. In this way, the at least partial release of the brake pressure regulation by the two brake actuators 2, 3 can be linked to a plausibility check and is not used in all operating situations.

[0047] If the plausibility check in step 305 shows that the correct pressure 13 is being set or that the correct pressure 13 is being set taking into account the characteristic curve 17 and the existing tolerances, an error in the bus communication 7 only is determined. In this case, it is assumed that the primary brake actuator 2 is fault-free. Here, as an alternative reaction 306, the brake pressure buildup is maintained in the primary brake actuator 2 and the secondary brake actuator 3 does not take over, i.e., the secondary brake actuator 3 is prevented from taking over. The method described above can be performed and used in a vehicle without time limitations.

[0048] In the embodiments described so far, it is assumed that the brake pressure 13 is monitored and that an error is identified in the control device 16 of the secondary brake actuator 3 .

[0049] In another embodiment, the analysis of whether the brake pressure 13 generated by the primary brake actuator 2 and calculated by the secondary brake actuator 3 and the corresponding brake pressure sensor 12 conforms to the brake settings 6b, 11b can also be carried out on a control device other than the control device 16 of the secondary brake actuator 3. Similarly, other steps of the described method can also be executed on other control devices. Furthermore, certain method steps can be executed on a control device and other steps can be executed on at least one other device. For this purpose, the relevant control devices must be supplied with the necessary signals.

[0050] On the other hand, the method steps can be at least partially carried out by another control device provided in the vehicle, for example the control device 10 which is primarily responsible for the driver assistance functions, or alternatively by a higher-level control device, for example the central computer of the vehicle. The data required to carry out the analysis on the other control device, for example the brake pressure 13 and the brake settings 6b, 11b, can be supplied to the other control device 10 via a suitable communication channel, for example via a communication network 7 (bus system) and also via wireless data transmission within the vehicle.

[0051] It is also conceivable to carry out an analysis of whether the achieved brake pressure 13 corresponds to the brake settings 6b, 11b and to perform other method steps external to the vehicle, for example in an external control device 21 or an external computer, which then accesses corresponding data of the vehicle. The data in this case are the achieved brake pressure 13 and the brake settings 6b, 11b. For this purpose, the brake demand settings 6b, 11b can also be directly provided to the external control device 21 or computer. It is also possible for the brake settings 6b, 11b to be subsequently provided to the secondary brake actuator 3 and transmitted from the secondary brake actuator 3 to the external control device 21 or the external computer. In this case, data transmission to an external control device, for example a cloud, can be achieved by suitable communication means, for example a data connection via the Internet.

[0052] Here, the fallback reaction in the event of a failure of the primary brake actuator 2, as shown in the first embodiment, can still be carried out by the secondary brake actuator 3 (either in the case of another control device 10 in the vehicle or in the case of a control device 21 external to the vehicle or a computer external to the vehicle). Similarly, a partial fallback reaction by the secondary brake actuator 3 can also be carried out if the primary brake actuator 2 is still partially generating a braking pressure. In other words, as already explained in the first embodiment, the difference between the target braking pressure and the braking pressure generated by the primary brake actuator is compensated by the secondary brake actuator 3.

[0053] If the brake system 1 includes other brake elements in addition to hydraulic adjusting elements or actuators, i.e., in addition to the primary brake actuator 2 and the secondary brake actuator 3, these brake elements can likewise be used for an alternative reaction. Such other brake elements can be, for example, an electrically operable parking brake, an electric brake arranged on at least one wheel to be braked, or a generator of an electric or hybrid vehicle that generates a braking effect during regeneration. When using other brake actuators, such as a parking brake, a generator, or an electric brake, for an alternative reaction, it is possible, under certain circumstances, to only partially regulate the hydraulic pressure from the primary brake actuator 2 and the secondary brake actuator 3. In this case, a full or at least additional complementary contribution to the other adjusting elements must be taken into account.

Claims

1. A method for operating a brake system (1) having a primary brake actuator (2) with a first control device (15) and a secondary brake actuator (3) with a second control device (16), the method being driven starting from a first brake setting (6a, 11a), comprising: - the first control device (15) and the second control device (16) and / or further control devices (10, 21) are interconnected via communication means (7), - using said second control device (16) and / or said further control device (10, 21), - whether a signal from the first control device (15) is received by the second control device (16) and / or the further control device (10, 21), or - whether the signal received from the first control device (15) at the second control device (16) and / or at the further control device (10, 21) has errors; is inspected, - if the signal from the side of the first control device (15) is missing or has errors, - the actuation of the secondary brake actuator (3) based on the second braking setting (6b, 11b) is released or prevented, error identification is performed using the second control device (16) and / or the further control device (10, 21) and an alternative reaction is initiated; For the error identification, - the brake pressure (13) adjusted by the primary brake actuator (2) based on the first brake setting (6a, 11a) is read by the second control device (16) or by the further control device (10, 21), - by means of the second control device (16) or the further control device (10, 21), a plausibility check (302) of the calculated brake pressure (13) for the second brake setting (6b, 11b) present in the second control device (16) or the further control device (10, 21) is carried out, If during the validation check (302) an expected pressure (13) is identified, in particular an expected pressure (13) within the tolerance range of a characteristic curve (17) between the pressure (13) and the brake setting (6b, 11b), a second error state is set in the scope of the error identification, indicating an error in the communication means (7). A method for operating a brake system (1).

2. the primary brake actuator (2) is driven based on the first brake setting (6a, 11a) via a first characteristic curve (18, 19) corresponding to the relationship between the first brake setting (6a, 11a) and an internal control variable to be adjusted of the primary brake actuator (2), in particular the relationship between the rod distance, the transmission force or the motor current of the primary brake actuator (2); The method of claim 1.

3. the plausibility check (302) is performed based on a second characteristic curve and / or characteristic map (17) defining a relationship between the brake pressure (13) and the second brake setting (6b, 11b); The method of claim 1.

4. the first braking setting (6a, 11a) and the second braking setting (6b, 11b) are identical, in particular the first braking setting (6a, 11a) and the second braking setting (6b, 11b) are derived from the same supply source (4, 5, 10); The method of claim 1.

5. If the pressure (13) or the expected pressure (13) is not identified during the validation check (302), a first error state is set in the scope of the error identification, indicating a defect in the primary brake actuator (2). The method of claim 1.

6. As the first error condition, an error in the environment of the communication means (7) or an error in the communication device of the primary brake actuator (2) may additionally be indicated. The method of claim 5.

7. As an alternative reaction (304), the release of the drive of the secondary brake actuator (3) based on the second braking setting (6b, 11b) is - if no pressure is identified within the scope of the plausibility check, by the secondary brake actuator (3) taking over the brake pressure regulation completely, - by at least partially assuming the brake pressure regulation if the expected pressure (13) is not identified, in particular if the expected pressure is not within the tolerance range of the characteristic curve (17) between the pressure (13) and the brake settings (6b, 11b), 7. The method according to claim 5 or 6.

8. The pressure regulation by the secondary brake actuator (3) is prevented as an alternative reaction (306), and the pressure regulation by the primary brake actuator (2) is continued. The method of claim 1.

9. 1. A braking system (1) comprising a primary brake actuator (2) having a first control device (15) and a secondary brake actuator (3) having a second control device and / or another control device (16, 10, 21), the control devices being configured to perform a method according to claim 1.

Images