WO2025210431A1

WO2025210431A1 - System architecture implementing hw/sw diversity for controlling a braking system of a vehicle

Info

Publication number: WO2025210431A1
Application number: PCT/IB2025/052932
Authority: WO
Inventors: Massimo DI STEFANO; Manuel LAMONICA
Original assignee: Brembo SpA
Current assignee: Brembo SpA
Priority date: 2024-04-04
Filing date: 2025-03-20
Publication date: 2025-10-09
Anticipated expiration: 2026-10-04

Abstract

A system architecture (100) for controlling a braking system of a vehicle, said vehicle comprising: a first braking corner (1) comprising a respective first brake disc (D-1); a second braking corner (2) comprising a respective second brake disc (D-2); a third braking corner (3) comprising a respective third brake disc (D-3); a fourth braking corner (4) comprising a respective fourth brake disc (D-4). The system architecture (100) comprising: a first braking actuation module (S-1) associable with the first braking corner (1) of the vehicle, the first braking actuation module (S-1) being adapted to apply a braking action to said first brake disc (D-1); a second braking actuation module (S-2) associable with the second braking corner (2) of the vehicle, the second braking actuation module (S-2) being adapted to apply a braking action to said second brake disc (D-2); a third braking actuation module (S-3) associable with the third braking corner (3), the third braking actuation module (S-3) being adapted to apply a braking action to said third brake disc (D-3); a fourth braking actuation module (S-4) associable with the fourth braking corner (4), the fourth braking actuation module (S-4) being adapted to apply a braking action to said fourth brake disc (D-4); a central control unit (5) operatively connected to said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4). Each of said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, comprises at least one respective main data processing module (E1, E2, E3, E4), at least one respective actuator driving module (P1, P2, P3, P4), a respective actuator (M1, A1, M2, A2, M3, A3, M4, A4). Each of said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a software point of view, comprises a respective main actuator control module (CA1, CA2, CA3, CA4), a respective actuator safety monitoring module (SA1, SA2, SA3, SA4), and a backup actuator control module (B1, B2, B3, B4). The actuator safety monitoring module (SA1, SA2, SA3, SA4) is configured to detect a failure of the respective braking actuation module (S-1, S-2, S-3, S-4) and, if a failure of the braking actuation module (S-1, S-2, S-3, S-4) is detected, to also enable the backup actuator control module (B1, B2, B3, B4) to control the actuator. In said system architecture (100), from a software point of view, the actuator safety monitoring module (SA1, SA2, SA3, SA4) of a braking actuation module of said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) is implemented differently to perform the same actuator safety monitoring function with respect to the safety monitoring module (SA1, SA2, SA3, SA4) of at least another braking actuation module of said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4).

Description

DESCRIPTION

“System architecture implementing HW/SW diversity for controlling a braking system of a vehicle”

[0001]. Field of the invention

[0002]. The present invention relates to braking systems for vehicles, in particular to a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle.

[0003]. Background art

[0004]. System architectures distributed on a conventionally-driven, i.e., driver-operated, vehicle, which implement the same HW/SW components allocated in the braking corners of the vehicle, are currently known and widespread in the market.

[0005]. If the same failure occurs simultaneously in several braking corners of the vehicle (thus in case of a common failure), the actuation of a backup mechanism, which still ensures degraded deceleration performance, by the driver can easily take over.

[0006]. In a self-driving vehicle, e.g., a so-called Level 3 or higher (L3+) vehicle, since it cannot rely on the driver’s intervention, the manual actuation of a backup mechanism is obviously not possible if a common failure occurs on multiple braking corners of the vehicle.

[0007]. An alternative strategy must be provided to prevent/avoid possible common-cause failures, and this idea aims to suggest some system architectures with a combination of HW and SW diversity.

[0008]. In light of the above, nowadays, a need is strongly felt for system architectures implementing HW/SW diversity for controlling a braking system of a vehicle, whether self-driving or conventionally-driven, which are capable of preventing/avoiding problems if a common failure occurs on multiple braking corners of the vehicle so that the reliability of the so-called “wheel-distributed” braking system regardless of the type (e.g., electro-mechanical, electro- hydraulic), is not compromised.

[0009]. Summary of the invention

[0010]. It is the object of the present invention to devise and provide a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle which allows obviating, at least partially, the drawbacks complained of above with reference to the prior art, and in particular which is capable of preventing/avoiding problems if a common failure on multiple braking corners of the vehicle occurs so as to ensure and maintain high reliability of the so-called “wheel-distributed” braking system, regardless of the type thereof (e.g., electromechanical, electro-hydraulic).

[0011]. Such an object is achieved by a system architecture according to claim 1.

[0012]. Further advantageous embodiments of the system architecture are the subject of the respective dependent claims.

[0013]. Brief description of the figures

[0014]. Further features and advantages of the system architecture according to the invention will become apparent from the following description of preferred exemplary embodiments, given by way of non-limiting indication, with reference to the accompanying drawings, in which:

[0015]. - figure 1 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention;

[0016]. - figure 2 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention;

[0017]. - figure 3 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention;

[0018]. - figure 4 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention;

[0019]. - figure 5 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention, and

[0020]. - figure 6 shows, by means of a block chart, a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to an embodiment of the present invention.

[0021]. It should be noted that equal or similar elements in the drawings will be indicated by the same numeric or alphanumeric references.

[0022]. Description of some preferred embodiments

[0023]. Referring now to figures 1-6, reference numeral 100 indicates as a whole a system architecture implementing HW/SW diversity for controlling a braking system of a vehicle, according to the present invention.

[0024]. “Vehicle” means both a self-driving vehicle and a conventionally- driven vehicle, i.e. , a non-autonomous vehicle with a driver.

[0025]. Although the present invention addresses needs felt primarily in the braking systems of self-driving vehicles, it is also implementable in braking systems of conventionally-driven vehicles, e.g., especially if the braking system of the conventionally-driven vehicle does not include a manually actuatable backup mechanism.

[0026]. For the purpose of the present description, “HW/SW diversity” means the use of different hardware (HW) components (e.g., two different microprocessors) which meet the same requirement and the use of software (SW) modules (e.g., two control logics) configured to perform the same function but implemented differently.

[0027]. The possible functions executable by software modules employable in the present invention will be described below.

[0028]. As mentioned above, the system architecture 100 is usable for controlling a braking system of the vehicle, whether self-driving or conventional, i.e., non-autonomously driven.

[0029]. In this respect, the vehicle is a vehicle having at least four wheels distributed as follows:

[0030]. - a first wheel and a second wheel connected, respectively, on a first side (e.g., left side) and a second side (e.g., right side) of a first front axle of the vehicle;

[0031]. - a third wheel and a fourth wheel connected, respectively, on the first side (e.g., right side) and a second side (e.g., left side) of a second rear axle of the vehicle.

[0032]. According to this configuration, the vehicle comprises a first braking corner 1 comprising a respective first brake disc D-1 .

[0033]. The first braking corner 1 is arranged at the first wheel of the vehicle, e.g., the front left wheel, to which the first brake disc D-1 is connected.

[0034]. Therefore, the first braking corner 1 is definable as the front left corner F-L.

[0035]. Furthermore, the vehicle comprises a second braking corner 2 comprising a respective second brake disc D-2.

[0036]. The second braking corner 2 is arranged at the second wheel of the vehicle, e.g., the front right wheel, to which the second brake disc D-2 is connected.

[0037]. Therefore, the second braking corner 2 is definable as the front right corner F-R.

[0038]. Furthermore, the vehicle comprises a third braking corner 3 comprising a respective third brake disc D-3.

[0039]. The third braking corner 3 is arranged at the third wheel of the vehicle, e.g., the rear left wheel, to which the third brake disc D-3 is connected.

[0040]. Therefore, the third braking corner 3 is definable as the rear left corner R-L.

[0041]. Furthermore, the vehicle comprises a fourth braking corner 4 comprising a respective fourth brake disc D-4.

[0042]. The fourth braking corner 4 is arranged at the fourth wheel of the vehicle, e.g., the rear right wheel, to which the fourth brake disc D-4 is connected.

[0043]. Therefore, the fourth braking corner 4 is definable as the rear right corner R-R.

[0044]. Turning back in general to the present invention, as shown in the figures, the system architecture 100 comprises a first braking actuation module S-1 associable with (e.g., integrable in) the first braking corner 1 of the vehicle. [0045]. The first braking actuation module S-1 is adapted to apply a braking action to said first brake disc D-1 . [0046]. Furthermore, the architecture 100 comprises a second braking actuation module S-2 associable with (e.g., integrable in) the second braking corner 2 of the vehicle.

[0047]. The second braking actuation module S-2 is adapted to apply a braking action to said second brake disc D-2.

[0048]. Furthermore, the architecture 100 comprises a third braking actuation module S-3 associable with (e.g., integrable in) the third braking corner 3.

[0049]. The third braking actuation module S-3 is adapted to apply a braking action to said third brake disc D-3.

[0050]. Furthermore, the architecture 100 comprises a fourth braking actuation module S-4 associable with (e.g., integrable in) the fourth braking corner 4.

[0051]. The fourth braking actuation module S-4 is adapted to apply a braking action to said fourth brake disc D-4.

[0052]. According to the present invention, as shown in the figures, the system architecture 100 further comprises a central control unit 5 operatively connected to said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4.

[0053]. For example, the central control unit 5 is a specifically configured hardware module or software logic present in a main hardware module of the braking system of the vehicle or, more in general, of a hardware module of the vehicle 1 .

[0054]. The central control unit 5 is configured to perform dynamic vehicle control functions.

[0055]. According to the present invention, each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, comprises at least one respective main data processing module, indicated in the figures, respectively, by E1 , E2, E3, E4, at least one respective actuator driving module, indicated in the figures, respectively, by P1 , P2, P3, P4, a respective actuator, indicated in the figures, respectively, by M1 , A1 , M2, A2, M3, A3 and M4, A4.

[0056]. Each braking actuation module, in light of the presence of a respective main data processing module, can also be referred to as SAC (Smart Actuator Caliper).

[0057]. For example, the main data processing module is a microprocessor or microcontroller.

[0058]. The actuator driving module, according to different embodiments, will be described below.

[0059]. The actuator, according to different embodiments, can be of electromechanical or electro-hydraulic type.

[0060]. According to the present description, as will also be described below according to different embodiments, “actuator” means the set of an electric motor (three-phase or double winding), indicated in the figures by M1 , M2, M3, M4, adapted to move a brake caliper, indicated in the figures by A1 , A2, A3, A4, to apply the braking action to the respective brake disc D-1 , D-2, D-3, D-4.

[0061]. Turning back to the present invention, each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a software point of view, comprises a respective main actuator control module, indicated in the figures, respectively, by CA1 , CA2, CA3, CA4, a respective actuator safety monitoring module, indicated in the figures, respectively, by SA1 , SA2, SA3, SA4, and a backup actuator control module B1 , B2, B3, B4.

[0062]. The main actuator control module, also referred to as ACU (Actuator Control Unit), is a software logic adapted to perform actuator control functions.

[0063]. In more detail, the main actuator control module is configured to control the actuator by means of a pulse-width modulated or PWM electrical signal.

[0064]. The actuator safety monitoring module, also referred to as ASMU (Actuator Safety Monitoring Unit) is a software logic adapted to monitor, in general, the behavior of the respective actuator (e.g., monitoring of any failures due to incorrect or unintended actuation), and more in particular to monitor the respective braking actuation module (e.g., the main actuator control module and/or the backup actuator control module or any other component of the braking actuation module).

[0065]. The backup actuator control module, also referred to as ASCII (Actuator Safety Control Unit) is a software logic adapted to perform backup actuator control functions.

[0066]. In more detail, the backup actuator control module is configured to control the actuator by means of a pulse-width modulated or PWM electrical signal in a simplified manner compared to the actuator control performed by the main actuator control module.

[0067]. According to the present invention, the actuator safety monitoring module SA1 , SA2, SA3, SA4 is configured to detect a failure of the respective braking actuation module S-1 , S-2, S-3, S-4 and, if a failure of the braking actuation module S-1 , S-2, S-3, S-4 is detected, the actuator safety monitoring module SA1 , SA2, SA3, SA4 is configured to also enable the backup actuator control module B1 , B2, B3, B4 to control the actuator.

[0068]. The detection of a failure of the respective braking actuation module S-1 , S-2, S-3, S-4 is achieved by performing a diagnosis, by the actuator safety monitoring module SA1 , SA2, SA3, SA4, which constantly checks the correct operation of the braking actuation module S-1 , S-2, S-3, S-4, by checking the consistency between relevant input values (e.g., a value representative of a braking request) and output values (e.g., an actuated force value, measurable by an appropriate sensor) of the braking actuator module.

[0069]. In the system architecture 100, from a software point of view, the actuator safety monitoring module SA1 , SA2, SA3, SA4 of a braking actuation module of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented differently to perform the same actuator safety monitoring function with respect to the safety monitoring module SA1 , SA2, SA3, SA4 of at least another braking actuation module of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4. [0070]. According to an embodiment, shown in figure 1 , from a software point of view, the main actuator control module CA1 , CA2, CA3, CA4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented in the same manner to perform the same actuator control function.

[0071]. The same implementation to perform the same actuator control function is achieved by using the same software control logic (SW) allocated on the main actuator control module CA1 , CA2, CA3, CA4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S- 4.

[0072]. In this embodiment, the backup actuator control module B1 , B2, B3, B4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented in the same manner to perform the same backup actuator control function.

[0073]. The same implementation to perform the same actuator control function is achieved by using the same software control logic (SW) allocated on the backup actuator control module B1 , B2, B3, B4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4.

[0074]. In this embodiment, a first actuator safety monitoring module SA1 of the first braking actuation module S-1 is implemented in the same manner to perform an actuator safety monitoring function with respect to a fourth actuator safety monitoring module SA4 of said fourth braking actuation module S-4.

[0075]. In this embodiment, a second safety monitoring module SA2 of the second braking actuation module S-2 is implemented in the same manner to perform an actuator safety monitoring function with respect to a third actuator safety monitoring module SA3 of the third braking actuation module S-3.

[0076]. The implementation from a software point of view to perform the same actuator safety monitoring function of the first actuator safety monitoring module SA-1 of the first braking actuation module S-1 and the fourth actuator safety monitoring module SA-4 of said fourth braking actuation module S-4 is different from the implementation to perform the same actuator safety monitoring function of the second actuator safety monitoring module SA-2 of the second braking actuation module S-2 and the third actuator safety monitoring module SA-4 of the third braking actuation module S-3.

[0077]. Therefore, in this embodiment, the diversity is only of the SW type (no diversity is present from a hardware point of view between the four braking actuation modules) and is present between the actuator safety monitoring modules of the same diagonal of the vehicle with respect to the actuator safety modules of the other diagonal of the vehicle.

[0078]. In more detail, from a software point of view, the first actuator safety monitoring module SA1 of the first braking actuation module S-1 (first braking corner 1 , front left) and the fourth actuator safety monitoring module SA4 of the fourth braking actuation module S-4 (fourth braking corner 4, rear right) are mutually implemented in the same manner to perform the same actuator safety monitoring function.

[0079]. Furthermore, from a software point of view, the second actuator safety monitoring module SA2 of the second braking actuation module S-2 (second braking corner 2, front left) and the third actuator safety monitoring module SA3 of the third braking actuation module S-3 (third braking corner 3, rear right) are mutually implemented in the same manner to perform the same actuator safety monitoring function.

[0080]. However, from a software point of view, the first actuator safety monitoring module SA1 of the first braking actuation module S-1 (first braking corner 1 , front left) and the fourth actuator safety monitoring module SA4 of the fourth braking actuation module S-4 (fourth braking corner 4, rear right) are implemented differently to perform the same actuator safety monitoring function with respect to the second actuator safety monitoring module SA2 of the second braking actuation module S-2 (second braking corner 2, front right) and the third actuator safety monitoring module SA3 of the third braking actuation module S- 3 (third braking corner 3, rear left). [0081]. Therefore, from a software point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that a braking control is still ensured even in case of a software failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[0082]. According to different embodiments, this software diversity could be achieved not between corners of different vehicle diagonals but between corners of different vehicle axles or simply between single vehicle corners or according to any other possible combination.

[0083]. In this case, the redundancy will be present between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[0084]. According to an embodiment, in combination with the preceding one and again with reference to figure 1 , each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, comprises at least one respective support and monitoring module, indicated in the figures by C1 , C2, C3, C4, respectively, of the at least one main data processing module E1 , E2, E3, E4. The at least one respective support and monitoring module C1 , C2, C3, C4 is also configured to control the power supply of the at least one main data processing module E1 , E2, E3, E4.

[0085]. The support and monitoring module of the at least one main data processing module is, for example, a hardware module configured with software logic.

[0086]. In more detail, the support and monitoring module of at least one main data processing module, also referred to as SBC (System Basic Chip), is configured to perform, inter alia, a main function of external monitoring of the data processing module (“external watchdog” function, i.e., timed hardware monitoring to check that the main data processing module is working correctly, i.e., is alive, and running) and additional secondary functions, such as a function of checking the operation integrity of the data processing module and an electrical voltage regulator function, i.e., power supply control (adjustment) of the data processing module, for example.

[0087]. Its main function is to monitor a correct operation of the micro, thus it does not perform the main function but provides support to ensure operation integrity.

[0088]. In this embodiment, the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, is the same. [0089]. Therefore, in one of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4 there is a main data processing module E1 , E2, E3, E4 which will also be used in the other three of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S- 4.

[0090]. In this embodiment, the at least one support and monitoring module C1 , C2, C3, C4 of the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, is the same.

[0091]. Therefore, in one of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4 there is a support and monitoring module C1 , C2, C3, C4 of the at least one main data processing module E1 , E2, E3, E4 which will also be used in the other three of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4.

[0092]. In this embodiment, the at least one actuator driving module P1 , P2, P3, P4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, is the same. [0093]. Therefore, also in this embodiment, the diversity is present only from a software point of view, as mentioned above, and there is no diversity from a hardware point of view between the four braking actuation modules.

[0094]. According to an embodiment, in combination with the preceding one and again with reference to figure 1 , the first braking actuation module S-1 comprises at least one first main data processing module E1 , at least one first support and monitoring module C1 of the at least one first main data processing module E1 , at least one first actuator driving module P1 , a first actuator M1 , A1 . [0095]. In this embodiment, the second braking actuation module S-2 comprises at least one second main data processing module E2, at least one second support and monitoring module C2 of the at least one second main data processing module E2, at least one second actuator driving module P2, a second actuator M2, A2.

[0096]. In this embodiment, the third braking actuation module S-3 comprises at least one third main data processing module E3, at least one third support and monitoring module C3 of the at least one third main data processing module E3, at least one third actuator driving module P3, a third actuator M3, A3.

[0097]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, at least one fourth support and monitoring module C4 of the at least one fourth main data processing module E4, at least one fourth actuator driving module P4, a fourth actuator M4, P4.

[0098]. In this embodiment, the at least one first main data processing module E1 and the at least one fourth main data processing module E4 are, from a hardware point of view, mutually the same.

[0099]. In this embodiment, the at least one second main data processing module E2 and the at least one third main data processing module E3 are, from a hardware point of view, mutually the same.

[00100]. In this embodiment, the at least one first main data processing module E1 and the at least one fourth main data processing module E4 are, from a hardware point of view, different from the at least one second main data processing module E2 and the at least one third main data processing module E3.

[00101]. Therefore, in this embodiment, the at least one first main data processing module E1 and the at least one fourth main data processing module E4 are, from a hardware point of view, microprocessors or microcontrollers of different type.

[00102]. In this embodiment, the at least one first support and monitoring module C1 of the at least one first main data processing module E1 and the at least one fourth electric power supply control module C4 of the at least one fourth main data processing module E4 are, from a hardware point of view, mutually the same.

[00103]. In this embodiment, the at least one second support and monitoring module C2 of the at least one second main data processing module E2 and the at least one third electric power supply control module C3 of the at least one third main data processing module E3 are, from a hardware point of view, mutually the same.

[00104]. In this embodiment, the at least one first support and monitoring module C1 of the at least one first main data processing module E1 and the at least one fourth electric power supply control module C4 of the at least one fourth main data processing module E4 are, from a hardware point of view, different from the at least one second electrical support and monitoring module C2 of the at least one second main data processing module E2 and the at least one third support and monitoring module C3 of the at least one third main data processing module E3.

[00105]. In this embodiment, the at least one first actuator driving module P1 and the at least one fourth actuator driving module P4 are, from a hardware point of view, mutually the same, the at least one second actuator driving module P2 and the at least one third actuator driving module P3 are, from a hardware point of view, mutually the same, the at least one first actuator driving module P1 and the at least one fourth actuator driving module P4 are, from a hardware point of view, different from the at least one second actuator driving module P2 and the at least one third actuator driving module P3.

[00106]. Therefore, in this embodiment, in addition to a diversity from a software point of view, described above, there is also diversity from a hardware point of view among the four braking actuation modules.

[00107]. In more detail, in this embodiment, the diversity of the HW type is present between the braking actuation modules of the same vehicle diagonal with respect to the braking actuation modules of the other vehicle diagonal.

[00108]. Indeed, the hardware components of the first braking actuation module S-1 (first braking corner 1 - front left) are the same as the hardware components of the fourth braking actuation module S-4 (fourth braking corner 4 - rear right) but different from the hardware components, mutually the same, of the second braking actuation module S-2 (second braking corner 2 - front right) and the third braking actuation module S-3 (third braking corner 3 - rear left).

[00109]. Therefore, also from a hardware point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that braking control is still ensured even in case of a hardware failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[00110]. According to different embodiments, this hardware diversity could be achieved not between corners of different vehicle diagonals but between corners of different vehicle axles or simply between single vehicle corners or according to any other possible combination.

[00111]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00112]. Furthermore, according to different embodiments, this diversity could affect not all but only some of the components present in each braking actuation module.

[00113]. According to an embodiment, in combination with any of the preceding ones, in which each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, comprises at least one respective support and monitoring module C1 , C2, C3, C4 of the at least one main data processing module E1 , E2, E3, E4, the at least one support and monitoring module C1 , C2, C3, C4 of the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises a system base control module configured to externally monitor (“external watchdog” function, as defined above) the at least one main data processing module E1 , E2, E3, E4, enable/disable the actuator M1 , A1 , M2, A2, M3, A3, M4, A4, control the electric power supply of the at least one main data processing module E1 , E2, E3, E4. [00114]. Each system base control module, also referred to as SBC (System Basic Chip), is a hardware module configured with software logic so as to perform, inter alia, the functions indicated above.

[00115]. According to an embodiment, in combination with any of the preceding ones, the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a software point of view, comprises the respective main actuator control module CA1 , CA2, CA3, CA4, the respective actuator safety monitoring module SA1 , SA2, SA3, SA4 and the respective backup actuator control module B1 , B2, B3, B4.

[00116]. According to an embodiment, alternative to the preceding ones and shown in figure 2, each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4, from a hardware point of view, comprises a further main data processing module E1 ’, E2’, E3’, E4’.

[00117]. Each further main data processing module E1 ’, E2’, E3’, E4’ is, for example, a microprocessor or microcontroller.

[00118]. In this embodiment, the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a software point of view, comprises the respective main actuator control module CA1 , CA2, CA3, CA4 and the respective backup actuator control module B1 , B2, B3, B4.

[00119]. The further main data processing module E1’, E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises the respective actuator safety monitoring module SA1 , SA2, SA3, SA4.

[00120]. According to an embodiment, in combination with the preceding one, from a software point of view, the main actuator control module CA1 , CA2, CA3, CA4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented in the same manner to perform the same actuator control function.

[00121]. In this embodiment, the actuator safety monitoring module SA1 , SA2, SA3, SA4 of each of said first braking actuation module S-1 , second braking actuation module S-2, third braking actuation module S-3, fourth braking actuation module S-4 are implemented in the same manner to perform the same actuator safety monitoring function.

[00122]. In this embodiment, a first backup actuator control module B1 of the first braking actuation module S-1 is implemented in the same manner to perform the same backup actuator control function with respect to a fourth backup actuator control module B4 of said fourth braking actuation module S- 4.

[00123]. In this embodiment, a second backup actuator control module B1 of the second braking actuation module S-2 is implemented in the same manner to perform the same backup actuator control function with respect to a third backup actuator control module B3 of the third braking actuation module S-3.

[00124]. In this embodiment, the implementation from a software point of view to perform the same backup actuator control function of the first backup actuator control module B1 of the first braking actuation module S-1 and the fourth backup actuator control module B4 of said fourth braking actuation module S-4 is different from the implementation from a software point of view to perform the same backup actuator control function of the second backup actuator control module B2 of the second braking actuation module S-2 and the third backup actuator control module B3 of the third braking actuation module S-3.

[00125]. According to an embodiment, according to any of the preceding ones in which the further main data processing module ET, E2’, E3’, E4’ is present in each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, the first braking actuation module S-1 comprise at least one first main data processing module E1 , a further first main data processing module E1’, at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module E1 ’, at least one first actuator driving module P1 , a first actuator M1 , A1.

[00126]. In this second embodiment, the second braking actuation module S- 2 comprises at least one second main data processing module E2, a further second main data processing module E2’, at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, at least one second actuator driving module P2, a second actuator M2, A2.

[00127]. In this embodiment, the third braking actuation module S-3 comprises at least one third main data processing module E3, a further third main data processing module E3’, at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, at least one third actuator driving module P3, a third actuator M3, A3.

[00128]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, a further fourth main data processing module E4’, at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, at least one fourth actuator driving module P4, a fourth actuator M4, A4.

[00129]. For each braking actuation module S-1 , S-2, S-3, S-4, the at least one main data processing module, the at least one electric power supply control module of the at least one main data processing module (now also applicable to the further main data processing module), the actuator driving module and the actuator have been introduced before.

[00130]. In this embodiment, the at least one first main data processing module E1 and the at least one fourth main data processing module E4 are, from a hardware point of view, mutually the same.

[00131]. In this embodiment, the at least one second main data processing module E2 and the at least one third main data processing module E3 are, from a hardware point of view, mutually the same.

[00132]. In this embodiment, the at least one first main data processing module E1 and the at least one fourth main data processing module E4 are, from a hardware point of view, different from the at least one second main data processing module E2 and the at least one third main data processing module E3.

[00133]. In this embodiment, the further first main data processing module E1 ’ and the further fourth data processing module E4’ are, from a hardware point of view, mutually the same.

[00134]. In this embodiment, the further second main data processing module E2’ and the further third main data processing module E3’ are, from a hardware point of view, mutually the same.

[00135]. In this embodiment, the further first main data processing module E1 ’ and the further fourth main data processing module E4’ are, from a hardware point of view, different from the further second main data processing module E2’ and the further third main data processing module E3’.

[00136]. Therefore, in this embodiment, in addition to a diversity from a software point of view, described above, there is also diversity from a hardware point of view among the four braking actuation modules.

[00137]. In more detail, in this embodiment, the diversity of the HW type is present between the braking actuation modules of the same vehicle diagonal with respect to the braking actuation modules of the other vehicle diagonal.

[00138]. Indeed, the hardware components of the first braking actuation module S-1 (first braking corner 1 -front left), i.e. , the at least one first main data processing module E1 and the further first main data processing module ET, are equal to the hardware components of the fourth braking actuation module S-4 (fourth braking corner 4 - rear right), the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, but different from the hardware components, mutually the same, of the second braking actuation module S-2 (second braking corner 2 - front right), i.e., the at least one second main data processing module E2 and the further second main data processing module E2’ and the third braking actuation module S-3 (third braking corner 3 - rear left), i.e., the at least one third main data processing module E3 and the further third main data processing module E3’.

[00139]. Therefore, also from a hardware point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that braking control is still ensured even in case of a hardware failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[00140]. According to different embodiments, this hardware diversity and the related redundancy could be achieved not between corners of different vehicle diagonals but between corners of different vehicle axles or simply between single vehicle corners or according to any other possible combination.

[00141]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, between single braking corners or in all redundant components according to other possible combinations.

[00142]. Furthermore, according to different embodiments, this diversity and the related redundancy could affect not all but only some of the components present in each braking actuation module.

[00143]. According to an embodiment, in combination with the preceding one, from a hardware point of view, the further first main data processing module ET, the further fourth main data processing module E4’, the further second main data processing module E2’, and the further third main data processing module E3’ are different from the at least one first main data processing module E1 , the at least one fourth main data processing module E4, the at least one second main data processing module E2, and the at least one third main data processing module E3.

[00144]. Therefore, in this embodiment, a further diversity from a hardware point of view is also added in the single braking actuation module where, precisely, the at least one main data processing module can be different, from a hardware point of view, from the respective further main data processing module (E1 different from ET, E2 different from E2’, E3 different from E3’, E4 different from E4’).

[00145]. According to a further embodiment, in combination with any of the preceding ones in which each braking actuation module comprises the respective at least one main data processing module and the respective further main data processing module, the at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module ET, the at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, the at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, the at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further second main data processing module E4’, are the same from a hardware point of view.

[00146]. Therefore, in this embodiment, there is, from a hardware point of view, a non-diversity among other components, i.e. , the electric power supply control modules, of each braking actuation module.

[00147]. According to a further embodiment, in combination with any of the preceding ones in which each braking actuation module comprises the respective at least one main data processing module and the respective further main data processing module, the at least one first actuator driving module P1 , the at least one second actuator driving module P2, the at least one third actuator driving module P3, and the at least one fourth actuator driving module P4, are the same from a hardware point of view. [00148]. Therefore, also in this embodiment, there is, from a hardware point of view, a non-diversity between further components, i.e., the actuator driving modules, of each braking actuation module.

[00149]. According to a further embodiment, in combination with any of the preceding ones in which each braking actuation module comprises the respective at least one main data processing module and the respective further main data processing module, but alternative to the preceding one, the at least one first actuator driving module P1 and the at least one fourth actuator driving module P4, are the same from a hardware point of view.

[00150]. In this embodiment, the at least one second actuator driving module P2 and the at least one third actuator driving module P3 are, from a hardware point of view, mutually the same.

[00151]. In this embodiment, the at least one first actuator driving module P1 and the at least one fourth actuator driving module P4 are, from a hardware point of view, different from the at least one second actuator driving module P2 and the at least one third actuator driving module P3.

[00152]. Therefore, in this embodiment, from a hardware point of view, there is diversity among the four braking actuation modules.

[00153]. In more detail, also in this embodiment, the diversity of the HW type is present between the braking actuation modules of the same vehicle diagonal compared to the braking actuation modules of the other vehicle diagonal.

[00154]. Indeed, the further hardware component of the first braking actuation module S-1 (first braking corner 1 - front left), i.e., the first actuator driving module P1 , is the same as a further hardware component of the fourth braking actuation module S-4 (fourth braking corner 4 - rear right), i.e., the fourth actuator driving module P4 but different from the hardware components, mutually the same, of the second braking actuation module S-2 (second braking corner 2 - front right), i.e., the second actuator driving module P2, and the third braking actuation module S-3 (third braking corner 3 - rear left), i.e., the third actuator driving module P3.

[00155]. Therefore, also from a hardware point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that braking control is still ensured even in case of a hardware failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[00156]. According to different embodiments, this hardware diversity and the related redundancy could be achieved not between corners of different vehicle diagonals but between corners of different vehicle axles or simply between single vehicle corners or according to any other possible combination.

[00157]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, between single braking corners or in all redundant components according to other possible combinations.

[00158]. According to an embodiment, alternative to the preceding ones and shown in figure 3, each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4, from a hardware point of view, comprises a further main data processing module again indicated by E1 ’, E2’, E3’, E4’ also in figure 3.

[00159]. In this embodiment, one of the at least one main data processing module E1 , E2, E3, E4 and the further main data processing module E1 ’, E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises the respective main actuator control module, again indicated by CA1 , CA2, CA3, CA4 also in figure 3 and a respective actuator safety monitoring module indicated by SA1 , SA2, SA3, SA4 also in figure 3.

[00160]. In this embodiment, the other of the at least one main data processing module E1 , E2, E3, E4 and the further main data processing module E1 ’, E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a software point of view, comprises the respective backup actuator control module, again indicated by B1 , B2, B3, B4 also in figure 3, and a respective further actuator safety monitoring module, indicated by SAT, SA2’, SA3’, SAT in figure 3.

[00161]. For each braking actuation module S-1 , S-2, S-3, S-4, the at least one main data processing module, the further main data processing module and the actuator safety monitoring module have been introduced before.

[00162]. The further actuator safety monitoring module, SAT, SA2’, SA3’, SAT, also referred to as ASMII (Actuator Safety Monitoring Unit) is a software logic adapted to monitor the respective braking actuation module (e.g., the main actuator control module and/or the backup actuator control module or any other component of the braking actuation module).

[00163]. In more detail, the further actuator safety monitoring module SA1 , SA2, SA3, SA4 is also configured to detect a failure of the respective braking actuation module S-1 , S-2, S-3, S-4 and, if a failure of the further braking actuation module S-1 , S-2, S-3, S-4 is detected, the further actuator safety monitoring module SA1 , SA2, SA3, SA4 is configured to also enable the backup actuator control module B1 , B2, B3, B4 to control the actuator.

[00164]. The detection of a failure of the respective braking actuation module S-1 , S-2, S-3, S-4 is achieved by performing a diagnosis, by the further actuator safety monitoring module SAT, SA2’, SA3’, SAT, which constantly checks the correct operation of the braking actuation module S-1 , S-2, S-3, S-4, by checking the consistency between relevant input values (e.g., a value representative of a braking request) and output values (e.g., an actuated force value, measurable by an appropriate sensor) of the braking actuator module.

[00165]. According to an embodiment, in combination with the preceding one and shown in figure 3, from a software point of view, the main actuator control module CA1 , CA2, CA3, CA4 (introduced above) of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented in the same manner to perform a main actuator control function.

[00166]. In this embodiment, the actuator safety monitoring module SA1 , SA2, SA3, SA4 and the further actuator safety monitoring module SAT, SA2’, SA3’, SA4’ of each of said first braking actuation module S-1 , second braking actuation module S-2, third braking actuation module S-3, fourth braking actuation module S-4 are implemented in the same manner to perform the same actuator safety monitoring function.

[00167]. In this embodiment, a first backup actuator control module B1 of the first braking actuation module S-1 is implemented in the same manner to perform a backup actuator control function with respect to a fourth backup actuator control module B4 of said fourth braking actuation module S-4.

[00168]. In this embodiment, a second backup actuator control module B2 of the second braking actuation module S-2 is implemented in the same manner to perform a backup actuator control function with respect to a third backup actuator control module B3 of the third braking actuation module S-3.

[00169]. In this embodiment, the implementation to perform the same backup actuator control function of the first backup actuator control module B1 of the first braking actuation module S-1 and the fourth backup actuator control module B4 of said fourth braking actuation module S-4 is different from the implementation to perform the same backup actuator control function of the second backup actuator control module B2 of the second braking actuation module S-2 and the third backup actuator control module B3 of the third braking actuation module S-3.

[00170]. Therefore, from a software point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that a braking control is still ensured even in case of a software failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[00171]. In more detail, redundancy, from a software point of view, is introduced between the backup actuator control modules of each braking actuation module between the FL-RR diagonal and the FR-RL diagonal.

[00172]. According to different embodiments, this software diversity could be achieved not between corners of different vehicle diagonals but between corners of different vehicle axles or simply between single vehicle corners or according to any other possible combination.

[00173]. In this case, the redundancy will be present between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00174]. According to an embodiment, in combination with any of the preceding ones in which the further main data processing module ET, E2’, E3’, E4’ and the further safety monitoring module SA1 ’, SA2’, SA3’, SA4’ are present in each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 and shown in figure 3, the first braking actuation module S-1 comprises at least one first main data processing module E1 , a further first main data processing module ET, at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module ET, at least one first switching module W1 , at least one first actuator driving module P1 , a first actuator M1 , A1.

[00175]. The at least one first switching module W1 , e.g., a switch, is adapted to connect the at least one first actuator driving module P1 to the at least one first main data processing module E1 or to the further first main data processing module ET based on a respective switching signal.

[00176]. If the at least one first main data processing module E1 and the further first main data processing module ET are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the first actuator safety monitoring module SA1 . If one of said at least one first main data processing module E1 and the further first main data processing module ET is not working correctly or is subject to failure, i.e. , is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00177]. According to this embodiment, the second braking actuation module S-2 comprises at least one second main data processing module E2, a further second main data processing module E2’, at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, at least one second switching module W2, at least one second actuator driving module P2, a second actuator M2, A2.

[00178]. The at least one second switching module W2, e.g., a switch, is adapted to connect the at least one second actuator driving module P2 to the at least one second main data processing module E2 or to the further second main data processing module E2’ based on a respective switching signal.

[00179]. If the at least one second main data processing module E2 and the further second main data processing module E2’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the second actuator safety monitoring module SA2. If one of said at least one second main data processing module E2 and the further second main data processing module E2’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00180]. According to this embodiment, the third braking actuation module S-3 comprises at least one third main data processing module E3, a further third main data processing module E3’, at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, at least one third switching module \N3, at least one third actuator driving module P3, a third actuator M3, A3.

[00181]. The at least one third switching module W3, e.g., a switch, is adapted to connect the at least one third actuator driving module P3 to the at least one third main data processing module E3 or to the further third main data processing module E3’ based on a respective switching signal.

[00182]. If the at least one third main data processing module E3 and the further third main data processing module E3’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the third actuator safety monitoring module SA3. If one of said at least one third main data processing module E3 and the further third main data processing module E3’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00183]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, a further fourth main data processing module E4’, at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, at least one fourth switching module W4, at least one fourth actuator driving module P4, a fourth actuator M4, A4.

[00184]. The at least one fourth switching module W4, e.g., a switch, is adapted to connect the at least one fourth actuator driving module P4 to the at least one fourth main data processing module E4 or to the further fourth main data processing module E4’ based on a respective switching signal.

[00185]. If the at least one fourth main data processing module E4 and the further fourth main data processing module E4’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the fourth actuator safety monitoring module SA4. If one of said at least one fourth main data processing module E4 and the further fourth main data processing module E4’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00186]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, mutually the same. [00187]. In this embodiment, the further first main data processing module ET, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’ are, from a hardware point of view, mutually the same.

[00188]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, different from the further first main data processing module ET, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’.

[00189]. Therefore, in this embodiment, in addition to a diversity from a software point of view, described above, there is also a diversity, thus a redundancy, from a hardware point of view in each of the four braking actuation modules.

[00190]. According to different embodiments, this hardware diversity could be achieved not in each braking corner but only in braking corners of different vehicle diagonals or between braking corners of different vehicle axles or in any other possible combination.

[00191]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00192]. According to an embodiment, in combination with any of the preceding ones in which the further main data processing module ET, E2’, E3’, E4’ and the further safety monitoring module SA1 ’, SA2’, SA3’, SA4’ are present in each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 and shown in figure 3 and shown in figure 4, the at least one main data processing module, again indicated by E1 , E2, E3, E4 also in figure 4, of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, comprises the respective main actuator control module again indicated by CA1 , CA2, CA3, CA4 also in figure 4, the respective actuator safety monitoring module again indicated by SA1 , SA2, SA3, SA4 in figure 4, the respective backup actuator control module again indicated by B1 , B2, B3, B4 in figure 4.

[00193]. In this embodiment, the further main data processing module E1 E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises the respective further actuator safety monitoring module, again indicated by SA1’, SA2’, SA3’, SA4’ also in figure 4, and a respective further backup actuator control module, again indicated by B1 ’, B2’, B3’, B4’ also in figure 4.

[00194]. In this embodiment, from a software point of view, the main actuator control module CA1 , CA2, CA3, CA4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 are implemented in the same manner to perform the same main actuator control function.

[00195]. In this embodiment, from a software point of view, the actuator safety monitoring module SA1 , SA2, SA3, SA4 and the further safety monitoring module SA1’, SA2’, SA3’, SA4’ of each of said first braking actuation module S- 1 , second braking actuation module S-2, third braking actuation module S-3, fourth braking actuation module S-4 are implemented in the same manner to perform the same actuator safety monitoring function.

[00196]. In this embodiment, from a software point of view, the backup actuator control module B1 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 are implemented in the same manner to perform the same backup actuator control function.

[00197]. In this embodiment, from a software point of view, the further backup actuator control module B1 ’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 are implemented in the same manner to perform the same backup actuator control function.

[00198]. In this embodiment, the further actuator safety monitoring module SA1 ’, SA2’, SA3’, SA4’ is configured to detect a failure of the respective braking actuation module S-1 , S-2, S-3, S-4 and, in case a failure of the braking actuation module S-1 , S-2, S-3, S-4 is detected, to also enable the further backup actuator control module BT, B2’, B3’, B4’ to control the actuator.

[00199]. Therefore, in this embodiment, there is no diversity from a software point of view among the four braking actuation control modules, but a diversity from a software point of view is advantageously introduced within the single braking actuation control module so that a braking control is still ensured even in case of software failure in one of the main data processing modules present in the same braking actuation module, by virtue of the intervention of the other main data processing module present in the same braking actuation module, which is failure-free.

[00200]. In more detail, the redundancy, from a software point of view, is introduced in each braking actuation module between the backup actuator control module present in one of the main data processing modules and the further backup actuator control module present in the other of the main data processing modules.

[00201]. According to different embodiments, this software diversity could be achieved not within a single braking corner but between braking corners of different diagonals or different vehicle axles or according to any other possible combination.

[00202]. In this case, the redundancy will be present between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00203]. According to an embodiment, in combination with the preceding one and shown in figure 4, the first braking actuation module S-1 comprises at least one first main data processing module E1 , a further first main data processing module E1’, at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first data processing module E1’, at least one first switching module W1 , at least one first actuator driving module P1 , a first actuator M1 , A1 .

[00204]. The at least one first switching module W1 , e.g., a switch, is adapted to connect the at least one first actuator driving module P1 to the at least one first main data processing module E1 or to the further first main data processing module ET based on a respective switching signal.

[00205]. If the at least one first main data processing module E1 and the further first main data processing module ET are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the first actuator safety monitoring module SA1 . If one of said at least one first main data processing module E1 and the further first main data processing module ET is not working correctly or is subject to failure, i.e. , is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00206]. In this embodiment, the second braking actuation module S-2 comprises at least one second main data processing module E2, a further second main data processing module E2’, at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, at least one second switching module W2, at least one second actuator driving module P2, a second actuator M2, A2.

[00207]. The at least one second switching module W2, e.g., a switch, is adapted to connect the at least one second actuator driving module P2 to the at least one second main data processing module E2 or to the further second main data processing module E2’ based on a respective switching signal.

[00208]. If the at least one second main data processing module E2 and the further second main data processing module E2’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the second actuator safety monitoring module SA2. If one of said at least one second main data processing module E2 and the further second main data processing module E2’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00209]. In this embodiment, the third braking actuation module S-3 comprises at least one third main data processing module E3, a further third main data processing module E3’, at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, at least one third switching module W3, at least one third actuator driving module P3, a third actuator M3, A3.

[00210]. The at least one third switching module W3, e.g., a switch, is adapted to connect the at least one third actuator driving module P3 to the at least one third main data processing module E3 or to the further third main data processing module E3’ based on a respective switching signal.

[00211]. If the at least one third main data processing module E3 and the further third main data processing module E3’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the third actuator safety monitoring module SA3. If one of said at least one third main data processing module E3 and the further third main data processing module E3’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00212]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, a further fourth main data processing module E4’, at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, at least one fourth switching module W4, at least one fourth actuator driving module P4, a fourth actuator M4, A4.

[00213]. The at least one fourth switching module W4, e.g., a switch, is adapted to connect the at least one fourth actuator driving module P4 to the at least one fourth main data processing module E4 or to the further fourth main data processing module E4’ based on a respective switching signal.

[00214]. If the at least one fourth main data processing module E4 and the further fourth main data processing module E4’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the fourth actuator safety monitoring module SA4. If one of said at least one fourth main data processing module E4 and the further fourth main data processing module E4’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00215]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, mutually the same. [00216]. In this embodiment, the further first main data processing module E1 ’, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’ are, from a hardware point of view, mutually the same.

[00217]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, different from the further first main data processing module ET, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’.

[00218]. Therefore, also in this embodiment, in addition to a diversity from a software point of view, described above, there is also a diversity, i.e., a redundancy, from a hardware point of view in each of the four braking actuation modules.

[00219]. According to different embodiments, this hardware diversity could be achieved not in each braking corner but only in braking corners of different vehicle diagonals or between braking corners of different vehicle axles or in any other possible combination.

[00220]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00221]. According to an embodiment, in combination with the preceding one and with reference to figure 4, the at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module E1 ’, the at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, the at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, the at least one fourth electric power supply regulation module G4 of the at least one fourth main data processing module E4 and the further second main data processing module E4’, are, from a hardware point of view, mutually the same.

[00222]. Therefore, as for the aforesaid components, in this embodiment, there is no diversity from a hardware point of view among the four braking actuation control modules.

[00223]. According to an embodiment, in combination with any of the preceding ones described with reference to figure 4, the at least one first actuator driving module P1 , the at least one second actuator driving module P2, the at least one third actuator driving module P3, and the at least one fourth actuator driving module P4, from a hardware point of view, are mutually the same.

[00224]. Therefore, as for the above component, also in this embodiment, there is no diversity from a hardware point of view among the four braking actuation control modules.

[00225]. According to an embodiment, shown in figure 5 and in combination with any of the preceding ones in which the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuator module S-1 , said second braking actuator module S-2, said third braking actuator module S-3, comprises the respective main actuator control module CA1 , CA2, CA3, CA4, the respective safety monitoring actuator module SA1 , SA2, SA3, SA4, the respective backup actuator control module B1 , B2, B3 and the further main data processing module ET, E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4 comprises the respective further safety actuator monitoring module SAT SA2’, SA3’, SA4’ and a respective further backup actuator monitoring module BT, B2’, B3’, B4’, the first braking actuation module S-1 comprises at least one first main data processing module E1 , a further first main data processing module ET, at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module ET, at least one first actuator driving module P1 with a respective first switching module W1 controlled by the at least one first main data processing module E1 , a further first actuator driving module PT with a respective further first switching module WT controlled by the further first main data processing module ET, a first actuator M1 , A1.

[00226]. The first switching module W1 and the further first switching module WT, a relay driver circuit with switching function, are adapted to connect, respectively, the at least one first actuator driving module P1 or the further first actuator driving module PT to the first actuator M1 , A1 based on a respective switching signal.

[00227]. If the at least one first main data processing module E1 and the further first main data processing module ET are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the first actuator safety monitoring module SA1 . If one of said at least one first main data processing module E1 and the further first main data processing module ET is not working correctly or is subject to failure, i.e. , is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”. [00228]. In this embodiment, as shown in figure 5, the second braking actuation module S-2 comprises at least one second main data processing module E2, a further second main data processing module E2’, at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, at least one second actuator driving module P2 with a respective second switching module W2 controlled by the at least one second main data processing module E2, a further second actuator driving module P2’ with a further second switching module W2’ controlled by the further second main data processing module E2’, a second actuator M2, A2.

[00229]. The second switching module W2 and the further second switching module W2’, a relay driver circuit with switching function, is adapted to connect, respectively, the at least one second actuator driving module P2 or the further second actuator driving module P2’ to the second actuator M2, A2 based on a respective switching signal.

[00230]. If the at least one second main data processing module E2 and the further second main data processing module E2’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the second actuator safety monitoring module SA2. If one of said at least one second main data processing module E2 and the further second main data processing module E2’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00231]. In this embodiment, as shown in figure 5, the third braking actuation module S-3 comprises at least one third main data processing module E3, a further third main data processing module E3’, at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, at least one third actuator driving module P3 with a respective third switching module W3 controlled by the at least one third main data processing module E3, a further third actuator driving module P3’ with a further third switching module W3’ controlled by the further third main data processing module E3’, a third actuator M3, A3.

[00232]. The third switching module \N3 and the further third switching module W3’, a relay driver circuit with switching function, are adapted to connect, respectively, the at least one third actuator driving module P3 or the further third actuator driving module P3’ to the third actuator M3, A3 based on a respective switching signal.

[00233]. If the at least one third main data processing module E3 and the further third main data processing module E3’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the third actuator safety monitoring module SA3. If one of said at least one third main data processing module E3 and the further third main data processing module E3’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00234]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, a further fourth main data processing module E4’, at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, at least one fourth actuator driving module P4 with a respective fourth switching module W4 controlled by the at least one fourth main data processing module E4, a further fourth actuator driving module P4’ with a further fourth switching module W4’ controlled by the further fourth main data processing module E4’, a fourth actuator M4, A4.

[00235]. The fourth switching module W4 and the further fourth switching module W4’, a relay driver circuit with switching function, are adapted to connect, respectively, the at least one fourth actuator driving module P4 or the further fourth actuator driving module P4’ to the fourth actuator M4, A4 based on a respective switching signal.

[00236]. If the at least one fourth main data processing module E4 and the further fourth main data processing module E4’ are both alive, the switching signal is provided by the actuator safety monitoring module which monitors the main actuator control module, in this case the fourth actuator safety monitoring module SA4. If one of said at least one fourth main data processing module E4 and the further fourth main data processing module E4’ is not working correctly or is subject to failure, i.e., is “dead”, the switching signal is provided by the actuator safety monitoring module which monitors the actuator control module (main or backup) corresponding to the main processing module that is working correctly, i.e., is “alive”.

[00237]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, mutually the same. [00238]. In this embodiment, the further first main data processing module E1 ’, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’ are, from a hardware point of view, mutually the same.

[00239]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, different from the further first main data processing module E1’, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’.

[00240]. In this embodiment, the at least one first actuator driving module P1 with the first switching module W1 , the at least one second actuator driving module P2 with the second switching module W2, the at least one third actuator driving module P3 with the third switching module W1 , the at least one fourth actuator driving module P4 with the fourth switching module W4 are, from a hardware point of view, mutually the same and equal to the respective main data processing module E1 , E2, E3, E4.

[00241]. In this embodiment, the further first actuator driving module P1 ’ with the further first switching module WT, the further second actuator driving module P2’ with the further second switching module W2’, the further third actuator driving module P3’ with the further third switching module W3’, the further fourth actuator driving module P4’ with the further fourth switching module W4’ are, from a hardware point of view, mutually the same and equal to the respective further main data processing module E1 ’, E2’, E3’, E4’.

[00242]. In this embodiment, the at least one first actuator driving module P1 with the first switching module W1 , the at least one second actuator driving module P2 with the second switching module W2, the at least one third actuator driving module P3 with the third switching module W1 , the at least one fourth actuator driving module P4 with the fourth switching module W4 are, from a hardware point of view, different from the further first actuator driving module PT with the further first switching module WT, the further second actuator driving module P2’ with the further second switching module W2’, the further third actuator driving module P3’ with the further third switching module \N3’, the further fourth actuator driving module P4’ with the further fourth switching module W4’.

[00243]. Therefore, also in this embodiment, in addition to a diversity from a software point of view, described above, with reference to an embodiment in figure 4, there is also a diversity, thus a redundancy, from a hardware point of view in each of the four braking actuation modules.

[00244]. According to different embodiments, this hardware diversity could be achieved not in each braking corner but only in braking corners of different vehicle diagonals or between braking corners of different vehicle axles or in any other possible combination.

[00245]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00246]. As for the diversity from a software point of view, it is reiterated that in the embodiment in figure 5, such a diversity is within the single braking actuation control module so that a braking control is still ensured even in case of software failure in one of the main data processing modules present in the same braking actuation module, by virtue of the intervention of the other main data processing module present in the same braking actuation module, which is failure-free.

[00247]. In more detail, the redundancy, from a software point of view, is introduced in each braking actuation module between the backup actuator control module present in one of the main data processing modules and the further backup actuator control module present in the other of the main data processing modules.

[00248]. According to different embodiments, this software diversity could be achieved not within a single braking corner but between braking corners of different diagonals or different vehicle axles or according to any other possible combination.

[00249]. In this case, the redundancy will be present between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00250]. According to an embodiment, in combination with any of the preceding ones, the actuator M1 , A1 , M2, A2, M3, A3, M4, A4 of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises a three-phase electric motor M1 , M2, M3, M4 and a brake caliper A1 , A2, A3, A4 actuatable by said three-phase electric motor M1 , M2, M3, M4. [00251]. According to an embodiment, shown in figure 6 and in combination with any of the preceding ones in which the at least one main data processing module E1 , E2, E3, E4 of each of said first braking actuator module S-1 , said second braking actuator module S-2, said third braking actuator module S-3, comprises the respective main actuator control module CA1 , CA2, CA3, CA4, the respective safety monitoring actuator module SA1 , SA2, SA3, SA4, the respective backup actuator control module B1 , B2, B3 and the further main data processing module ET, E2’, E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4 comprises the respective further safety actuator monitoring module SAT SA2’, SA3’, SA4’ and a respective further backup actuator control module BT, B2’, B3’, B4’, the first braking actuation module S-1 comprises at least one first main data processing module E1 , a further first main data processing module ET, at least one first electric power supply adjustment module G1 of the at least one first main data processing module E1 and the further first main data processing module ET, at least one first actuator driving module P1 controlled by the at least one first main data processing module E1 , a further first actuator driving module PT controlled by the further first main data processing module ET, a first actuator M1 , A1.

[00252]. In this embodiment, the at least one first main data processing module E1 and the further first main data processing module ET are configured to connect, respectively, the at least one first actuator driving module P1 or the further first actuator driving module P1 ’ to the first actuator M1 , A1.

[00253]. The control criteria for choosing one or the other of the connections can be different.

[00254]. For example, if the at least one first main data processing module E1 and the further first main data processing module ET are both alive, the connection choice is performed by the actuator safety monitoring module which monitors the main actuator control module, in this case the first actuator safety monitoring module SAT

[00255]. The other of either the at least one first main data processing module E1 or the further first main data processing module E1 ’ takes over only in case of failure of the other (HW failure) or in case of failure of the backup actuator control module in case the main actuator control module has already failed.

[00256]. Furthermore, other control criteria are still possible, for example, also a coordination of the main data processing modules to drive the actuator simultaneously.

[00257]. The second braking actuation module S-2 comprises at least one second main data processing module E2, a further second main data processing module E2’, at least one second electric power supply adjustment module G2 of the at least one second main data processing module E2 and the further second main data processing module E2’, at least one second actuator driving module P2 controlled by the at least one second main data processing module E2, a further second actuator driving module P2’ controlled by the further second main data processing module E2’, a second actuator M2, A2.

[00258]. The at least one second main data processing module E2 and the further second main data processing module E2’ are configured to connect, respectively, the at least one second actuator driving module P2 or the further second actuator driving module P2’ to the second actuator M2, A2.

[00259]. The control criteria for choosing one or the other of the connections can be different.

[00260]. For example, if the at least one second main data processing module E2 and the further second main data processing module E2’ are both alive, the connection choice is performed by the actuator safety monitoring module which monitors the main actuator control module, in this case the second actuator safety monitoring module SA2.

[00261]. The other of either the at least one second main data processing module E2 or the further second main data processing module E2’ takes over only in case of failure of the other (HWfailure) or in case of failure of the backup actuator control module in case the main actuator control module has already failed.

[00262]. Furthermore, other control criteria are still possible, for example, also a coordination of the main data processing modules to drive the actuator simultaneously.

[00263]. In this embodiment, the third braking actuation module S-3 comprises at least one third main data processing module E3, a further third main data processing module E3’, at least one third electric power supply adjustment module G3 of the at least one third main data processing module E3 and the further third main data processing module E3’, at least one third actuator driving module P3 controlled by the at least one third main data processing module E3, an further third actuator driving module P3’ controlled by the further third main data processing module E3’, a third actuator M3, A3.

[00264]. The at least one further third main data processing module E3 and the further third main data processing module E3’ are configured to connect, respectively, the at least one third actuator driving module P3 or the further third actuator driving module P3’ to the third actuator M3, A3.

[00265]. The control criteria for choosing one or the other of the connections can be different.

[00266]. For example, if the at least one third main data processing module E3 and the further third main data processing module E3’ are both alive, the connection choice is performed by the actuator safety monitoring module which monitors the main actuator control module, in this case the third actuator safety monitoring module SA3.

[00267]. The other of either the at least one third main data processing module E3 or the further third main data processing module E3’ takes over only in case of failure of the other (HW failure) or in case of failure of the backup actuator control module in case the main actuator control module has already failed.

[00268]. Furthermore, other control criteria are still possible, for example, also a coordination of the main data processing modules to drive the actuator simultaneously.

[00269]. In this embodiment, the fourth braking actuation module S-4 comprises at least one fourth main data processing module E4, a further fourth main data processing module E4’, at least one fourth electric power supply adjustment module G4 of the at least one fourth main data processing module E4 and the further fourth main data processing module E4’, at least one fourth actuator driving module P4 controlled by the at least one fourth main data processing module E4, a further fourth actuator driving module P4’ controlled by the further fourth main data processing module E4’, a fourth actuator M4, A4. [00270]. In this embodiment, the at least one fourth main data processing module E4 and the further fourth main data processing module E4’ are configured to connect, respectively, the at least one fourth actuator driving module P4 or the further fourth actuator driving module P4’ to the fourth actuator M4, A4.

[00271]. The control criteria for choosing one or the other of the connections can be different. [00272]. For example, if the at least one fourth main data processing module E4 and the further fourth main data processing module E4’ are both alive, the connection choice is performed by the actuator safety monitoring module which monitors the main actuator control module, in this case the fourth actuator safety monitoring module SA4.

[00273]. The other of either the at least one fourth main data processing module E4 or the further fourth main data processing module E4’ takes over only in case of failure of the other (HWfailure) or in case of failure of the backup actuator control module in case the main actuator control module has already failed.

[00274]. Furthermore, other control criteria are still possible, for example, also a coordination of the main data processing modules to drive the actuator simultaneously.

[00275]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, mutually the same. [00276]. In this embodiment, the further first main data processing module ET, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’ are, from a hardware point of view, mutually the same.

[00277]. In this embodiment, the at least one first main data processing module E1 , the at least one second main data processing module E2, the at least one third main data processing module E3, the at least one fourth main data processing module E4, are, from a hardware point of view, different from the further first main data processing module ET, the further second main data processing module E2’, the further third main data processing module E3’, the further fourth main data processing module E4’.

[00278]. In this embodiment, the at least one first actuator driving module P1 , the at least one second actuator driving module P2, the at least one third actuator driving module P3, the at least one fourth actuator driving module P4 are, from a hardware point of view, mutually the same and equal to the respective main data processing module E1 , E2, E3, E4.

[00279]. In this embodiment, the further first actuator driving module PT, the further second actuator driving module P2’, the further third actuator driving module P3’, the further fourth actuator driving module P4’ are, from a hardware point of view, mutually the same and equal to the respective further main data processing module ET, E2’, E3’, E4’.

[00280]. In this embodiment, the at least one first actuator driving module P1 , the at least one second actuator driving module P2, the at least one third actuator driving module P3, the at least one fourth actuator driving module P4, are, from a hardware point of view, different from the further first actuator driving module PT, the further second actuator driving module P2’, the further third actuator driving module P3’, the further fourth actuator driving module P4’.

[00281]. Therefore, also in this embodiment, in addition to a diversity from a software point of view, described above, with reference to an embodiment in figure 4 or figure 5, there is also a diversity, thus a redundancy, from a hardware point of view in each of the four braking actuation modules.

[00282]. According to different embodiments, this hardware diversity could be achieved not in each braking corner but only in braking corners of different vehicle diagonals or between braking corners of different vehicle axles or in any other possible combination.

[00283]. In this case, the redundancy will be present, for example, between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00284]. As for the diversity from a software point of view, it is reiterated that in the embodiment in figure 6, such a diversity is within the single braking actuation control module so that a braking control is still ensured even in case of software failure in one of the main data processing modules present in the same braking actuation module, by virtue of the intervention of the other main data processing module present in the same braking actuation module, which is failure-free.

[00285]. In more detail, the redundancy, from a software point of view, is introduced in each braking actuation module between the backup actuator control module present in one of the main data processing modules and the further backup actuator control module present in the other of the main data processing modules.

[00286]. According to different embodiments, this software diversity could be achieved not within a single braking corner but between braking corners of different diagonals or different vehicle axles or according to any other possible combination.

[00287]. In this case, the redundancy will be present between rear axle and front axle, left side and right side, or in all redundant components according to other possible combinations.

[00288]. According to an embodiment, in combination with the preceding one, the actuator of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 comprises a three-phase electric motor M1 , M2, M3, M4 and a brake caliper A1 , A2, A3, A4 actuatable by said three-phase electric motor M1 , M2, M3, M4.

[00289]. According to an embodiment in combination with any of the preceding ones in which the further main data processing module ET, E2’, E3’, E4’ is present in each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4, alternatively to the at least one electric power supply adjustment module G1 , G2, G3, G4 of the at least one main data processing module E1 , E2, E3, E4 and the further one main data processing module E1 ’, E2’ E3’, E4’ of each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4, each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3 and said fourth braking actuation module S-4 comprises at least one respective support and monitoring module of the at least one main data processing module E1 , E2, E3, E4 and the further one main data processing module ET, E2’, E3’, E4’. The at least one respective support and monitoring module C1 , C2, C3, C4 is further configured to control the power supply of the at least one main data processing module E1 , E2, E3, E4 and the further one main data processing module ET, E2’, E3’, E4’.

[00290]. An example of the operation of the system architecture 100 according to the present invention is now described with reference to an embodiment described with reference to figure 1 .

[00291]. The system architecture 100 is associated with a vehicle comprising: [00292]. - a first braking corner 1 comprising a respective first brake disc D-1 (front left corner F-L);

[00293]. - a second braking corner 2 comprising a respective second brake disc D-2 (front right corner F-R);

[00294]. - a third braking corner 3 comprising a respective third brake disc D-3 (rear left corner R-L);

[00295]. - a fourth braking corner 4 comprising a respective fourth brake disc D-4 (rear right corner R-R),

[00296]. The fourth braking actuation module S-4 is adapted to apply a braking action to said fourth brake disc D-4.

[00297]. A first braking actuation module S-1 of the system architecture 100 is associated with the first braking corner 1 of the vehicle and is adapted to apply a braking action to said first brake disc D-1 .

[00298]. A second braking actuation module S-2 of the system architecture 100 is associated with the second braking corner 2 of the vehicle and is adapted to apply a braking action to said second brake disc D-2.

[00299]. A third braking actuation module S-3 of the system architecture 100 is associated with the third braking corner 3 of the vehicle and is adapted to apply a braking action to said third brake disc D-3.

[00300]. A fourth braking actuation module S-4 of the system architecture 100 is associated with the fourth braking corner 4 of the vehicle and is adapted to apply a braking action to said fourth brake disc D-4.

[00301]. Furthermore, the system architecture 100 comprises a central control unit 5 operatively connected to said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4.

[00302]. Each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a hardware point of view, comprises at least one respective main data processing module E1 , E2, E3, E4, at least one respective actuator driving module P1 , P2, P3, P4, and a respective actuator M1 , A1 , M2, A2, M3, A3, M4, A4.

[00303]. Each of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4, from a software point of view, comprises a respective main actuator control module CA1 , CA2, CA3, CA4, a respective actuator safety monitoring module SA1 , SA2, SA3, SA4, and a backup actuator control module B1 , B2, B3, B4.

[00304]. During vehicle operation, the actuator safety monitoring module SA1 , SA2, SA3, SA4 detects a failure of the respective braking actuation module S- 1 , S-2, S-3, S-4, such as a failure in the respective main actuator control module CA1 , CA2, CA3, CA4.

[00305]. In this case, the actuator safety monitoring module SA1 , SA2, SA3, SA4 enables the respective backup actuator control module B1 , B2, B3, B4 to control the actuator in place of the main actuator control module CA1 , CA2, CA3, CA4 in which the failure was detected.

[00306]. In such a system architecture 100, from a software point of view, the actuator safety monitoring module SA1 , SA2, SA3, SA4 of a braking actuation module of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4 is implemented differently to perform the same actuator safety monitoring function with respect to the safety monitoring module SA1 , SA2, SA3, SA4 of at least another braking actuation module of said first braking actuation module S-1 , said second braking actuation module S-2, said third braking actuation module S-3, and said fourth braking actuation module S-4.

[00307]. In more detail, with reference to figure 1 , from a software point of view, the first actuator safety monitoring module SA1 of the first braking actuation module S-1 (first braking corner 1 , front left) and the fourth actuator safety monitoring module SA4 of the fourth braking actuation module S-4 (fourth braking corner 4, rear right) are mutually implemented in the same manner to perform the same actuator safety monitoring function.

[00308]. Furthermore, from a software point of view, the second actuator safety monitoring module SA2 of the second braking actuation module S-2 (second braking corner 2, front left) and the third actuator safety monitoring module SA3 of the third braking actuation module S-3 (third braking corner 3, rear right) are mutually implemented in the same manner to perform the same actuator safety monitoring function.

[00309]. However, from a software point of view, the first actuator safety monitoring module SA1 of the first braking actuation module S-1 (first braking corner 1 , front left) and the fourth actuator safety monitoring module SA4 of the fourth braking actuation module S-4 (fourth braking corner 4, rear right) are implemented differently to perform the same actuator safety monitoring function with respect to the second actuator safety monitoring module SA2 of the second braking actuation module S-2 (second braking corner 2, front right) and the third actuator safety monitoring module SA3 of the third braking actuation module S- 3 (third braking corner 3, rear left).

[00310]. Therefore, from a software point of view, a redundancy is advantageously introduced between the diagonal FL-RR and the diagonal FR- RL so that a braking control is still ensured even in case of a software failure in one of the braking actuation modules of one diagonal, by virtue of the intervention of the braking actuation modules of the other diagonal, which is free of failures.

[00311]. As can be seen, the object of the present invention is fully achieved.

[00312]. Indeed, the system architecture of the present invention and described with reference to different embodiments advantageously allows preventing/avoiding the problems if a common failure on several braking corners of the vehicle occurs so as to ensure and maintain high reliability of the so-called “wheel-distributed” braking system.

[00313]. Indeed, the introduction of hardware and software diversity within a single braking corner and/or on multiple braking corners of the vehicle, between different diagonals of the vehicle, between different axles of the vehicle, or between different sides of the vehicle, allow for one or more sufficient redundancies to be available to have the possibility to control the vehicle braking with adequate reliability despite the occurrence of a common failure on all braking corners.

[00314]. Indeed, the introduction of distributed hardware and/or software diversity on the vehicle braking corners drastically reduces the possibility that a common failure could affect the reliability of the entire braking system.

[00315]. This is because different components from a hardware and/or software point of view have different behaviors in response to a common failure, in other words, the possibility that a common failure on all braking corners of the vehicle could actually damage all components completely compromising the functionality of the vehicle braking system has greatly diminished.

[00316]. Furthermore, the present system architecture is completely independent of the type of actuators employable in the braking system (e.g., electro-mechanical or electro-hydraulic actuators), therefore it can be advantageously employed with any of the aforesaid actuator types.

[00317]. Those skilled in the art may make changes and adaptations to the embodiments of the system architecture described above or can replace elements with others which are functionally equivalent in order to meet contingent needs, without departing from the scope of the appended claims. Each of the features described above as belonging to a possible embodiment can be implemented irrespective of the other embodiments described.

Claims

1. A system architecture (100) for controlling a braking system of a vehicle, said vehicle comprising: a first braking corner (1 ) comprising a respective first brake disc (D- 1 ); a second braking corner (2) comprising a respective second brake disc (D-2); a third braking corner (3) comprising a respective third brake disc (D- 3); a fourth braking corner (4) comprising a respective fourth brake disc (D-4); said system architecture (100) comprising: a first braking actuation module (S-1 ) associable with the first braking corner (1 ) of the vehicle, the first braking actuation module (S-1 ) being adapted to apply a braking action to said first brake disc (D-1 ); a second braking actuation module (S-2) associable with the second braking corner (2) of the vehicle, the second braking actuation module (S-2) being adapted to apply a braking action to said second brake disc (D-2); a third braking actuation module (S-3) associable with the third braking corner (3), the third braking actuation module (S-3) being adapted to apply a braking action to said third brake disc (D-3); a fourth braking actuation module (S-4) associable with the fourth braking corner (4), the fourth braking actuation module (S-4) being adapted to apply a braking action to said fourth brake disc (D-4); a central control unit (5) operatively connected to said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, comprising at least one respective main data processing module (E1 , E2, E3, E4), at least one respective actuator driving module (P1 , P2, P3, P4), a respective actuator (M1 , A1 , M2, A2, M3, A3, M4, A4), each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a software point of view, comprising a respective main actuator control module (CA1 , CA2, CA3, CA4), a respective actuator safety monitoring module (SA1 , SA2, SA3, SA4), and a backup actuator control module (B1 , B2, B3, B4), the actuator safety monitoring module (SA1 , SA2, SA3, SA4) being configured to detect a failure of the respective braking actuation module (S-1 , S-2, S-3, S-4) and, if a failure of the braking actuation module (S-1 , S-2, S-3, S- 4) is detected, to also enable the backup actuator control module (B1 , B2, B3, B4) to control the actuator, in said system architecture (100), from a software point of view, the actuator safety monitoring module (SA1 , SA2, SA3, SA4) of a braking actuation module of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) is implemented differently to perform the same actuator safety monitoring function with respect to the safety monitoring module (SA1 , SA2, SA3, SA4) of at least another braking actuation module of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4).

2. The system architecture (100) according to claim 1 , wherein, from a software point of view: the main actuator control module (CA1 , CA2, CA3, CA4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) is implemented in the same manner to perform the same actuator control function; the backup actuator control module (B1 , B2, B3, B4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S- 2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) is implemented in the same manner to perform the same backup actuator control function; a first actuator safety monitoring module (SA1 ) of the first braking actuation module (S-1 ) is implemented in the same manner to perform an actuator safety monitoring function with respect to a fourth actuator safety monitoring module (SA4) of said fourth braking actuation module (S-4); a second safety monitoring module (SA2) of the second braking actuation module (S-2) is implemented in the same manner to perform an actuator safety monitoring function with respect to a third actuator safety monitoring module (SA3) of the third braking actuation module (S-3), the implementation from a software point of view to perform the same actuator safety monitoring function of the first actuator safety monitoring module (SA-1 ) of the first braking actuation module (S-1 ) and the fourth actuator safety monitoring module (SA-4) of said fourth braking actuation module (S-4) is different from the implementation to perform the same actuator safety monitoring function of the second actuator safety monitoring module (SA-2) of the second braking actuation module (S-2) and the third actuator safety monitoring module (SA-4) of the third braking actuation module (S-3).

3. The system architecture (100) according to claim 2, wherein: each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, comprises at least one respective support and monitoring module (C1 , C2, C3, C4) of the at least one main data processing module (E1 , E2, E3, E4), said at least one respective support and monitoring module (C1 , C2, C3, C4) being also configured to control the electric power supply of the at least one main data processing module (E1 , E2, E3, E4); the at least one main data processing module (E1 , E2, E3, E4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, is mutually the same; the at least one support and monitoring module (C1 , C2, C3, C4) of the at least one main data processing module (E1 , E2, E3, E4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S- 2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, is mutually the same; the at least one actuator driving module (R1 , P2, P3, P4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, is mutually the same.

4. The system architecture (100) according to claim 3, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), at least one first support and monitoring module (C1 ) of the at least one first main data processing module (E1 ), at least one first actuator driving module (P1 ), a first actuator (M1 , A1 ); the second braking actuation module (S-2) comprises at least one second main data processing module (E2), at least one second support and monitoring module (C2) of the at least one second main data processing module (E2), at least one second actuator driving module (P2), a second actuator (M2, A2); the third braking actuation module (S-3) comprises at least one third main data processing module (E3), at least one third support and monitoring module (C3) of the at least one third main data processing module (E3), at least one third actuator driving module (P3), a third actuator (M3, A3); the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), at least one fourth support and monitoring module (C4) of the at least one fourth main data processing module (E4), at least one fourth actuator driving module (P4), a fourth actuator (M4, P4), the at least one first main data processing module (E1 ) and the at least one fourth main data processing module (E4) being, from a hardware point of view, mutually the same, the at least one second main data processing module (E2) and the at least one third main data processing module (E3) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ) and the at least one fourth main data processing module (E4) being, from a hardware point of view, different from the at least one second main data processing module (E2) and the at least one third main data processing module (E3); the at least one first support and monitoring control module (C1 ) of the at least one first main data processing module (E1 ) and the at least one fourth support and monitoring module (C4) of the at least one fourth main data processing module (E4) being, from a hardware point of view, mutually the same, the at least one second support and monitoring module (C2) of the at least one second main data processing module (E2) and the at least one third support and monitoring control module (C3) of the at least one third main data processing module (E3) being, from a hardware point of view, mutually the same, the at least one first support and monitoring module (C1 ) of the at least one first main data processing module (E1 ) and the at least one fourth support and monitoring module (C4) of the at least one fourth main data processing module (E4) being, from a hardware point of view, different from the at least one second support and monitoring module (C2) of the at least one second main data processing module (E2) and the at least one third support and monitoring module (C3) of the at least one third main data processing module (E3); the at least one first actuator driving module (P1 ) and the at least one fourth actuator driving module (P4) being, from a hardware point of view, mutually the same, the at least one second actuator driving module (P2) and the at least one third actuator driving module (P3) being, from a hardware point of view, mutually the same, the at least one first actuator driving module (P1 ) and the at least one fourth actuator driving module (P4) being, from a hardware point of view, different from the at least one second actuator driving module (P2) and the at least one third actuator driving module (P3).

5. The system architecture (100) according to any one of the preceding claims 3 or 4, wherein the at least one support and monitoring module (C1 , C2, C3, C4) of the at least one main data processing module (E1 , E2, E3, E4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises a system base control module configured to externally control the at least one main data processing module (E1 , E2, E3, E4), enable/disable the actuator (M1 , A1 , M2, A2, M3, A3, M4, A4), control the electric power supply of the at least one main data processing module (E1 , E2, E3, E4).

6. The system architecture (100) according to any one of the preceding claims, wherein the at least one main data processing module (E1 , E2, E3, E4) of each of said first braking actuation module (S-1), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a software point of view, comprises the respective main actuator control module (CA1 , CA2, CA3, CA4), the respective actuator safety monitoring module (SA1 , SA2, SA3, SA4) and the respective backup actuator control module (B1 , B2, B3, B4).

7. The system architecture (100) according to claim 1 , wherein each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3) and said fourth braking actuation module (S-4), from a hardware point of view, comprises a further main data processing module (ET, E2’, E3’, E4’), the at least one main data processing module (E1 , E2, E3, E4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a software point of view, comprising the respective main actuator control module (CA1 , CA2, CA3, CA4) and the respective backup actuator control module (B1 , B2, B3, B4), the further main data processing module (ET, E2’, E3’, E4’) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises the respective actuator safety monitoring module (SA1 , SA2, SA3, SA4).

8. The system architecture (100) according to claim 7, wherein, from a software point of view: the main actuator control module (CA1 , CA2, CA3, CA4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) is implemented in the same manner to perform the same actuator control function; the actuator safety monitoring module (SA1 , SA2, SA3, SA4) of each of said first braking actuation module (S-1 ), second braking actuation module (S-2), third braking actuation module (S-3), fourth braking actuation module (S- 4) are implemented in the same manner to perform the same actuator safety monitoring function; a first backup actuator control module (B1 ) of the first braking actuation module (S-1 ) is implemented in the same manner to perform the same backup actuator control function with respect to a fourth backup actuator control module (B4) of said fourth braking actuation module (S-4); a second backup actuator control module (B1 ) of the second braking actuation module (S-2) is implemented in the same manner to perform the same backup actuator control function with respect to a third backup actuator control module (B3) of the third braking actuation module (S-3), the implementation from a software point of view to perform the same backup actuator control function of the first backup actuator control module (B1 ) of the first braking actuation module (S-1 ) and the fourth backup actuator control module (B4) of said fourth braking actuation module (S-4) is different from the implementation from a software point of view to perform the same backup actuator control function of the second backup actuator control module (B2) of the second braking actuation module (S-2) and the third backup actuator control module (B3) of the third braking actuation module (S-3).

9. The system architecture (100) according to any one of the preceding claims 7 or 8, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), a further first main data processing module (ET), at least one first electric power supply adjustment module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), at least one first actuator driving module (P1 ), a first actuator (M1 , A1 ); the second braking actuation module (S-2) comprises at least one second main data processing module (E2), a further second main data processing module (E2’), at least one second electric power supply adjustment module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), at least one second actuator driving module (P2), a second actuator (M2, A2); the third braking actuation module (S-3) comprises at least one third main data processing module (E3), a further third main data processing module (E3’), at least one third electric power supply adjustment module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), at least one third actuator driving module (P3), a third actuator (M3, A3); the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), a further fourth main data processing module (E4’ ), at least one fourth electric power supply adjustment module (G4) of the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’), at least one fourth actuator driving module (P4), a fourth actuator (M4, A4), the at least one first main data processing module (E1 ) and the at least one fourth main data processing module (E4) being, from a hardware point of view, mutually the same, the at least one second main data processing module (E2) and the at least one third main data processing module (E3) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ) and the at least one fourth main data processing module (E4) being, from a hardware point of view, different from the at least one second main data processing module (E2) and the at least one third main data processing module (E3); the further first main data processing module (E1 ’) and the further fourth main data processing module (E4’) being, from a hardware point of view, mutually the same, the further second main data processing module (E2’) and the further third main data processing module (E3’) being, from a hardware point of view, mutually the same, the further first main data processing module (E1 ’) and the further fourth main data processing module (E4’) being, from a hardware point of view, different from the further second main data processing module (E2’) and the further third main data processing module (E3’).

10. The system architecture (100) according to claim 9, wherein, from a hardware point of view, the further first main data processing module (ET), the further fourth main data processing module (E4’), the further second main data processing module (E2’), and the further third main data processing module (E3’) are different from the at least one first main data processing module (E1 ), the at least one fourth main data processing module (E4), the at least one second main data processing module (E2), and the at least one third main data processing module (E3).

11 . The system architecture (100) according to any one of claims 9 to 10, wherein the at least one first electric power supply adjustment module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), the at least one second electric power supply adjustment module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), the at least one third electric power supply adjustment module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), the at least one fourth electric power supply adjustment module (G4) of the at least one fourth main data processing module (E4) and the further second main data processing module (E4’), are, from a hardware point of view, mutually the same.

12. The system architecture (100) according to any one of the preceding claims 9 to 11 , wherein the at least one first actuator driving module (P1 ), the at least one second actuator driving module (P2), the at least one third actuator driving module (P3), and the at least one fourth actuator driving module (P4), from a hardware point of view, are mutually the same.

13. The system architecture (100) according to any one of the preceding claims 9 to 11 , wherein the at least one first actuator driving module (P1 ) and the at least one fourth actuator driving module (P4) are, from a hardware point of view, mutually the same, the at least one second actuator driving module (P2) and the at least one third actuator driving module (P3) being, from a hardware point of view, mutually the same, the at least one first actuator driving module (P1 ) and the at least one fourth actuator driving module (P4) being, from a hardware point of view, different from the at least one second actuator driving module (P2) and the at least one third actuator driving module (P3).

14. The system architecture according to claim 1 , wherein each of said first braking actuation module (S-1 ), said second braking actuation module (S- 2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a hardware point of view, comprises a further main data processing module (ET, E2’, E3’, E4’), one of the at least one main data processing module (E1 , E2, E3, E4) and the further main data processing module (ET, E2’, E3’, E4’) of each of said first braking actuation module (S-1 ), said second braking actuation module (S- 2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprising the respective main actuator control module (CA1 , CA2, CA3, CA4) and a respective actuator safety monitoring module (SA1 , SA2, SA3, SA4), the other of the at least one main data processing module (E1 , E2, E3, E4) and the further main data processing module (ET, E2’, E3’, E4’) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), from a software point of view, comprising the respective backup actuator control module (B1 , B2, B3, B4) and a respective further actuator safety monitoring module (SAT, SA2’, SA3’, SA4’).

15. The system architecture (100) according to claim 14, wherein from a software point of view: the main actuator control module (CA1 , CA2, CA3, CA4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) are implemented in the same manner to perform the same main actuator control function; the actuator safety monitoring module (SA1 , SA2, SA3, SA4) and the further safety monitoring module (SA1’, SA2’, SA3’, SA4’) of each of said first braking actuation module (S-1 ), second braking actuation module (S-2), third braking actuation module (S-3), fourth braking actuation module (S-4) are implemented in the same manner to perform the same actuator safety monitoring function; a first backup actuator control module (B1 ) of the first braking actuation module (S-1 ) is implemented in the same manner to perform a backup actuator control function with respect to a fourth backup actuator control module (B4) of said fourth braking actuation module (S-4); a second backup actuator control module (B2) of the second braking actuation module (S-2) is implemented in the same manner to perform a backup actuator control function with respect to a third backup actuator control module (B3) of the third braking actuation module (S-3), the implementation to perform the same backup actuator control function of the first backup actuator control module (B1 ) of the first braking actuation module (S-1 ) and the fourth backup actuator control module (B4) of said fourth braking actuation module (S-4) is different from the implementation to perform the same backup actuator control function of the second backup actuator control module (B2) of the second braking actuation module (S-2) and the third backup actuator control module (B3) of the third braking actuation module (S-3).

16. The system architecture (100) according to any one of the preceding claims 14 or 15, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), a further first main data processing module (ET), at least one first electric power supply adjustment module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), at least one first switching module (W1 ), at least one first actuator driving module (P1 ), a first actuator (M1 , A1 ), the at least one first switching module (W1 ) being adapted to connect the at least one first actuator driving module (P1 ) to the at least one first main data processing module (E1 ) or the further first main data processing module (ET) based on a respective switching signal; the second braking actuation module (S-2) comprises at least one second main data processing module (E2), a further second main data processing module (E2’), at least one second electric power supply adjustment module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), at least one second switching module (W2), at least one second actuator driving module (P2), a second actuator (M2, A2), the at least one second switching module (W2) being adapted to connect the at least one second actuator driving module (P2) to the at least one second main data processing module (E2) or the further second main data processing module (E2’) based on a respective switching signal; the third braking actuation module (S-3) comprises at least one third main data processing module (E3), a further third main data processing module (E3’), at least one third electric power supply adjustment module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), at least one third switching module (W3), at least one third actuator driving module (P3), a third actuator (M3, A3), the at least one third switching module (W3) being adapted to connect the at least one third actuator driving module (P3) to the at least one third main data processing module (E3) or the further third main data processing module (E3’) based on a respective switching signal; the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), a further fourth main data processing module (E4’ ), at least one fourth electric power supply adjustment module (G4) of the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’), at least one fourth switching module (W4), at least one fourth actuator driving module (P4), a fourth actuator (M4, A4), the at least one fourth switching module (W4) being adapted to connect the at least one fourth actuator driving module (P4) to the at least one fourth main data processing module (E4) or the further fourth main data processing module (E4’) based on a respective switching signal; the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, mutually the same, the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, different from the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’).

17. The system architecture (100) according to claim 14, wherein: the at least one main data processing module (E1 , E2, E3, E4), of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), comprises the respective main actuator control module (CA1 , CA2, CA3, CA4), the respective actuator safety monitoring module (SA1 , SA2, SA3, SA4), the respective backup actuator control module (B1 , B2, B3, B4); the further main data processing module (ET, E2’, E3’, E4’) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises the respective further actuator safety monitoring module (SAT, SA2’, SA3’, SA4’) and a respective further backup actuator control module (BT, B2’, B3’, B4’); from a software point of view: the main actuator control module (CA1 , CA2, CA3, CA4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) are implemented in the same manner to perform the same main actuator control function; the actuator safety monitoring module (SA1 , SA2, SA3, SA4) and the further safety monitoring module (SA1’, SA2’, SA3’, SA4’) of each of said first braking actuation module (S-1 ), second braking actuation module (S-2), third braking actuation module (S-3), fourth braking actuation module (S-4) are implemented in the same manner to perform the same actuator safety monitoring function; the backup actuator control module (B1 ) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) are implemented in the same manner to perform the same backup actuator control function; the further backup actuator control module (BT) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) are implemented in the same manner to perform the same backup actuator control function, the further actuator safety monitoring module (SAT, SA2’, SA3’, SA4’) being configured to detect a failure of the respective braking actuation module (S-1 , S-2, S-3, S-4) and, in case a failure of the braking actuation module (S-1 , S-2, S-3, S-4) is detected, to also enable the further backup actuator control module (BT, B2’, B3’, B4’) to control the actuator.

18. The system architecture (100) according to claim 17, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), a further first main data processing module (ET), at least one first electric power supply adjustment module (G1 ) of the at least one first main data processing module (E1 ) and the further first data processing module (ET), at least one first switching module (W1 ), at least one first actuator driving module (P1 ), a first actuator (M1 , A1 ), the at least one first switching module (W1 ) being adapted to connect the at least one first actuator driving module (P1 ) to the at least one first main data processing module (E1 ) or the further first main data processing module (ET) based on a respective switching signal; the second braking actuation module (S-2) comprises at least one second main data processing module (E2), a further second main data processing module (E2’), at least one second electric power supply adjustment module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), at least one second switching module (W2), at least one second actuator driving module (P2), a second actuator (M2, A2), the at least one second switching module (W2) being adapted to connect the at least one second actuator driving module (P2) to the at least one second main data processing module (E2) or the further second main data processing module (E2’) based on a respective switching signal; the third braking actuation module (S-3) comprises at least one third main data processing module (E3), a further third main data processing module (E3’), at least one third electric power supply adjustment module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), at least one third switching module (W3), at least one third actuator driving module (P3), a third actuator (M3, A3), the at least one third switching module (W3) being adapted to connect the at least one third actuator driving module (P3) to the at least one third main data processing module (E3) or the further third main data processing module (E3’) based on a respective switching signal; the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), a further fourth main data processing module (E4’ ), at least one fourth electric power supply adjustment module (G4) of the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’), at least one fourth switching module (W4), at least one fourth actuator driving module (P4), a fourth actuator (M4, A4), the at least one fourth switching module (W4) being adapted to connect the at least one fourth actuator driving module (P4) to the at least one fourth main data processing module (E4) or the further fourth main data processing module (E4’) based on a respective switching signal; the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, mutually the same, the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, different from the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’).

19. The system architecture (100) according to claim 18, wherein the at least one first power supply adjustment module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), the at least one second power supply adjustment module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), the at least one third electric power supply control module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), the at least one fourth electric power supply control module (G4) of the at least one fourth main data processing module (E4) and the further second main data processing module (E4’), are, from a hardware point of view, mutually the same.

20. The system architecture (100) according to any one of the preceding claims 18 or 19, wherein the at least one first actuator driving module (P1 ), the at least one second actuator driving module (P2), the at least one third actuator driving module (P3), and the at least one fourth actuator driving module (P4), from a hardware point of view, are mutually the same.

21 . The system architecture (100) according to claim 17, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), a further first main data processing module (E1 ’), at least one first electric power supply control module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), at least one first actuator driving module (P1 ) with a respective first switching module (W1 ) controlled by the at least one first main data processing module (E1 ), a further first actuator driving module (P1 ’) with a respective further first switching module (W1 ’) controlled by the further first main data processing module (ET), a first actuator (M1 , A1 ), the first switching module (W1 ) and the further first switching module (WT) being adapted to connect the at least one first actuator driving module (P1 ) or the further first actuator driving module (PT) to the first actuator (M1 , A1 ) based on a respective switching signal, respectively; the second braking actuation module (S-2) comprises at least one second main data processing module (E2), a further second main data processing module (E2’), at least one second electric power supply control module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), at least one second actuator driving module (P2) with a second switching module (W2) controlled by the at least one second main data processing module (E2), a further second actuator driving module (P2’) with a further second switching module (W2’) controlled by the further second main data processing module (E2’), a second actuator (M2, A2), the second switching module (W2) and the further second switching module (W2’) being adapted to connect the at least one second actuator driving module (P2) or the further second actuator driving module (P2’) to the second actuator (M2, A2) based on a respective switching signal, respectively; the third braking actuation module (S-3) comprises at least one third main data processing module (E3), a further third main data processing module (E3’), at least one third electric power supply control module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), at least one third actuator driving module (P3) with a third switching module (W3) controlled by the at least one third main data processing module (E3), a further third actuator driving module (P3’) with a further third switching module (W3’) controlled by the further third main data processing module (E3’), a third actuator (M3, A3), the third switching module (W3) and the further third switching module (W3’) being adapted to connect the at least one third actuator driving module (P3) or the further third actuator driving module (P3’) to the third actuator (M3, A3) based on a respective switching signal, respectively; the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), a further fourth main data processing module (E4’), at least one fourth electric power supply control module (G4) of the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’), at least one fourth actuator driving module (P4) with a fourth switching module (W4) controlled by the at least one fourth main data processing module (E4), a further fourth actuator driving module (P4’) with a further fourth switching module (W4’) controlled by the further fourth main data processing module (E4’), a fourth actuator (M4, A4), the fourth switching module (W4) and the further fourth switching module (W4’) being adapted to connect the at least one fourth actuator driving module (P4) or the further fourth actuator driving module (P4’) to the fourth actuator (M4, A4) based on a respective switching signal, respectively; the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, mutually the same, the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, different from the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’), the at least one first actuator driving module (P1 ) with the first switching module (W1 ), the at least one second actuator driving module (P2) with the second switching module (W2), the at least one third actuator driving module (P3) with the third switching module (W1 ), the at least one fourth actuator driving module (P4) with the fourth switching module (W4) being, from a hardware point of view, mutually the same and equal to the respective main data processing module (E1 , E2, E3, E4); the further first actuator driving module (PT) with the further first switching module (WT), the further second actuator driving module (P2’) with the further second switching module (W2’), the further third actuator driving module (P3’) with the further third switching module (W3’), the further fourth actuator driving module (P4’) with the further fourth switching module (W4’) being, from a hardware point of view, mutually the same and equal to the respective further main data processing module (ET, E2’, E3’, E4’); the at least one first actuator driving module (P1 ) with the first switching module (W1 ), the at least one second actuator driving module (P2) with the second switching module (W2), the at least one third actuator driving module (P3) with the third switching module (W1 ), the at least one fourth actuator driving module (P4) with the fourth switching module (W4) being, from a hardware point of view, different from the further first actuator driving module (P1 ’) with the further first switching module (WT), the further second actuator driving module (P2’) with the further second switching module (W2’), the further third actuator driving module (P3’) with the further third switching module (W3’), the further fourth actuator driving module (P4’) with the further fourth switching module (W4’).

22. The system architecture (100) according to any one of the preceding claims, wherein the actuator (M1 , A1 , M2, A2, M3, A3, M4, A4) of each of said first braking actuation module (S-1 ), said second braking actuation module (S- 2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises a three-phase electric motor (M1 , M2, M3, M4) and a brake caliper (A1 , A2, A3, A4) actuatable by said three-phase electric motor (M1 , M2, M3, M4).

23. The system architecture (100) according to claim 17, wherein: the first braking actuation module (S-1 ) comprises at least one first main data processing module (E1 ), a further first main data processing module (ET), at least one first electric power supply control module (G1 ) of the at least one first main data processing module (E1 ) and the further first main data processing module (ET), at least one first actuator driving module (P1 ) controlled by the at least one first main data processing module (E1 ), a further first actuator driving module (PT) controlled by the further first main data processing module (ET), a first actuator (M1 , A1 ), the at least one first main data processing module (E1 ) and the further first main data processing module (ET) being configured to connect the at least one first actuator driving module (P1 ) or the further first actuator driving module (PT) to the first actuator (M1 , A1 ), respectively; the second braking actuation module (S-2) comprises at least one second main data processing module (E2), a further second main data processing module (E2’), at least one second electric power supply control module (G2) of the at least one second main data processing module (E2) and the further second main data processing module (E2’), at least one second actuator driving module (P2) controlled by the at least one second main data processing module (E2), a further second actuator driving module (P2’) controlled by the further second main data processing module (E2’), a second actuator (M2, A2), the at least one second main data processing module (E2) and the further second main data processing module (E2’) being configured to connect the at least one second actuator driving module (P2) or the further second actuator driving module (P2’) to the second actuator (M2, A2), respectively; the third braking actuation module (S-3) comprises at least one third main data processing module (E3), a further third main data processing module (E3’), at least one third electric power supply control module (G3) of the at least one third main data processing module (E3) and the further third main data processing module (E3’), at least one third actuator driving module (P3) controlled by the at least one third main data processing module (E3), a further third actuator driving module (P3’) controlled by the further third main data processing module (E3’), a third actuator (M3, A3), the at least one third main data processing module (E3) and the further third main data processing module (E3’) being configured to connect the at least one third actuator driving module (P3) or the further third actuator driving module (P3’) to the third actuator (M3, A3), respectively; the fourth braking actuation module (S-4) comprises at least one fourth main data processing module (E4), a further fourth main data processing module (E4’), at least one fourth electric power supply control module (G4) of the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’), at least one fourth actuator driving module (P4) controlled by the at least one fourth main data processing module (E4), a further fourth actuator driving module (P4’) controlled by the further fourth main data processing module (E4’), a fourth actuator (M4, A4), the at least one fourth main data processing module (E4) and the further fourth main data processing module (E4’) being configured to connect the at least one fourth actuator driving module (P4) or the further fourth actuator driving module (P4’) to the fourth actuator (M4, A4), respectively; the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, mutually the same, the further first main data processing module (E1 ’), the further second main data processing module (E2’), the further third main data processing module (E3’), the further fourth main data processing module (E4’) being, from a hardware point of view, mutually the same, the at least one first main data processing module (E1 ), the at least one second main data processing module (E2), the at least one third main data processing module (E3), the at least one fourth main data processing module (E4), being, from a hardware point of view, different from the further first main data processing module (E1 ’), the further second main data processing module (E2¹), the further third main data processing module (E3’), the further fourth main data processing module (E4’), the at least one first actuator driving module (P1 ), the at least one second actuator driving module (P2), the at least one third actuator driving module (P3), the at least one fourth actuator driving module (P4) being, from a hardware point of view, mutually the same and equal to the respective main data processing module (E1 , E2, E3, E4); the further first actuator driving module (PT), the further second actuator driving module (P2’), the further third actuator driving module (P3’), the further fourth actuator driving module (P4’) being, from a hardware point of view, mutually the same and equal to the respective further main data processing module (E1’, E2’, E3’, E4’); the at least one first actuator driving module (P1 ), the at least one second actuator driving module (P2), the at least one third actuator driving module (P3), the at least one fourth actuator driving module (P4), being, from a hardware point of view, different from the further first actuator driving module (P1 ’), the further second actuator driving module (P2’), the further third actuator driving module (P3’), the further fourth actuator driving module (P4’).

24. The system architecture (100) according to claim 23, wherein the actuator (M1 , A1 , M2, A2, M3, A3, M4, A4) of said each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises a double-winding electric motor (M1 , M2, M3, M4) and a brake caliper (A1 , A2, A3, A4) actuatable by said double-winding electric motor (M1 , M2, M3, M4).

25. The system architecture according to any one of the preceding claims 9 to 24, wherein, as an alternative to the at least one electric power supply adjustment module (G1 , G2, G3, G4) of the at least one main data processing module (E1 , E2, E3, E4) and the further one main data processing module (E1 ’, E2’, E3’, E4’) of each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4), each of said first braking actuation module (S-1 ), said second braking actuation module (S-2), said third braking actuation module (S-3), and said fourth braking actuation module (S-4) comprises at least one respective support and monitoring module of the at least one main data processing module (E1 , E2, E3, E4) and the further one main data processing module (E1 ’, E2’, E3’, E4’), said at least one respective support and monitoring module (C1 , C2, C3, C4) being also configured to control the electric power supply of the at least one main data processing module (E1 , E2, E3, E4).