Fail operational electric brake system

An electric brake system comprising a brake control unit and a vehicle brake motor controlled by the brake control unit;

• the brake control unit comprising a primary control branch, a backup control branch, diagnostic utilities and mode control utilities;
• the primary control branch having a primary inverter and a primary control module to control operation of the primary inverter,
• the backup control branch having a backup inverter and a backup control module to control operation of the backup inverter,
• the diagnostic utilities being configured to determine an integrity status of both control branches and
• the mode control utilities being configured to select, in accordance with said determination of the integrity status, an operational mode of the brake control unit from a plurality of potential operational modes, the potential operational modes comprising a normal operational mode and a degraded operational mode;
• wherein respectively the primary control branch and the backup control branch are configured to generate a brake motor drive signal with their respective inverters being controlled by their respective control modules in response to an external brake control signal;
• wherein the primary control module includes at least first and second mutually cooperating primary control components with respective first and second diagnostic units that are part of said diagnostic utilities in that the first diagnostic unit of the first primary control component is configured to diagnose an integrity of the second primary control component, and the second diagnostic unit of the second primary control component is configured to diagnose an integrity of the first primary control component;
• wherein the diagnostic utilities further comprise a third diagnostic unit configured to diagnose an integrity status of the backup control branch by verifying a response signal of the backup control branch in response to a test signal.

Method of controlling a brake motor for a vehicle, comprising generating a brake motor drive signal in response to an external brake control signal, the method comprising:

• providing a primary control branch, a backup control branch, the primary control branch having a primary inverter and a primary control module to control operation of the primary inverter, the primary control module including at least a first and a second mutually cooperating primary control component, and the backup control branch having a backup inverter and a backup control module to control operation of the backup inverter;
• selecting an operational mode, in accordance with determination of an integrity status of both control branches, from a plurality of potential operational modes, the potential operational modes comprising a normal operational mode and a degraded operational mode, during the normal operational mode and enabling the primary control branch to exclusively generate the brake motor drive signal in response to the external brake control signal, in which the normal operational mode determining an integrity status comprises:
• the at least a first and a second mutually cooperating primary control component diagnosing each other's integrity status, and
• the primary control branch further diagnosing an integrity status of the backup control branch by verifying a response signal of the backup control branch in response to a test signal, during the degraded operational mode and enabling the backup control branch to exclusively generate the brake motor drive signal in response to the external brake control signal.