Short Review of EMB Systems Related to Safety Concepts

Abstract

A growing interest in Electromechanical Brakes (EMBs) is discernible in the automotive industry. Nevertheless, no EMBs have ever been deployed for series production, although countless publications have been made, and patents have been filed. One reason for this is the need for the optimization of functional safety. Due to the missing mechanical/hydraulic link between the driver and the actuator, sophisticated concepts need to be elaborated upon. This paper presents the current state of the art of safety concepts for EMB systems (only publicly available publications are reviewed). An analysis of current regulatory and safety requirements is conducted to provide a base for design options. These design options are explored on the basis of an extensive patent and literature research. The various discovered designs are summarized and analyzed according to their (a) EMB actuators; (b) control topology; (c) energy supply; and (d) communication architecture. This paper concludes by revealing the weak points of the current systems.

1. Introduction

The automobile industry is currently facing two simultaneous challenges. The first challenge is the progression of automated driving. The newly promoted Mercedes-Benz S-Class can be cited in this context, supporting automated driving (SAE Level 3) up to a speed of 60 km/h in specific contexts [1]. The second major challenge is decarbonization: the shift from internal combustion engines (ICE) towards electric driving. Both challenges are driving factors for the introduction of Electromechanical Service Brakes (EMBs) into series production [2].

In 2015, the presentation of the Audi R8 e-tron equipped with two EMBs at the rear axle for the 24 h in Le Mans race can be highlighted as a milestone towards series production [3]. However, to date, no programs towards series production have been announced to the public by any OEM, leaving the state of EMBs as being ‘under research’.

The introduction of EMBs is linked to Brake-by-Wire (BBW) systems, which are characterized by the capability of controlling the brake actuators electronically, and which promise diverse possible advantages:

• Reduced weight [4,5];

• Easy assembly [4,6];

• Modularization [6];

• Lower power consumption [5];

• Enhanced vehicle stability (dynamic brake force distribution, faster brake response, etc.) [4,7,8];

• Easier cooperative regenerative braking [8].

BBW systems currently on the market typically consist of a pedal simulator, a control unit, electrically actuated brake actuators, and a mechanical/hydraulic backup actuated directly by pedal [8,9].

EMB systems are systems that usually have neither mechanical nor hydraulic links between driver and brake actuator. However, this raises significant reliability and security concerns for the E/E architecture that need to be addressed [9].

However, today’s E/E architectures are the result of continuous evolution and the permanent appending of functions and electronic control units (ECUs). This evolution has led to complex topologies with over 100 distributed ECUs (at the vehicle level). Another topic of concern is the processing and exchange of potentially safety-critical and redundant signals between those ECUs [10,11,12,13,14]. The issues concerning safety and the E/E architectures of EMBs are well known to the scientific community. Many different and concurrent approaches have been presented trying to resolve the aforementioned problems, and these are reviewed in this paper.

The scope of this paper is to give a brief overview of relevant topics concerning future EMB systems, concentrating on the functional E/E architecture and disregarding the precise mechanical attributes. First, general requirements for braking systems are presented in Section 2. Section 3 highlights the current state of the art (SoA) of EMB actuators and explains their sub-components, as well. The foreseen future concepts for E/E architectures concerning EMB systems are addressed in Section 4. This paper concludes by pointing out current inadequacies that are not appropriately addressed and that might be researched in future.

2. Safety

2.1. Regulations for Braking Systems

2.1.1. Introduction to Regulations

The European Union, the United States of America, China, and India accounted for 71% of worldwide car sales in 2020 [15]. Regulations in these four regions are considered in this paper [16,17,18,19,20]. Additionally, the regulations of Canada [21] were analyzed, because they explicitly address electrically actuated brakes (in addition to hydraulic ones). The aim is rather to give a holistic set of requirements that must be met than to analyze the regulations in their detail.

An organization to be noted in the context of vehicle regulation is the United Nations Economic Commission for Europe (UNECE), which includes 56 member states in Europe, North America, and Asia. One of its purposes is the development of regulation and norms, resulting in UNECE-R13H, which is implemented in the European Union and similarly in the United States as the certification specification for braking systems [22]. China and India do not take part in the UNECE. Nevertheless, they have implemented specifications that are comparable albeit on a lower performance level.

2.1.2. Common Subsets of Legislation

The most relevant requirements for certifying an EMB service braking system are summarized in the following tables, specifying only the most performant requirements with respect to various performances requested in different regions. A distinction is drawn between design (see Table 1), performance (see Table 2), performance of the degraded system (see Table 3), and degradation of the design (see Table 4), while noting the specific paragraph that requests a given feature. The numbers listed in the right columns beneath the requirements refer to the paragraphs of the legislative documents. If the letter ‘A’ precedes a number, the relevant requirement can be found in the Annex.

The following summary shows that certain design principles are to be followed, as the braking system must actuate all four wheels of a vehicle (D.05), and certain redundancies are to be implemented (D.14). However, a degree of degradation is allowed, reducing the required mean deceleration from 6.63 m/² (P.01) to a minimum of 2.6 m/s² (P.11) resulting from single failure [22]. It needs to be highlighted that Canada explicitly addresses that electrically actuated brakes are to decelerate according to nominal required performance in the case of any 1st E/E failure.

2.2. Functional Safety for Braking

In general, every braking system can be regarded as being safety-critical. The state-of-the-art means of compliance for safety-critical E/E architectures of road vehicles is ISO 26262. Detailed information on how items and safety concepts are defined, as well as how safety assessments are conducted, is explained in [23]. The following paragraphs focus on the consequences for service braking systems and their actuators analyzed in the literature after showing how ASILs (Automotive Safety Integrity Level) are determined in general.

2.2.1. ASIL Determination in General

ASIL is an indicator of the safety impact of the malfunction of a certain system. The highest ASIL (D) reflects a major impact, where the lowest ASIL (A) reflects a minor impact on the safety of the vehicle. It is to be determined by the superposition of the following three factors [23]:

• Exposure: refers to the probability of occurring in a driving scenario [24].

• Severity: refers to the potential harm to passengers and other road users based on the Abbreviated Injury Scale (AIS).

• Controllability: refers to the share of drivers who could handle the situation while avoiding hazards.

It is important to note that a malfunction of the vehicle resulting in an event that is uncontrollable by any driver (C3) and fatal to all occupants (S3) might be classified as either ASIL A or D only on the basis of whether the related driving situation might happen more or less frequently. The determined ASIL of an item informs the development process that is to be followed and certain random hardware fault metrics that must be tolerated by the allocated systems [25,26].

After the ASIL determination, an ASIL decomposition might be conducted, following the rules of [27]. ASIL decomposition is the allocation of one item to several elements, resulting in a lower ASIL for each element. However, the hurdle that the elements must be ‘sufficiently independent’ is to be ensured. Ref. [28] describes common faults in ASIL decomposition.

2.2.2. Applied ASIL Determination

The ASIL of an item is independent of the architecture of the linked systems. Furthermore, it can be seen as the starting point for deriving architectural concepts that comply with the required safety (Section 3 and Section 4).

In the literature, ASIL assessments are rarely given, because they are the know-how of the OEMs. However, a few reviews have been published. Table 5 provides an overview of the ASILs for various malfunctions of braking functionality, as generalized by [29], that have been published in literature. Table 5 illustrates that with increasing degradation of the braking system, the increase in uncommanded deceleration or yaw motion of the vehicle could result in rising ASIL ratings for the braking system. However, it has also been shown that the same degree of degradation might result in different ASIL ratings as a result of the source or the context [2,9,30].

Two classes of reliability requirements can be derived from Table 5. The first class is the availability of the function ‘deceleration’ in several degradation levels. The second class is the integrity, which is, at least in a fail-silent manner, required by the regulation (D.11), as well [31]. Whereas fail-silent behavior must be ensured for every single wheel, it is still possible to decompose the availability requirement between the different wheels or axles, possibly resulting in an adjusted brake force distribution [9,32].

2.3. Principles of Reliability Engineering

The requirements listed in the preceding sections can often only be met by applying reliability engineering. Therefore, that topic shall be highlighted briefly.

Reliability, itself, can be defined as “the ability of a product or system to perform as intended (i.e., without failure and within specified performance limits) for a specified time in its life cycle conditions” [33]. For certain applications, such as braking systems, for instance, adequate reliability can be achieved by introducing redundancy.

In general, redundancy can be distinguished between active redundancy and standby redundancy. The pivotal difference between these two concepts is that a standby-redundant system incorporates a switch that changes the command from one unit (failed) to another unit that then takes over control, either from idling (hot standby) or from a non-operative (cold standby) state. In contrast, active-redundant systems incporporate several entities that work simultaneously in parallel. If a failure in one of the units occurs, the same functionality is still available without any switching elements. One important concept in this context is the so-called (majority) voting, where a failed unit is simply overruled by the intact entities [34].

3. Electro-Mechanical Brake Actuators

This section provides a brief overview of the components that comprise an EMB actuator. Additionally, redundancy concepts for the actuators are presented. One basis for this section is an extensive patent research (all relevant patents are listed below the References) related to electromechanical brake actuation.

3.1. Components of EMB Actuators

In general, an EMB actuator or at least the EMB actuation function, comprises at a minimum one sensor, one control unit, and one electric motor with rotation-to-translation gear, in accordance with the input–process–output (IPO) model. Figure 1 shows schematically an EMB actuator for a parking brake. The (sub-)components that are discussed in this section are marked in bold and red.

3.1.1. Sensors

Sensors can be implemented in the actuator to (a) measure the drive dynamic behavior of the vehicle and to (b) monitor the actuator itself (i.e., uncommanded actuation). While this paper focuses on the measurands themselves, descriptions of the physical measuring principles and possible sensor types are reviewed in [36,37,38].

The patent research showed that the most common measurands required by the actuators are:

• Brake force or pressure;

• Wheel speed;

• Rotational angle of motor (of EMB).

It should benoted that a brake force sensor can correspond to costs of up to USD 15 in mass production, considering the sensor, the amplifier, and connections [39]. As a result, it could be profitable to avoid the force sensor by using the model-based estimated force, also referred to as analytical redundancy. Model-based estimation takes advantage of the fact that the measurements of different physical attributes of a single process are correlated with one another. Therefore, it is possible to derive one measurement from another [35].

Schwarz et al. [40] first proposed measuring the brake pad position by measuring motor rotor position and motor current. Many others followed, showing that a force sensor can be saved by measuring the electric attributes of the motor and its position [39,41,42,43,44].

3.1.2. Control Unit

The purpose of an ECU, in the context of an EMB system, consists in the conversion of a brake request to an explicit actuation of the brake motor.

Following a specific braking request by the driver or an automated driving function, various applications such as ASS (Anti-Skid System) or ESC (Electronic Stability Control) are executed to ensure vehicle stability, determining the braking force required at each wheel.

The controller allocated to the ECU finally compares the estimated and the required braking force at each wheel and drives the motor using a closed control loop [8]. The described function of the control unit may be accomplished by different control entities connected by communication links. In general, a control unit consists of a central power unit (CPU), a memory unit, a power supply unit, and a communication interface [45].

3.2. Redundancy Concepts for EMB Actuators

As mentioned in the introduction, EMB systems usually have neither mechanical nor hydraulic links between the driver and the brake actuator. This means that the driver is no longer—as in conventional BBW systems—the backup solution if the EMB system does not work as desired. A suitable and optimal redundancy concept is one of the biggest challenges presented in EMB development.

Redundancy concepts concern the E/E architecture considering E-Supply, ECU topology, or sensor concepts. This contribution focuses on redundancy concepts for the electromechanical components of a single EMB actuator.

Section 2 shows that certain reliability requirements for EMB actuators exist, starting from ASIL B items that need to achieve failure rates of λ ≤ 10⁻⁷ 1/h [25]. With reference to [46] citing [47], an electric motor by itself possesses a failure rate of approximately λ = 9 ×10⁻⁶ 1/h, disregarding its periphery as there are gears (λ = 4.7 × 10⁻⁶ 1/h) and related wiring (λ = 10⁻⁶ 1/h). Eventually, it is obvious that a certain redundancy could be necessary to comply with the required failure rate. Table 6 shows four different redundancy concepts found in the studied patents, exemplarily shown as disk brake configurations.

3.2.1. Redundant Single Entity

This option increases reliability by adding two stator assemblies to a single rotor, as realized in the patent [48]. However, it is key that no interdependence between the different stators exists, as this would lead to common cause failures.

3.2.2. Independent Pads

According to Table 5, a degradation of the service braking system can be tolerated by ASIL A if its magnitude is small enough. Following this approach, patents describe an EMB actuator that has two independent brake systems (motor, translation, pad) [49,50]. A failure (in a silent manner) of a single motor leads to a reduction in braking power by half. An uncommanded activation failure of a single motor eventually results in a low uncommanded deceleration of the vehicle, causing only a small safety impact.

3.2.3. Addition Gear

A failure of one motor leads to a performance degradation of the actuator if the motors are not oversized. A significant difference compared to independent pads is that an uncommanded movement of one motor can be absorbed by being counteracted by another motor using an addition gear. However, the disadvantage is that the addition gear and the shaft exist as common components. This could possibly result in common cause failures of the actuator. Another embodiment of this approach is the series [51] or parallel connection [50] of the motors. Our research showed that this approach is often mentioned in inventions and patent applications [52,53,54,55,56,57,58].

3.2.4. Parking Brake for Integrity

The functionality of the parking brake is to lock the wheel while the vehicle is in standstill and to provide a certain deceleration in case of an emergency at low vehicle velocity [15]. However, the locking functionality can be used to lock the service brake against uncommanded movement. This locking functionality can provide integrity to the service brake. Some inventions are designed to be able to take advantage of this effect [57,59,60,61,62,63,64,65].

3.3. Thermal Safety

The actuation of an EMB is produced by an electric motor. This motor requires certain temperature conditions in order to be able operate well. Depending on the motor insulation class, the maximum allowable temperature of commonly available electric motors can range from 105 °C (Tolerance Class A) to 180 °C (Tolerance Class H) [66]. If the motor is operated outside these conditions, it will be derated, leading to a degradation of available brake performance and a decrease in component lifetime.

On the other hand, the EMB is situated in a very harsh environment, where disc brakes may easily reach temperatures of approximately 400 °C during strong braking [67,68]. This heat might be radiated, dissipated, or conducted to the EMB motor during braking maneuvers. A potential threat would exist if the temperature of the motor rose above its limitations due to heat transfer.

No publications could be found that address this topic explicitly. However, several publications investigate the decrease of brake disk temperature due the introduction of venting holes [67,68,69]. Another approach is to tolerate the failure of one stator assembly due to overheating by applying a 2 × 3 phase electric motor, as presented in Section 3.2.1 [70].

4. EMB Systems

This section discusses current developments in EMB systems on a topological level. Both architectures the explored in Section 3 as well as the requirements investigated in Section 2 will be considered for the system. Figure 2 shows a schematic diagram of the X circuit topology of an EMB system. The topics addressed in this sections are highlighted in color, and are: control topology, E-supply (-) and communication ().

4.1. Power Supply

The power supply generally has the task of storing the energy (from the recuperation or public charging network) and safely delivering the energy (the focus of this paper) to consumers if necessary [71].

4.1.1. Reliable Power Supply

Due to the availability requirements, a redundant power supply is necessary [31,72,73,74,75]. This is already in place for electric and hybrid cars, which possess a higher voltage network (up to 400 V) for propulsion and a low-voltage (12 V or 48 V) supply for standard consumers [31,76]. Providing a highly available power supply realized within a single network can be ensured by implementing decentralized backup power storage where necessary [77].

4.1.2. Power Supply in the EMB Context

Conventional hydraulic brake systems use two brake circuits in an X or H arrangement. Many EMB system inventions have been presented that revert to this design by replacing the hydraulic lines with power lines of an equivalent voltage [46,72,78,79,80,81,82,83,84]. Alternatives have also been proposed. Bosch [82], Audi [85], and Kipping et al. [73] provided full redundancy by connecting every EMB to two equivalent supplies. Full redundancy as described in these references is advantageous if a redundant actuator is in place where a single power supply represents the threat of a single point failure. Continental [86] and BYD [87] developed this full redundancy further by using the conventional X or H arrangement for the low-voltage network and taking advantage of a high-voltage network that was additionally connected to every EMB. In contrast, [56] described an EMB system with a simplex power supply, adding local power storage to every EMB actuator, as proposed in [77]. A similar approach is to use the kinetic energy of the wheel to power a generator that can act as a backup power supply for the EMB [88]. Table 7 gives an overview of the described topologies.

4.2. Communication

The communication system has the purpose of providing a means to exchange data between differently located control entities [89,90]. It must satisfy very high standards of availability and reliability, as well as possess real-time properties for safety-critical functions [14].

4.2.1. Ethernet as the Future

Intelligent driving requires the processing and exchange of high amounts of data, resulting in a rising demand for bandwidth. The demand for bandwidth is added on top of the aforementioned general requirements [91,92]. Automotive Ethernet complies with all of these requirements [91,93], while also being low cost [13,94]. As a result, it is forecast to be the next automotive standard technology [13,14,91,93].

4.2.2. Topologies

Ethernet, as it is expected to be the future communication standard, only allows for point-to-point connections. Eventually, star-and-ring topologies could be implemented in future EMB communication systems. The advantage of a bidirectional ring topology is the per se failure tolerance of a failed wire or communication entity by using the ‘other direction’ of the ring to exchange data [73,95]. A star configuration, in contrast, is axiomatically not failure tolerant, considering the central switch as a potential single point failure [10]. However, the physical redundancy of the switch, resulting in alternate network routing, exists in the case of a failure [89]. The aviation industry has deployed AFDX (Avionics Full-Duplex Switched Ethernet), applying this principle [72].

4.3. Control

As mentioned in the Introduction, the control architecture of cars has undergone a steady growth in terms of functions and the number of ECUs, leading to an amount of over 100 ECUs, nowadays. Therefore, it is necessary to discuss strategies to counteract that development while nonetheless achieving safety.

4.3.1. Integration Concepts

The key to the reduction of ECUs and, eventually, complexity is the integration of different functions on a single controller [95]. The real-time operating system (RTOS) is the enabler for this development. In this sense, the main requirements for RTOS are [96]:

• Resource management (e.g., CPU, memory, disc drives);

• Service execution and provision for application software;

• Timing.

Partitioning refers to the prevention of interference between different applications related to timing (temporal partitioning) or resources (spatial partitioning) [96]. This enables the integration of applications with mixed criticality on a single controller [95]. The aviation industry has already implemented this function integration with the rollout of the A380 in 2005, incorporating ‘IMA’ (Integrated Modular Avionics) [97]. IMA is based on the ARINC 653 standard, which defines its interfaces [96]. AUTOSAR reflects a similar approach in the automobile industry [98].

4.3.2. Fault-Tolerant Control Strategies

The commonly known fault-tolerance strategies include duplex, triplex and quadruplex redundancy [99].

The duplex topology consists of two (=duo) entities. The first entity is responsible for the command of the actuators, whereas the second entity is only responsible for the monitoring of the command entity. If the monitor detects a discrepancy, it shuts the whole duplex module down, and thus cares for the integrity and the fail-silent behavior of the module (see EGAS) [31,72]. Another implementation of a duplex behavior is the so-called ‘lockstep controller’, which incorporates both command and monitoring, which are run on two separated cores [75,100]. Duplex redundancy might be used for systems with a safety level up to ASIL C [75]. The disadvantage of this topology is that a fail-operational behavior (see Requirement D.14) cannot be provided [99,100]. Nevertheless, it is of course possible to implement several duplex modules in parallel, providing fail-operational behavior [100].

The other topologies consist of three (triplex) or four (quadruplex) entities. If one entity fails, the other modules can detect this and eventually shut the affected entity down in order to realize fail-operational behavior, representing a permutated system.

4.4. Embedding EMB Actuators into the System

A strong minority of systems can be found that surrender the use of controllers in the EMB actuator itself, reducing the complete control to a centralized duplex module. If the entities of the duplex modules have no capacity for self-monitoring, these systems reflect fail-silent systems [87,101]. Mando [102] considered this challenge when stating that if the monitoring entity detected a failure in the command entity, it would take over control by itself. More common are systems that use so-called ‘smart’ actuators, which incorporate their own control unit, as presented in Section 3. This section focuses on this implementation.

A design pattern that can be found repeatedly is the use of the conventional two brake circuits (cf. Section 4.1), with each brake circuit having its own central control unit that commands the responding EMB actuators [48,82,83,103,104]. The fault tolerance consists of the fact that if one control unit fails, the second brake circuit can still operate properly. However, a degradation in total braking performance needs to be tolerated.

In contrast, [80,86,105] describe a triplex topology for the centralized control modules that can withstand at least a first failure. Eventually, full braking capability will be available even after this first failure.

Refs. [106,107] add another control unit to improve the failure tolerance further, implementing a quadruplex system. The fact that the vehicle operates four wheels is capitalized on by simply using the smart actuators mutually as a quadruplex system. Centralized functions such as ESC are simply deployed on every single actuator, so that each calculates the command for every wheel [31,73]. In addition to its strong failure tolerance, this topology might be very cost-efficient [73].

Finally, Refs. [79,99,108] went one step further in merging the presented wheel-node quadruplex system with a central module (duplex or simplex). The central module incorporates the higher control functions, such as ESC and ASS. If this module fails, however, the smart actuators receive their braking commands directly from the driver pedal. Although a degradation can be noticed due to the missing higher functions, the braking system is still capable of deploying the full braking force in the case of degradation. Table 8 gives an overview of the discussed control topologies.

5. Summary and Outlook

A review of EMB systems related to safety concepts (requirements, E/E architecture, redundancy, degradation strategies) was provided in this contribution. Although there is existing literature related to this topic, not much research has been published investigating the safety criticality of different malfunctions of the braking system. Furthermore, no distinct evaluation exists on that specific topic. Therefore, attention needs to be devoted to this specific topic, with represents the starting point for EMB systems.

Additionally, only a small number of publications have been found that harmonize the design of the EMB actuator with the complete EMB system. This volume is minimized again when considering the challenges posed by electric, automated driving vehicles for such a system. Synergies thereof need to be taken in account, as well.

Finally, a universal set of Key Performance Indicators must be found to be able to evaluate different options and to find superior design solutions.

6. Patents

DE102006010713 B4; CN111873958 A; CN106347339 A; KR20100030010 A; WO21122214 A1; US2016339897 AA; DE102019217601; WO09007505 A1; KR20110060260 A; US2006061210 AA; US6272421 BA; US2005167212 AA; DE102019128742 A1; KR20040022900 A; KR20210002011 A; KR20210002010 A; KR20090119486 A; KR20090064732 A; DE102006053617 A1; US6189981 BA; FR2855611 A1; US6317675 BA; US6397981 BA; WO21139954 A1; CN113110238 A; CN112550189 A; US2016009260 AA; KR20120027613 A; DE102015203717 A1; CN209146188 U; DE102019128741 A1; US2001020562 AA; US2010007199 AA; US6536562 BA; US6213256 BA; US2010147633 AA; CN107150674 A; WO20193420 A1; DE10319082 B3; EP1174322 A1; US6279690 BA; US2009278401 AA; WO9736116A1; CN209852287 U; CN111319596 A; KR20120000838 A; CN113389828 A; KR101721654 B1; DE102009046231 A1; US2021108692 AA; WO0037818 A1; US2009107740 AA; US2020180582 AA; DE102009046238 A1; US6774595 BA; FR2952011 A1; US2005006948 AA; US2014214269 AA; KR20100030012 A; KR20040022885 A; WO21047910 A1; KR20160103465 A; US2009223752 AA; US2010243388 AA; US2005127749 AA; CN109899422 A; KR20200098219 A; DE10312822 A1; FR2952886 A1; US2004040799 AA; CN211550350 U; WO09124810 A1; DE102011076424 A1,; KR20140057893 A; WO03054412 A1; KR20100008413 A; DE102020213916A1; CN102180163 A; US2019176789 AA; CN112721884 A; CN211202695 U; KR20130037018 A; DE102007001371 A1; DE102006027206 A1; KR20210002280 A; WO21158022 A1; US6340077 BA; DE102018218472 A1.

Author Contributions

Conceptualization, S.S., X.N., A.V. and D.S.; investigation, S.S.; writing—original draft preparation, S.S.; writing—review and editing, D.S. and X.N.; visualization, S.S.; supervision, X.N. and D.S. All authors have read and agreed to the published version of the manuscript.

Informed Consent Statement

Not applicable.

Conflicts of Interest

The authors declare no conflict of interest.

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

Figures and Tables

Figure 1. Scheme of an EMB actuator for a parking brake, based on [25,35].

Figure 2. Scheme of an EMB system; shown is an exemplary X circuit topology.

Table 1

Sections of the standard documents related to the design requirements for intact EMB service braking systems.

ID	Requirement	EU + UK	USA	China	India	Canada
D.01	Two independent energy reserves	5.2.25.2.4	-	4.2.2	4.2.1	-
D.02	Two independent energy transmissions	5.2.25.2.4	-	4.2.2	4.2.1	-
D.03	Each energy reserve must be connected to two or more wheels	5.2.2	-	4.2.2	4.2.1	-
D.04	Each energy transmission must be connected to two or more wheels	5.2.2	-	4.2.2	4.2.1	-
D.05	All 4 wheels shall be actuated by brakes	5.2.6	14.24	4.2.7	4.2.1	5.1
D.06	Regenerative braking is allowed to be applied alone	5.2.7	-	-	-	-
D.08	ESC (Electronic Stability Program) shall apply braking torque to the wheels individually	UN ECER140	FMVSS 126	-	-	TSD126
D.09	Brake shall return to OFF position when released	5.2.2	-	-	-	-

Table 2

Sections of the standard documents related to the performance requirements for intact EMB service braking systems.

ID	Requirement	EU + UK	USA	China	India	Canada
P.01	Provide more than 6.43 m/s² deceleration with the engine disconnected	A3.2	14.7	5.2.1	4.1.1	5.1.1
P.02	Provide more than 5.67 m/s² deceleration with the engine connected	A3.2	14.8	5.2.1	4.1.1	5.1.1
P.03	Energy reserve must be dimensioned to halt vehicle 10 times from 100 km/h	5.2.45.2.20	14.18	-	4.2.1	5.1.2.2
P.04	Energy supply must be dimensioned to halt vehicle according to P.11	5.2.4	-	4.2.54.2.14	4.2.1	-
P.05	Transmission delay must be less than 0.6 s	A3.3	-	5.4.1	4.3.1	-

Table 3

Sections of the standard documents related to the performance requirements for degraded EMB service braking systems.

ID	Failure	Requirement	EU + UK	USA	China	India	Canada
P.11	1st Circuit	Provide more than 2.6 m/s² deceleration	A3.2	14.14	5.2.1	4.1.2	5.1.2.1
P.12	ASS	Provide more than 5.15 m/s² deceleration	A6.4	14.12	-	9.5.4	5.5.2
P.13	Brake Distr.	Provide more than 3.86 m/s² deceleration with the engine disconnected	A5.4	14.1314.17	A6	-	-
P.14	Power Brake Unit	Performance of P.11	-	14.18	-	-	5.1.3.1
P.15	Booster	Performance of P.11	-	14.21	5.2.3	-	5.1.3.1
P.16	Any 1st E/E	Performance of P.01 must still be available	-	-	-	-	5.1.3.5

Table 4

Sections of the standard documents related to the design requirements concerning failure tolerance of EMB service braking systems.

ID	Failure	Requirement	EU + UK	USA	China	India	Canada
D.11	any	No unintended application	5.2.9	-	-	-	-
D.12	E-Supply	E-reserves must tolerate it	5.2.15	-	-	-	-
D.13	Transmission	No unintended application of parking brake	5.2.19	-	-	-	-
D.14	Any 1st	Application still possible	5.2.20	-	-	-	-
P.15	Booster	Performance of P.11	-	14.21	5.2.3	-	5.1.3.5

Table 5

ASIL classifications of malfunctions of service braking systems.

	Malfunction	Range [m/s2 or °]		ASIL
		from	to	D	C	B	A
Alarm to Drive	Degradation of deceleration	10	6.5				[2]
	Degradation of deceleration	6.5	2.44		[30]	[2]
	Degradation of deceleration	2.44	0	[2,9,29,30]	[9]	[9]
	Unintended activation	0	2.44	[31]
	Unintended activation	2.44	6.5	[31]		[2]
	Unintended activation	6.5	10	[31]	[2]
No Alarm	Degradation of deceleration	10	6.5			[2]
	Degradation of deceleration	6.5	2.44		[2,30]
	Degradation of deceleration	2.44	0	[2,9,29,30]	[9]	[9]
Unintended yaw		15	180	[2]
Unintended yaw		0	15			[2]
Incorrect brake torque		-	-	[30]
Unintended activation of actuator		-	-	[31]
Passivation of one actuator		-	-		[31]

Table 6

EMB actuator redundancy concepts exemplarily shown as disk brake configurations.

[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]
No Redundancy(for Comparison)	Redundantsingle Entity	Independent Pads	Addition Gear	Parking Brake for Integrity
Legend:	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]

Table 7

Overview of power supply topologies.

[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]
X-Circuits	H Circuit	Full Redundancy	X Circuit +High-VoltageRedundancy	Local EnergySupplies as Backup

Table 8

Overview of Control Topologies.

[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]	[Image omitted. Please see PDF.]
X-Circuit	H-Circuit	Triplex-Topology	Quadruplex-Topology	Hybrid Topology

References

1. Unknown,. Autopilot Review. 2021; Available online: https://www.autopilotreview.com/2020-mercedes-benz-s-class-to-offer-eyes-off-level-3-autonomous-driving/ (accessed on 31 December 2021).

2. Auguste, A. Hitachi ASTEMO. Autonomous Driving and Safety Requirements for Braking Systems for Different Automation Levels; China Automotive Steering & Braking Summit 2021: Shanghai, China, 2021.

3. Diehl, P. Elektromechanische Bremse: Schraubzwinge. Auto Service Praxis, Internet. 2015; Available online: https://www.autoservicepraxis.de/naachrichten/autotechnik/elektromechanische-betriebsbremse-schraubzwinge-2520511 (accessed on 31 December 2021).

4. Xiang, W.; Richardson, P.C.; Zhao, C.; Mohammad, S. Utomobile Brake-by-Wire Control System Design and Analysis. IEEE Trans. Veh. Technol.; 2008; 57, pp. 138-145. [DOI: https://dx.doi.org/10.1109/TVT.2007.901895]

5. Sababha, B.H.; Alqudah, Y.A. A Reconfiguration-Based Fault-Tolerant Anti-Lock Brake-by-Wire System. ACM Trans. Embed. Comput. Syst.; 2018; 17, pp. 1-13. [DOI: https://dx.doi.org/10.1145/3242178]

6. Schriek, J. Challenge of Change—Reliability and Safety of Innovative E/E-Systems for X-by-wire Features. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2004.

7. Lee, K.J.; Ki, Y.H.; Cheon, J.S.; Hwang, G.; Ahn, H.S. Approach to functional safety-compliant ECU design for electro-mechanical brake systems. Int. J. Automot. Technol.; 2014; 15, pp. 325-332. [DOI: https://dx.doi.org/10.1007/s12239-014-0033-7]

8. Cheon, J.S. Brake By Wire System Configuration and Functions using Front EWB (Electric Wedge Brake) and Rear EMB (Electro-Mechanical Brake) Actuators. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2010.

9. Cheon, J.S.; Kim, J.; Jeon, J.; Lee, S.M. Brake By Wire Functional Safety Concept Design for ISO/DIS 26262. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2011.

10. Möller, D.P.F.; Haas, R.E. Automotive E/E and Automotive Software Technology. Guide to Automotive Connectivity and Cybersecurity; Springer International Publishing: Cham, Switzerland, 2019; pp. 83-169.

11. Johansson, L.-Å.; Lindahl, M.; Sivencrona, H.; Törngren, M. ODEEP—Open Dependable Electrical and Electronics Platform—Concept and Projects. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2005.

12. Rieth, P.E.; Raste, T. Future Integration Concepts for ADAS. Handbook of Driver Assistance Systems; Springer International Publishing: Cham, Switzerland, 2015; pp. 1399-1411.

13. Bello, L.L. The case for ethernet in automotive communications. ACM SIGBED Rev.; 2011; 8, pp. 7-15. [DOI: https://dx.doi.org/10.1145/2095256.2095257]

14. Chakraborty, S.; Lukasiewycz, M.; Buckl, C.; Fahmy, S.; Chang, N.; Park, S.; Kim, Y.; Leteinturier, P.; Adlkofer, H. Embedded systems and software challenges in electric vehicles. Proceedings of the 2012 Design, Automation & Test in Europe Conference & Exhibition (DATE); Dresden, Germany, 12–16 March 2012.

15. Kords, M. statista.com. Statista GmbH. 2021; Available online: https://de.statista.com/statistik/daten/studie/734067/umfrage/anzahl-verkaufter-automobile-nach-laendern-weltweit/ (accessed on 1 January 2022).

16. European Union. Regulation No 13-H of the Economic Commission for Europe of the United Nations (UN/ECE)—Uniform Provisions Concerning the Approval of Passenger Cars with Regard to Braking [2015/2364]; European Union: Brussels, Belgium, 2015.

17. U.S. Department of Transportation. Laboratory Test Procedure For FMVSS 135 Light Vehicle Brake Systems; U.S. Department of Transportation: Washington, DC, USA, 2005.

18. General Administration of Quality Supervision, Inspection and Quarantine of People’s Republic of China. Technical Requirements and Testing Methods for Commercial Vehicle and Trailer Braking Systems GB 12676-2014; General Administration of Quality Supervision, Inspection and Quarantine of People’s Republic of China: Beijing, China, 2014.

19. Bureau of Indian Standards. Automotive Vehicles—Brakes and Braking Systems: Part 2 General Functions and Features; Bureau of Indian Standards: New Delhi, India, 2004.

20. Bureau of Indian Standards. Automotive Vehicles—Brakes and Braking Systems: Part 9 Requirements for Vehicles equipped with Anti-Lock Braking Systems; Bureau of Indian Standards: New Delhi, India, 2003.

21. Transport Canada. Technical Standards Document No. 105, Revision 5—Hydraulic and Electric Brake Systems; Transport Canada: Ottowa, ON, Canada, 2015.

22. UN ECE. United Nations Economic Commission for Europe. Available online: https://unece.org/mission (accessed on 1 January 2022).

23. International Standard Organisation. ISO 26262-3: Road Vehicles—Functional Safety—Part 3: Concept Phase; International Standard Organisation: Geneva, Switzerland, 2018.

24. Verband der Automobilindustrie. VDA 702: Situationskatalog E-Parameter nach ISO 26262-3; Dokumentation Kraftfahrwesen: Berlin, Germany, 2015.

25. International Standard Organisation. ISO 26262-5: Road Vehicles—Functional Safety—Part 5: Product Development at the Hardware Level; International Standard Organisation: Geneva, Switzerland, 2018.

26. International Standard Organisation. ISO 26262-8: Road Vehicles—Functional Safety—Part 8: Supporting Processes; International Standard Organisation: Geneva, Switzerland, 2018.

27. International Standard Organisation. ISO 26262-9: Road Vehicles—Functional Safety—Part 9: Automotive Safety Integritey Level (ASIL)-Oriented and Safety-Oriented Analyses; International Standard Organisation: Geneva, Switzerland, 2018.

28. Ward, D.D.; Crozier, S.E. The uses and abuses of ASIL decomposition in ISO 26262. Proceedings of the 7th IET International Conference on System Safety, incorporating the Cyber Security Conference 2012; Edinburgh, UK, 15–18 October 2012.

29. Sinha, P. Architectural design and reliability analysis of a fail-operational brake-by-wire system from ISO 26262 perspectives. Reliab. Eng. Syst. Saf.; 2011; 96, pp. 1349-1359. [DOI: https://dx.doi.org/10.1016/j.ress.2011.03.013]

30. Parker, D.; Godof, A.; Papadopoulos, Y.; Saintis, L. A Study of Automatic Allocation of Automotive Safety Requirements in Two Modes: Components and Failure Modes. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2018.

31. MPutz, H.; Seifert, H.; Zach, M.; Peternel, J. Functional Safety (ASIL-D) for an Electro Mechanical Brake. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2016.

32. Liu, H.; Deng, W.; He, R.; Wu, J.; Zhu, B. Fault-Tolerant Control of Brake-by-Wire Systems Based on Control Allocation. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2016.

33. Kapur, K.C.; Pecht, M. Reliability Engineering; John Wiley & Sons: Hoboken, NJ, USA, 2014.

34. Department of Defence, USA. MIL-HDBK-338B, Military Handbook—Electronic Reliability Design Handbook; Department of Defence, USA: Fort Belvoir, VA, USA, 1998.

35. Muenchhof, M.; Beck, M.; Isermann, R. Fault Diagnosis and Fault Tolerance of Drive Systems: Status and Research. Eur. J. Control.; 2009; 15, pp. 370-388. [DOI: https://dx.doi.org/10.3166/ejc.15.370-388]

36. Zabler, E.; Finkbeiner, S.; Welsch, W.; Kittel, H.; Bauer, C.; Noetzel, G.; Emmerich, H.; Hopf, G.; Konzelmann, U.; Wahl, T. et al. Automotive Sensors. Bosch Automotive Electrics and Automotive Electronics; Springer Fachmedien Wiesbaden: Wiesbaden, Germany, 2014; pp. 208-231.

37. Zabler, E.; Finkbeiner, S.; Welsch, W.; Kittel, H.; Bauer, C.; Noetzel, G.; Emmerich, H.; Hopf, G.; Konzelmann, U.; Wahl, T. et al. Sensor Measuring Principles. Bosch Automotive Electrics and Automotive Electronics; Springer Fachmedien Wiesbaden: Wiesbaden, Germany, 2014; pp. 232-309.

38. Zabler, E.; Finkbeiner, S.; Welsch, W.; Kittel, H.; Bauer, C.; Noetzel, G.; Emmerich, H.; Hopf, G.; Konzelmann, U.; Wahl, T. et al. Sensor Types. Bosch Automotive Electrics and Automotive Electronic; Springer Fachmedien Wiesbaden: Wiesbaden, Germany, 2014; pp. 310-353.

39. Putz, M.H.; Seifert, H.; Zach, M.; Schiffer, M.; Peternel, J. Accuracy of Sensor-Less Control of an Electro-Mechanical Brake. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2015.

40. Schwarz, R.; Isermann, R.; Böhm, J.; Nell, J.; Rieth, P. Clamping Force Estimation for a Brake-by-Wire Actuator. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 1999.

41. Ki, Y.-H.; Ahn, H.-S.; Cheon, J.S. Fault-Tolerant Control of EMB Systems. SAE Int. J. Passeng. Cars Electron. Electr. Syst.; 2012; 5, pp. 579-589. [DOI: https://dx.doi.org/10.4271/2012-01-1795]

42. Hoseinnezhad, R.; Saric, S.; Bab-Hadiashar, A. Estimation of Clamp Force in Brake-by-Wire Systems: A Step-by-Step Identification Approach. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2006.

43. Schmidt, P.B.; Gasperi, M.L.; Ray, G.; Wijenayake, A.H. Initial rotor angle detection of a nonsalient pole permanent magnet synchronous machine. Proceedings of the IAS’97. Conference Record of the 1997 IEEE Industry Applications Conference Thirty-Second IAS Annual Meeting; New Orleans, LA, USA, 5–9 October 1997.

44. Hwang, W.; Han, K.; Huh, K. Fault detection and diagnosis of the electromechanical brake based on observer and parity space. Int. J. Automot. Technol.; 2012; 13, pp. 845-851. [DOI: https://dx.doi.org/10.1007/s12239-012-0085-5]

45. Kaiser, M.; Aue, A. Steuergerät. Kraftfahrtechnisches Taschenbuch; Springer Fachmedien: Wiesbaden, Germany, 2019; pp. 1420-1429.

46. Isermann, R. Fehlertolerante mechatronische Systeme, Teil 1 (Fault-tolerant Mechatronic Systems, Part 1). at-Autom.; 2007; 55, pp. 170-179.

47. U.S. Department of Defence. MIL-HDBK-217F: Reliablity Prediction of Electronic Equipment; U.S. Department of Defence: Washington, DC, USA, 1991.

48. Weiberle, R. Elektrisches Bremssystem, Insbesondere Elektromechanisches Bremssystem. Germany Patent; DE102009046238B4, 4 November 2021.

49. Bei, S.; Zhang, L.; Lai, X.; Wang, Z.; Tong, X.; Bian, J.; Ma, Z.; Wang, K. Self Power Supply Type Double-Motor Brake Execution Mechanism of Automobile Electro-Mechanical Brake System. China Patent; CN106347339A, 25 January 2017.

50. Takahashi, H.; Takahashi, K. Electric Brake. U.S. Patent; US7806241B2, 5 October 2010.

51. Fu, Y.; Qin, C.; Liu, Q.; Gao, Q.; Shu, X. Electromechanical Brake Device and Vehicle with Same. China Patent; CN211202695U, 7 August 2020.

52. Nuesse, D. Elektromechanische Bremsvorrichtung für ein Fahrzeug. Germany Patent; DE102018218472A1, 3 April 2020.

53. Gohbrandt, J.; Stroschein, J. Verfahren zum Erkennen von Schäden an Mechanischen Bauteilen einer Elektromechanischen Bremse, Elektronisch Gesteuertes Bremssystem, Computerprogrammprodukt, Steuergerät und Kraftfahrzeug. Germany Patent; DE102019128742A1, 29 April 2021.

54. Martin, S. Elektromechanische Bremse zum Abbremsen einer Sich Drehenden Komponente und Bremsanlage mit Einer Elektromechanischen Bremse. Germany Patent; DE10319082 B3, 16 December 2004.

55. Schumann, F. Elektromechanische Bremsvorrichtung. Germany Patent; WO9736116A1, 2 October 1997.

56. Kim, S. Disk Break Apparatus For Electromechanical Brake System. U.S. Patent; US2009223752A1, 10 September 2009.

57. Hartmann, H.; Schautt, M. Fail-Safe Concept for an Electromechanical Brake. U.S. Patent; US7748793B2, 26 November 2004.

58. Sim, G.; Jian, J. Electro-Mechanical Brake System and Method for Operating Same. Korea Patent; WO2021158022A1, 12 August 2021.

59. Saitner, M.; Keller, R. Elektrisch betreibbare Parksperrenvorrichtung für ein Fahrzeuggetriebe. Germany Patent; DE102009028858A1, 3 March 2011.

60. Schade, K.; Linhoff, P. Elektromechanische Bremse und zugehöriges Betriebsverfahren. Germany Patent; DE102011076424A1, 29 November 2012.

61. Keski-Luopa, M. Sähkömekaaninen Seisontajarrujärjestely. Finland Patent; FI119855B, 6 July 2007.

62. Yang, L.; Liu, S.; Ma, F.; Miao, F. Electromechanical Brake Cylinder with Parking Function and Brake System. China Patent; CN111319596 A, 23 June 2020.

63. Laxhuber, T.; Baumgartner, H.; Pahle, W. Device and Method for Monitoring a Brake-Applying Electromechanical Device for Vehicle Brakes. U.S. Patent; US6774595B1, 10 August 2004.

64. Friesen, U. Electromechanical Brake Applying Device. U.S. Patent; US2005006948A1, 13 January 2005.

65. Schaffer, W. Electromechanical Wheel Brake System. U.S. Patent; US6340077 BA, 27 May 1999.

66. The Engineering Toolbox. NEMA Insulation Classes. 2004; Available online: https://www.engineeringtoolbox.com/nema-insulation-classes-d_734.html. (accessed on 21 July 2022).

67. Belhocine, A.; Bouchetara, M. Thermal–Mechanical Coupled Analysis of a Brake Disk Rotor. ASM Int.; 2013; 49, pp. 167-176.

68. Najmi, H.; Kumar, N.; Singh, A.; Singh, R.; Kumar, S. Thermal analysis of brake disc of an automobile. Proceedings of the International Conference on Futuristic and Sustainable Aspects in Engineering and Technology (FSAET 2020); Mathura, India, 18–19 December 2020; IOP Conference Series: Materials Science and Engineering Volume 1116, pp. 1-14.

69. Jian, Q.; Wang, L.; Shui, Y. Thermal analysis of ventilated brake disc based on heat transfer. Int. J. Therm. Sci.; 2020; 155, 106356. [DOI: https://dx.doi.org/10.1016/j.ijthermalsci.2020.106356]

70. Hwang, K.Y.; Song, B.K.; Kwon, B.I.K. Asymmetric dual winding three-phase PMSMfor fault tolerance of overheat in electricbraking system of autonomous vehicle. IET Electr. Power Appl.; 2019; 13, pp. 1891-1898. [DOI: https://dx.doi.org/10.1049/iet-epa.2018.5973]

71. Fassnacht, J. Bordnetze für Hybrid- und Elektrofahrzeuge. Kraftfahrtechnisches Taschenbuch; Springer Fachmedien: Wiesbaden, Germany, 2019; pp. 1304-1309.

72. Bergmiller, P. Design and Safety Analysis of a Drive-by-Wire Vehicle. Automotive Systems Engineering; Springer: Berlin/Heidelberg, Germany, 2013; pp. 147-202.

73. Kelling, N.A.; Heck, W. The BRAKE Project—Centralized Versus Distributed Redundancy for Brake-by-Wire Systems. SAE Technical Paper Series; SAE World Congress & Exhibition: Detroit, MI, USA, 2002.

74. Koehler, A.; Bertsche, B. An Approach of Fail Operational Power Supply for Next Generation Vehicle Powernet Architectures. Proceedings of the 30th European Safety and Reliability Conference and 15th Probabilistic Safety Assessment and Management Conference (ESREL2020-PSAM15); Venice, Italy, 1–5 November 2020.

75. Ross, H.-L. System Engineering for Development of Requirements and Architecture. Functional Safety for Road Vehicles; Springer International Publishing: Cham, Switzerland, 2016; pp. 75-199.

76. Gebert, J.; Bauer, F.; Chamas, M.; Meseth, M.; Michel, H.-U.; Singh, G.; Traub, M. HiBord: Hochverfügbare und Intelligente Bordnetztopologien für Automatisierte Fahrzeuge; BMW AG: Munich, Germany, 2020.

77. Kilian, P.; Kohler, A.; Bergen, P.V.; Gebauer, C.; Pfeufer, B.; Koller, O.; Bertsche, B. Principle Guidelines for Safe Power Supply Systems Development. IEEE Access; 2021; 9, pp. 107751-107766. [DOI: https://dx.doi.org/10.1109/ACCESS.2021.3100711]

78. Nilsson, A.; Linidqvist, A. An Electromechanical Brake System. China Patent; WO2021122214A1, 24 June 2021.

79. Niedermeier, E. Brake system for a motor vehicle. U.S. Patent; US6189981B1, 20 February 2001.

80. Stoelzl, S.; Giers, B.; Oehler, R.; Willimowski, P.; Boehm, J.; Nell, J.; Hoffmann, O. Electromechanical Brake System. U.S. Patent; US6317675B1, 1 September 2000.

81. Yan, L.; Hao, Z.; Sui, Q. EMB Redundancy Control System and Method. China Patent; CN113110238A, 13 July 2021.

82. Weiberle, R. Elektrisches Bremssystem, Insbesondere Elektromechanisches Bremssystem. Germany Patent; DE102009046231A1, 5 May 2011.

83. Doericht, M.; Schmid, R. Elektromechanische Kraftfahrzeug-Bremsvorrichtung. Germany Patent; WO0037818A1, 29 June 2000.

84. Weiberle, R.; Mueller, B.; Hassdenteufel, F. Electric Brake System i.e., Electromechanical Brake System, for Motor Vehicle, Has Brake Circuits Provided with Control Apparatuses, and Rolling Dynamics Control Unit Integrated in Each Control Apparatus. France Patent; FR2952011A1, 6 May 2011.

85. Winkler, J. Bordnetz für ein Fahrzeug und Verfahren zur Energieversorgung eines Sicherheitsrelevanten Verbrauchers eines Bordnetzes. Germany Patent; DE102006010713B4, 1 April 2010.

86. Holzwarth, J.; Krausen, L. System zur Aktorsteuerung, Insbesondere Bremssystem. Germany Patent; DE102006053617A1, 15 May 2008.

87. Liu, Q.; Qin, C.; Fu, Y.L.D.; Liao, K. Vehicle Electromechanical Brake System and Vehicle with Same. China Patent; CN112550189A, 26 March 2021.

88. Gehring, O.; Heilmann, H.; Schwarzhaupt, A.; Spiegelberg, G.; Sulzmann, A. Verfahren und Anordnung zur Regelung einer Bremsanordnung mit redundantem Energiepfad zur Energieversorgung der Regelungseinrichtung. Germany Patent; DE102004014623A1, 13 October 2005.

89. Basic Principles of Networking. Bosch Automotive Electrics and Automotive Electronics; Springer Fachmedien Wiesbaden: Wiesbaden, Germany, 2014; pp. 70-81.

90. Weiler, H.; Lorenz, W.; Prelle, O.; Thoss, D. Vernetzung im Kfz, Busse im Kfz. Kraftfahrtechnisches Taschenbuch; Springer Fachmedien: Wiesbaden, Germany, 2019; pp. 1450-1458.

91. Zhu, H.; Zhou, W.; Li, Z.; Li, L.; Huang, T. Requirements-Driven Automotive Electrical/Electronic Architecture: A Survey and Prospective Trends. IEEE Access; 2021; 9, pp. 100096-100112. [DOI: https://dx.doi.org/10.1109/ACCESS.2021.3093077]

92. Haas, W.; Langjahr, P. Cross-domain vehicle control units in modern E/E architectures. Internationales Stuttgarter Symposium; Springer Fachmedien Wiesbaden: Wiesbaden, Germany, 2016; pp. 1619-1627.

93. Abendroth, S. Automotive Ethernet as enabler for flexible EE architectures. Proceedings of the 4th International Conference Advanced Chassis and Safety Architecture; Stuttgart, Germany, 13 May 2013.

94. Hager, M.; Gromala, P.; Wunderle, B.; Rzepka, S. Affordable and Safe High Performance Vehicle Computers with Ultra-Fast On-Board Ethernet for Automated Driving. Advanced Microsystems for Automotive Applications 2018; Springer International Publishing: Cham, Switzerland, 2018; pp. 56-68.

95. Sommer, S.; Camek, A.; Becker, K.; Buckl, C.; Zirkler, A.; Fiege, L.; Armbruster, M.; Spiegelberg, G.; Knoll, A. RACE: A Centralized Platform Computer Based Architecture for Automotive Applications. Proceedings of the 2013 IEEE International Electric Vehicle Conference (IEVC); Santa Clara, CA, USA, 23–25 October 2013.

96. Ross, H.-L. System Safety Engineering. Safety for Future Transport and Mobility; Springer International Publishing: Cham, Switzerland, 2020; pp. 159-265.

97. Schmidt, D. The Airbus A380—Towards a New Futre for Air Transport; Airbus: Samara, Russia, 2007.

98. Autosar. Autosar. 2022; Available online: https://www.autosar.org/standards/classic-platform/ (accessed on 1 January 2022).

99. Isermann, R.; Schwarz, R.; Stölzl, S. Fault-tolerant drive-by-wire systems. IEEE Control Syst.; 2002; 22, pp. 64-81.

100. Ross, H.-L. Automated Driving and Control. Safety for Future Transport and Mobility; Springer International Publishing: Cham, Switzerland, 2020; pp. 307-390.

101. Nillson, A.; Lindqvist, A.; Dong, X. A Brake System For a Vehicle. China Patent; WO2021139954A1, 15 June 2021.

102. Kim, J.G. Brake System For Vehicle. U.S. Patent; US2010007199A1, 14 January 2010.

103. Huang, S.; Zhou, C.; Yang, L.; Qin, Y.; Huang, X.; Hu, B. Transient fault tolerant control for vehicle brake-by-wire systems. Reliab. Eng. Syst. Saf.; 2016; 149, pp. 148-163. [DOI: https://dx.doi.org/10.1016/j.ress.2016.01.001]

104. Weiberle, R.; Mueller, B.; Kriso, S. Electrical Brake System i.e., Electromechanical Brake System, for Motor Vehicle, Has Brake System Controlling CPU Transmitting Signal by Communication System of Brake Circuit, and Seizing Unit Directly Connected to Controller. France Patent; FR2952886A1, 27 May 2011.

105. Holzwarth, J. Electromechanical Brake System with a Failsafe Energy Supply and Method for Failsafe Energy Supply in an Electromechanical Brake System For Vehicles. U.S. Patent; US2010243388A1, 30 September 2010.

106. Choi, H.R.; Hyun, D.Y. Electromechanical Brake System having Suspension Control Function. U.S. Patent; US2021108692A1, 15 April 2021.

107. Fijalkowski, B.T. Anti-Lock EFMB or EPMB BBW AWB Dispulsion Mechatronic Control Systems. Automotive Mechatronics: Operational and Practical Issues; Springer: Dordrecht, The Netherlands, 2010; pp. 463-495.

108. Molfetta, D.; Ringlstetter, M.; Zelger, C. Redundante Übermittlung von Bremsanweisungen. Germany Patent; DE102007001371A1, 10 July 2008.