Abstract: A brake system for a motor vehicle comprises a normally closed circuit separation valve such that the system is configured to operate in 1) in a by-wire mode when the circuit separation valve is open, such that pressure only from a pressure chamber of a linear actuator is delivered to both first and second pairs of wheel brakes, and 2) in a circuit separation mode with the circuit separation valve in the normally closed position, such that pressure from a tandem master cylinder is delivered only to the first pair of wheel brakes, and such that pressure from the pressure chamber of the linear actuator is concurrently delivered only to the second pair of wheel brakes. The system can provide braking pressure even in the event of a by-wire braking module leak that causes inoperability of an ECU.

Abstract: A braking apparatus of a vehicle including: a brake pedal position detector configured to detect a position of a brake pedal; a piston displacement detector configured to detect a displacement of a piston installed in a main master cylinder; a rear wheel circuit pressure detector configured to detect pressure supplied to a rear wheel circuit; a front wheel circuit pressure detector configured to detect pressure supplied to a front wheel circuit; a motor driver configured to drive a motor to move the piston; and a controller configured to receive the position of the brake pedal, the displacement of the piston, rear wheel circuit pressure and front wheel circuit pressure, determine a fail of a circuit isolation valve, and perform fail safe driving by operating the motor driver and a normal operating valve to supply pressure to only one of the rear wheel circuit and the front wheel circuit.

Abstract: A device for an automatic parking brake includes a first microchip and a second microchip. The first microchip and the second microchip are configured to actuate an end stage of the automatic parking brake. The first microchip and the second microchip are configured in a redundant manner with respect to one another in relation to actuating the end stage.

Abstract: A wheel speed sensor for a motor vehicle can be supplied with an operating voltage by a control device. The control device has a load resistance with a load resistance value. An operating voltage can be at a voltage input by the control device. An electrical circuit is designed to determine a turn-on or a turn-off voltage value according to the load resistance value. An operation control is designed to transfer the wheel speed sensor into a normal operation using the operating voltage, when the turn-on voltage value is exceeded, and to transfer the wheel speed sensor into an emergency operation using the operating voltage, when a turn-off voltage value is not met. In emergency operation only a low constant signal level is emitted.

Abstract: An aircraft braking system comprising: a first group (Ga) of actuators and a second group (Gb) of actuators. A first control module (105a) is adapted, in a nominal mode, to control the first group, and in a reconfigured mode, to control the first group and the second group. A second control module (105b) is adapted, in a nominal mode, to control the second group, and in a reconfigured mode, to control the first group and the second group. A monitoring unit adapted is adapted to monitor the first control module and the second control module, and to put the first control module into the reconfigured mode of operation when the monitoring unit detects a failure of the second control module, and to put the second control module into the reconfigured mode when the monitoring unit detects a failure of the first control module.

Abstract: A battery module for a battery system includes two terminals, via which the battery module can be electrically connected to the battery system. Furthermore, the battery module has a battery string, which connects the two terminals to one another and has at least one battery cell connected in series and/or in parallel with the battery string. The battery module comprises a battery module circuit, which is configured, upon receiving an alarm signal, to bridge the battery module via the terminals thereof. The at least one battery cell is connected to a monitoring circuit associated with the battery cell. The monitoring circuit is connected to an alarm line via an electrical connection. The alarm line is connected to an input of the battery module circuit.

Abstract: A method for diagnosing an electric brake system is disclosed.

Abstract: A cascade of safety switches includes safety switches for the monitoring of accesses of an automation system, at least one connection unit for the arrangement between two safety switches, and a terminator for the termination of the cascade of safety switches. Each safety switch has a first conductor and a second conductor. The first conductor includes conductor cores for transmitting signals and for receiving voltage. The second conductor includes conductor cores for receiving signals and for forwarding the voltage. The connection unit has a first circuit and a second circuit. The first circuit is provided for receiving the signals of a subsequent safety switch and for forwarding the signals of the subsequent safety switch to an upstream safety switch and the second circuit is provided for connecting the connection unit to a voltage source and to a conductor core for receiving the voltage of the subsequent safety switch.

Abstract: An apparatus for operating a vehicle, including a coupling device which is designed to decouple a speed sensor from a primary energy supply of a primary control of a primary brake-control system and to couple it to a secondary energy supply, and a control device which is designed to control the coupling device as a function of an error signal of the primary control, so that in response to an error of the primary control, the speed sensor is able to be decoupled from the primary energy supply and coupled to the secondary energy supply. A method for operating a vehicle, a system for operating a vehicle, as well as a computer program are also described.

Abstract: A vehicle includes a brake pedal, a master cylinder, a braking circuit with a wheel cylinder, and a brake pressure generator. A pedal feel simulator is coupled to the master cylinder through a switchable valve. An isolation valve is provided to isolate the braking circuit from the master cylinder and the simulator circuit. A controller is programmed to couple the simulator circuit to a pressure sensor positioned in the braking circuit at a designated diagnostic time during which the brake pedal is depressed to generate a brake pedal input while the vehicle is positively parked. Increased fluid pressure from the brake pedal input is observed with the sensor in the braking circuit. The controller checks whether the pressure-increase to brake pedal input relationship indicates efficacy of the simulator circuit for continued operation of brake-by-wire operation.

Abstract: A modified dual-duplex fail-operational control system. A primary controller includes a first processing unit and a second processing unit for executing a function. A first comparative module comparing the function results from the first and second processing unit to determine an error the first controller. A second controller includes a first processing unit and second processing unit. The first processing unit executes the function. The second processing unit operating in a non-redundant state and not executing the function while in the non-redundant state. A second comparative module determines whether an error is present in the second controller.

Abstract: The present invention relates to a brake control system for a motor vehicle having front and rear axles. The brake control system includes a controller operable in response to a braking request signal. The controller is configured to control a front axle braking system for applying a front axle braking force and a rear axle braking system for applying a rear axle braking force. The controller is configured to increase the front axle braking force to supplement the rear axle braking force when an operational parameter relating to the rear axle braking system is greater than or equal to a pre-defined threshold. The invention also relates to a method of controlling the braking of a motor vehicle.

Abstract: A method and arrangement for determining a capacitor degradation parameter associated with the degree of degradation of a cell capacitor in a converter cell of a power converter including a plurality of identical converter cells, including redundant converter cells, which converter cell, prior to determining the capacitor degradation parameter, has been bypassed. The method includes a) obtaining a measurement parameter value associated with discharging of the cell capacitor, forming a dc-link, from a measurement start voltage level at a measurement start time to a measurement end voltage level at a measurement end time, and b) determining a value of the capacitor degradation parameter based on the measurement parameter value.

Abstract: In a travel control apparatus for a vehicle, a travel environment information acquisition unit acquires travel environment information on a travel environment of the vehicle. A travel information detector detects travel information on the vehicle in order to execute automatic driving control based on such information pieces. A lateral force generator generates lateral force to be applied to the vehicle during the automatic driving control. A torsion bar is interposed on a torque transmission path of a steering system. A steering wheel angle detector detects a steering wheel angle. A lateral force detector detects the lateral force acting on the vehicle. An intervening steering operation determination unit determines that a driver has performed an intervening steering operation when a characteristic of the detected steering wheel angle and lateral force differs from a reference characteristic that varies univocally when the steering wheel is in a no load condition.

Abstract: The present invention provides a method of detecting solenoid valve failure of a vehicle electric brake booster, the method including: a) driving the motor so that the piston moves forward until the piston closes at least the cut-off hole in a state in which the solenoid valve is locked; b) measuring pressure in the master cylinder in a state in which the piston is moved forward; c) determining whether the pressure in the master cylinder which is measured in step b) exceeds a predetermined reference value; and d) determining that the solenoid valve is in a failure state when the pressure in the master cylinder which is measured in step b) is the predetermined reference value or less, to detect failure of the solenoid valve only by a software control change, thereby providing an advantageous effect that secures braking safety.

Abstract: A brake ECU uses a control pressure acquired from a control pressure sensor to determine whether a valve closing operation abnormality or a valve opening operation abnormality occurs in one of a pressure increasing linear control valve and an adjusted flow rate cut valve in a state where a hydraulic pressure is supplied from an accumulator. The brake ECU controls, if the brake ECU determines that an abnormality occurs, respectively the control valve and the cut valve to change to an open state or a closed state, and identifies, based on a change in the control pressure acquired from the control pressure sensor, in which of the control valve and the cut valve the valve opening operation abnormality or the valve closing operation abnormality occurs. The brake ECU can use, after a valve in which the valve opening operation abnormality or the valve closing operation abnormality occurs is identified, a valve in which the abnormality does not occur to carry out brake control.

Abstract: A hydraulic brake system for a vehicle in which a pressure of a working fluid supplied from a high-pressure-source device having a pump is adjusted by an electromagnetic pressure-increase linear valve and an electromagnetic pressure-decrease linear valve, and a brake device provided for a wheel generates a braking force whose magnitude depends on the pressure adjusted by the linear valves, the hydraulic brake system being configured to cope with fluid leakage in the pressure-increase linear valve that is beyond a set degree.

Abstract: The present invention comprises a method and apparatus for controlling gas flow via a gas shut-off valve assembly. In at least one embodiment, the assembly is configured to drive its shut-off valve from an open position to a closed position, in response to detecting a valve closure condition. The assembly in one or more embodiments operates as an intelligent node in an AMR network, and it interprets a received closure command as a closure condition. Additionally, or alternatively, the assembly detects abnormal operating conditions as the closure condition. Advantageously, the assembly performs initial closure verification, based on detecting movement of the valve into the closed position, and performs subsequent closure verification, based on monitoring downstream gas pressure. In the same or other embodiments, the assembly provides enhanced stand-alone reliability and safety by incorporating one or more valve clearing/cleaning routines into its operations.

Abstract: A brake control device for a brake system. The control device can perform both an interlocking brake control and an antilock brake control. The brake system includes a front-wheel hydraulic circuit, a front-wheel-side braking part; a rear-wheel hydraulic circuit, a rear-wheel-side braking part; and an electrically-operated pump which pressurizes the brake fluid. The brake control device includes a usual voltage mode where the interlocking brake control or the anti-lock brake control is performed when the supply voltage is a first voltage or more, and a low voltage mode where at least one of the interlocking brake control and the anti-lock brake control is performed in a limited manner when the supplied voltage is a second, lower voltage. An operation mode is changed from the usual voltage mode to the low voltage mode when it is determined that the supply voltage becomes lower than the first voltage.

Abstract: An electromagnetic pressure control module for a pressure-medium-actuated brake system of a motor vehicle, having at least two channels, the module being controlled electrically in undisrupted operation and pneumatically in the event of a fault in the electrics, and also from a method for operating the electropneumatic pressure control module.

Abstract: An electrically actuated parking brake system includes a control switch in a vehicles cabin, an intelligent controller, a linear actuator, and cables connected between the linear actuator and mechanical parking brakes. The intelligent controller receives signals from the control switch and from one or more electrical device in the vehicle. If any of the signals from the vehicle indicate that the vehicle is in motion, the parking brakes are not actuated. The electrically actuated parking brake system may further include a remote control, and logic in the intelligent controller will allow the parking brakes to be engaged when the vehicle is in motion, remote control is enabled, and the remote control is actuated by a user. The parking brakes may be either drum brakes or disk brakes.

Abstract: A brake control apparatus for a vehicle includes: a master cylinder for raising a wheel cylinder pressure according to operation of a brake pedal; a booster for raising the wheel cylinder pressure by operating the master cylinder independently of operation of the brake pedal; a pressure regulator provided with a hydraulic pump for raising the wheel cylinder pressure independently of operation of the master cylinder; and a control section including: a first controller for controlling the booster; and a second controller for controlling the pressure regulator. The control section detects that at least one of the booster and the first controller is in a state of malfunction; selects one of backup modes according to the state of malfunction, wherein the backup modes restrict operation of at least one of the booster and the pressure regulator in different manners; and controls the wheel cylinder pressure in the selected backup mode.

Abstract: A method of detecting an in-range failure of a brake pedal position sensor includes calculating the difference between a minimum position and a maximum position of the brake pedal position sensor. The calculated difference is weighted to define a fast test weighted input value and/or a full test weighted input value. A cumulative test result value is incremented by the fast test weighted input value and/or the full test weighted input value. The cumulative test result value is filtered to define a moving average of the cumulative test result value after each incremented occurrence. The moving average of the cumulative test result value is tracked to determine if the brake pedal position sensor is functioning properly.

Abstract: A brake control system includes a master cylinder to produce a master cylinder pressure, a brake booster to assist the master cylinder, a first control unit to control the booster, a hydraulic modulator to supply a wheel cylinder pressure to a wheel cylinder, and a second control unit to control the hydraulic modulator. The hydraulic modulator includes a pressure source, such as a pump, to increase the wheel cylinder pressure. The first and second control units are connected together by a communication line. The brake control system may further include a boost condition transmitting section to transmit, through the communicating line, a condition of a boost system formed by the brake booster and the first control unit.

Abstract: A vehicle braking system including an input piston and a pressure piston that are moveably supported within a cylinder. The input piston is allowed to depress the pressure piston and is connected to the a brake pedal. Pressure chambers to the front and to the rear of the input piston are communicated through a communication passage such that the control hydraulic pressure in accordance with the operation amount to the brake pedal is applied to the second pressure chamber via first and second linear valves. The control hydraulic pressure in accordance with the operation amount to the brake pedal that has been transmitted to the pressure piston through the input piston is regulated by a pressure regulating valve so as to be applied to the second pressure chamber. The braking hydraulic pressure may be output from the pressure chambers, respectively.

Abstract: A motor vehicle has wheels on which it travels, a powertrain delivering propulsion torque to at least some of the wheels propel the vehicle, and a service brake system having service brakes. When the service brakes are applied by a service brake actuator, braking torque is applied to at least some wheels. A first device provides data representing a velocity that correlates with velocity of the vehicle, and a second device associated with the actuator provides data that distinguishes between application and non-application of the service brakes by the actuator. A processor monitors data from the first and second devices and processes the monitored data to provide a data output when the first device has disclosed velocity change indicative of the service brakes having been applied without the second device having disclosed that the service brakes have been applied.

Abstract: A microchip system has a package forming a hermetically sealed interior, and MEMS structure within the interior. The system also has a gas sensor for detecting the concentration of at least one of oxygen or hydrogen within the interior.

Abstract: A brake control apparatus for a vehicle includes: a master cylinder for raising a wheel cylinder pressure according to operation of a brake pedal; a booster for raising the wheel cylinder pressure by operating the master cylinder independently of operation of the brake pedal; a pressure regulator provided with a hydraulic pump for raising the wheel cylinder pressure independently of operation of the master cylinder; and a control section including: a first controller for controlling the booster; and a second controller for controlling the pressure regulator. The control section detects that at least one of the booster and the first controller is in a state of malfunction; selects one of backup modes according to the state of malfunction, wherein the backup modes restrict operation of at least one of the booster and the pressure regulator in different manners; and controls the wheel cylinder pressure in the selected backup mode.

Abstract: An on-board diagnostic system of a vehicle comprises disabling diagnostic operation, such as a misfire monitor, based on road roughness. In one example, the disabling of the diagnostic operation is based on brake actuation and degradation of an anti-lock braking system.

Abstract: A brake control apparatus has first and second wheel cylinders; a master cylinder unit; first and second systems; a separation valve; a pressure control mechanism that controls the working fluid pressure transferred to at least one of the first and second wheel cylinders independently of the brake operation, and a brake ECU. The brake ECU generates a differential pressure across the separation valve by operating the pressure control mechanism when there is no brake operation while a running drive source of a vehicle is stopped to determine whether the separation valve has a leakage abnormality.

Abstract: A trouble diagnosis device of a vehicle body acceleration sensor by determining that the output fixing trouble of the vehicle body acceleration sensor or the like is not generated at a point of time that the fluctuation width of the output value of a vehicle body acceleration sensor becomes a predetermined value or above during the traveling of the vehicle with the vehicle speed equal to or more than the predetermined speed, and by stopping the trouble diagnosis of the output fixing trouble of the vehicle body acceleration sensor or the like until the vehicle speed is lowered to a value less than the predetermined speed thereafter, it is possible to avoid the trouble diagnosis of the output fixing trouble of the vehicle body acceleration sensor or the like when that the trouble diagnosis of the output fixing trouble of the vehicle body acceleration sensor or the like is unnecessary.

Abstract: A failure detecting apparatus for detecting a failure of a solenoid-operated control valve having a coil, a valve chamber, and a movable member which is movable, while changing a volume of the valve chamber, by an electromagnetic drive force produced upon supplying of an electric current to the coil, so that the solenoid-operated control valve is selectively placed in one of an open state thereof and a closed state thereof, the failure detecting apparatus including a pressure-change detecting device which detects a change of a pressure on at least one of a high-pressure side and a low-pressure side of the solenoid-operated control valve; and a failure detecting portion which detects that the solenoid-operated control valve has failed, when a change of the pressure detected by the pressure-change detecting device upon controlling of the electric current supplied to the coil is smaller than a change of the pressure that results from a change of the volume of the valve chamber caused by a movement of the movable

Abstract: The output of a wheel speed sensor is sampled at dithered time intervals and the samples used to construct a pair of histograms representing high and low sample values. A minimum voltage threshold is determined as a function of the output voltage associated with the dominate histogram value for the low sample values. The output voltage associated with the dominant histogram value for the high sample values is compared to the minimum voltage threshold to determine whether a potential sensor wiring problem is developing.

Abstract: A braking system includes first pressure sensors 35, 35 which are provided to braking pipes 41, 41 which constitute first input-side pressure sensors for detecting a liquid pressure on a front-wheel-master-cylinder-25 side and a rear-wheel-master-cylinder-82 side, and second pressure sensors 36, 36 which are provided at positions closer to a stroke-simulator-28 side than second solenoid-operated valves 31, 31 of braking pipes 27,27 which constitute second input-side pressure sensors for detecting a liquid pressure on the stroke-simulator-28 side.

Abstract: A method and apparatus for data interchange between a tractor vehicle and a trailer vehicle coupled thereto. A first electronic device provided in or on the tractor is connected via a data link to a second electronic device provided in or on the trailer; the first and second devices being connected to sensors and/or actuators for controlling operating functions of the vehicle allocated thereto and for measuring status information. Initiated by an information request, the first device sends request data via the data link to the second device. The first device receives status information via the data link sent by the second device in response to the request data. The first device outputs, in a manner that correlates with the trailer, the received status information by means of an output device disposed on or in the tractor. The same output scheme is used for both the tractor and trailer.

Abstract: A braking device is disclosed for a rail vehicle, in which a braking control unit is linked to braking units via a data bus system. According to an embodiment of the invention, the data bus system is designed to transmit telegrams and a fail-safe unit is assigned to the data bus system to identify transmission errors. The fail-safe unit is linked on the output side to braking units of the service brake and the emergency brake, in order to trigger the braking units in the event of a transmission error.

Abstract: A power supply apparatus for a vehicle. An electronic controller outputs information for controlling braking of a vehicle. A battery supplies electric power to a brake via the electronic controller. A power supply backup unit as an auxiliary power supply includes a capacitor unit formed of a plurality of capacitors and a detection unit for detecting an abnormality in the capacitor unit, and supplies electric power to the brake when the battery is in an abnormal state. In charging or discharging the capacitor unit, the detection unit measures an internal resistance value of the capacitor unit, and measures an internal capacitance value from the rate of change of voltage per unit time. The detection unit judges whether or not the capacitor unit is in a normal state based on the internal resistance value and the internal capacitance value.

Abstract: A rail vehicle includes an electrical signal line loop for activating the brakes. There is provision for a safety loop, which is redundant with respect to the signal line loop and is electrically independent of the rest of the vehicle control system, to be present.

Abstract: In a parallel relay circuit, only one of a plurality of relays is turned on sequentially while turning the rest of the relays off. It is determined whether the motor is applied with voltage via a voltage detection resistor when each of the relays is turned on individually such that a disconnection abnormality in the respective relays is detected. As the disconnection abnormality in each of the relays can be detected individually, it is possible to detect a disconnection abnormality that has been occurred at least in a part of the relays, and to alert a driver for the abnormality.

Abstract: A failure check apparatus for a control apparatus of a vehicle such as ABS. When the failure check apparatus performs initial check for the ABS, it successively activates each of solenoid valves and a motor provided in the ABS, one at a time, for a predetermined time so as to determine whether a failure has occurred in the ABS. At that time, activation of the motor is started when a certain delay time elapses after the end of activation of the last solenoid valve. The delay time is a time which the vibration generated in the control apparatus upon activation of the last solenoid valve converges. Thus, interference between a vibration wave (sound wave) generated upon actuation of the solenoid valves and a vibration wave (sound wave) generated upon actuation of the motor, which differ in nature of vibration, is prevented.

Abstract: A method of triggering a component in a distributed safety-related system, i.e., a component of an X-by-wire system in a motor vehicle, is described. The component is triggered by a process computer assigned to the component and connected to a communication system via a communications controller. A monitoring unit which is independent of the process computer is provided for monitoring the process computer. To simplify the configuration of such a safety-related system while at the same time at least retaining the safety that is achievable on enabling the components, the functions of the monitoring unit are executed by the communications controller. The communications controller may execute a question-and-answer communication with the process computer.

Abstract: In a method and a device for monitoring a brake system, e.g., a wheel pressure sensor suite of a brake system of a motor vehicle, the fault detection is implemented on the basis of a differential threshold being exceeded by a signal that is representative for the difference of the brake pressures at the individual wheel brakes of a wheel axle. In the process, the differential threshold is set as a function of the averaged rate of increase of the individual pressures at the wheel brakes. Fault detection is carried out on the basis of a model, which takes the instantaneous operating state of the brake system into account.

Abstract: A power-supply unit for automobiles, connected to an electrically-driven brake device which generates braking forces by being electrically driven, an electric generator capable of generating braking forces for a vehicle by power generation, and a storage device for storing electric power, the power-supply unit comprising a first power supply line for connecting the electric generator with the storage device, a second power supply line for connecting the first power supply line with the electrically-driven brake device, and power-source connection means provided on the second power supply line and have interrupting function.

Abstract: When a voltage supply to a motor is switched to OFF from ON, a brake fluid pressure control apparatus determines whether a duration of time required for a terminal voltage of the motor to reach a first threshold is shorter than a first predetermined duration of time, and whether a duration of time required for a terminal voltage of the motor to reach a second threshold lower than the first threshold is shorter than a second predetermined duration of time longer than the first predetermined duration of time. Then, when determinations are made that the terminal voltage of the motor reaches the first threshold in the duration of time shorter than the first predetermined duration of time, and that the terminal voltage of the motor reaches the second threshold in the duration of time shorter than the second predetermined duration of time, the voltage supply control portion determines that the motor seizes up and controls the voltage supply to the motor in the seizing-up state.

Abstract: A brake system for a heavy vehicle includes a control network, a brake component, a central control unit, and a distributed electronic control unit. The central control unit generates central control signals adapted to control the brake component, which control signals are transmitted to the brake component over the control network. The distributed electronic control unit receives the central control signals, controls the brake component in accordance with the central control signals if the central control signals are received during expected time periods, and controls the brake component in accordance with an alternative control scheme if the central control signals are not received during the expected time periods.

Abstract: A vehicle anti-lock brake system determines when an ABS failure condition has occurred, configures a failure condition operating mode of the ABS control, and, finally, activates the ABS control based on the failure condition operational mode. When a brake actuator failure occurs, this allows the system to configure the failure condition operating mode to exclude the wheel having the failed brake actuator. Alternately, the system may configure the failure condition operating mode to exclude wheel speed data when an invalid wheel speed indicator is determined for a wheel.

Abstract: A device and a method for monitoring a lateral-acceleration sensor suitable for use in a motor vehicle. A first lateral-acceleration variable is detected which describes the lateral acceleration acting on the vehicle. The device also includes a detecting arrangement with which wheel-speed variables are detected that describe the speeds of the individual wheels. Also included is a first determination arrangement with which a variable describing the vehicle speed is determined as a function of at least one wheel-speed variable, and a second determination arrangement with which a second lateral-acceleration variable is determined as a function of at least one wheel-speed variable, as well as a monitoring arrangement in which at least one comparison of the first lateral-acceleration variable to the second lateral-acceleration variable is carried out for monitoring the lateral-acceleration sensor.

Abstract: A method and system for ensuring reliable operation of a brake booster system for a vehicle braking system in which a pressure value prevailing in the brake pressure reservoir of the brake booster system is sensed by a pressure sensor. An error occurring in the brake booster system is detected by evaluating the sensed pressure value prevailing in the brake pressure reservoir as a function of the actuation of the brake actuating mechanism. The brake booster system includes a diagnostic circuit that is connected to the pressure sensor and to the brake actuating mechanism.

Abstract: The present invention includes a method for controlling brake motor. The method includes receiving brake motor information, determining a first brake motor voltage value and a brake motor current value based on the motor information when the brake motor is active, determining a brake motor resistance value based on the first brake motor voltage value and the brake motor current value, determining a brake motor temperature value based on the determined brake motor resistance value, and producing a brake motor control signal based on the determined brake motor temperature value. The method may additionally include determining a second brake motor voltage value when the brake motor is inactive, and producing a motor diagnostic voltage value based on the determined second brake motor voltage value.

Abstract: A microprocessor system for safety-critical control operations includes at least three central units which are preferably located jointly on one chip and execute the same program. Further, there is provision of read-only memories and random-access memories with additional memory locations for test data, input and output units and comparators which check the output signals of the central units for correlation. The central units are interconnected by way of bus systems and bypasses which enable the central units to jointly read and process the existing data, including the test data and commands, according to the same program. The central units are extended by redundant periphery units into two complete control signal circuits and are interconnected in such a manner that, upon failure, the faulty central unit is identified by a majority decision and an emergency operation function is maintained.