Abstract: A brake assurance monitor, for controlling the braking and propulsion systems of a vehicle, has a controller for controlling normal braking, a first level emergency braking and a second level emergency braking. The controller has inlets for connection to lines carrying vital command signals and outlets. A first switch device has inputs for connection to other lines carrying command signals. A number of alternative first inputs and first outputs, which are connectible to the normal or alternative inputs. The outputs are switched from the normal to the alternative inputs by an actuator, controlled by the controller; switching occurs when emergency braking is required. A second switch device similarly has normal, second inputs connected to outlets of the controller, and alternative, second inputs for connection to the lines carrying vital command signals. A second actuator maintains second outputs of the second switch device connected to the normal second inputs during normal braking.