Method and device for identifying inertial signal of driving assistance system

Abstract

The invention relates to a method and a device for identifying an inertial signal of a driving assistance system. The method includes reading a first state signal and a second state signal showing states of the first inertial sensor and the second inertial sensor, reading a first condition signal and a second condition signal showing conditions of the inertial sensors, and determining a quality signal (112) indicative of a quality of the inertial signal (106) using the first status signal, the second status signal, the first condition signal, and the second condition signal.

Description

Technical Field

[0001] The present invention relates to a method, a corresponding control unit, and a corresponding computer program product. Background Art

[0002] For driving assistance systems, i.e., so-called ADAS and AD application examples, high-performance inertial measurement units, i.e., so-called IMUs, can be used. The inertial measurement unit provides important signals for ADAS and AD systems, and these systems require not only high power but also high functional safety. Summary of the Invention

[0003] In this context, a method for authenticating inertial signals of a driving assistance system is proposed using the method presented herein. In addition, a device using this method is proposed, and finally, a corresponding computer program product is proposed. Advantageous design solutions are obtained from the following description.

[0004] Through appropriate condition detection and signal processing, the functionality of the inertial measurement unit can be safely evaluated and shown.

[0005] A method for authenticating inertial signals of a driving assistance system of a vehicle based on a first measurement signal and a second measurement signal includes the following steps:

[0006] Read a first status signal through an interface to a first inertial sensor for providing a first measurement signal, and read a second status signal through an interface to a second inertial sensor for providing a second measurement signal, where the first inertial sensor and the second inertial sensor represent redundant sensors with respect to each other, and the first status signal shows the status of the first inertial sensor and the second status signal shows the status of the second inertial sensor;

[0007] Read a first condition signal through an interface to a first condition sensor, where the first condition signal indicates the condition of the first inertial sensor, and read a second condition signal through an interface to a second condition sensor, where the second condition signal indicates the condition of the second inertial sensor;

[0008] Provide an inertial signal in the case of using the first measurement signal and the second measurement signal; and

[0009] Determine a quality signal indicating the quality of the inertial signal in the case of using the first status signal, the second status signal, the first condition signal, and the second condition signal.

[0010] The vehicle can be a passenger car or a truck. The vehicle can be implemented as an automatically or semi - automatically controllable vehicle. A driving assistance system can be used to intervene semi - autonomously or autonomously in the functions of the vehicle. For example, the driving assistance system can be used to automatically control the vehicle. The sensor system of the driving assistance system can include multiple sensors, in addition to an inertial measurement unit. In the case of using an inertial measurement unit, for example, linear accelerations acting in three spatial directions and rotational accelerations acting around three axes can be detected. The first inertial sensor and the second inertial sensor can be configured to detect the same linear acceleration or the same rotational acceleration. Thus, the inertial sensors can be redundant acceleration sensors or redundant rotational speed sensors. The inertial measurement unit can include multiple corresponding sensor pairs. The status signal can represent the effective or ineffective status of the corresponding inertial sensor or the corresponding measurement signal as a status. The condition sensor can be configured to detect the operating condition of the associated inertial sensor or the operating environment of the associated inertial sensor. The corresponding condition can be, for example, the operating temperature or the energy consumption. The inertial signal can represent a parameter of acceleration or rotational speed. The quality signal can indicate the quality of the parameter represented by the inertial signal, for example, a high quality that allows the inertial signal to be used without restriction for the functions of the driving assistance system or a low quality that allows the inertial signal to be used only limitedly further.

[0011] In the determination step, depending on the first status signal, the second status signal, the first condition signal, and the second condition signal, the quality signal can be determined as a signal indicating the maximum signal accuracy of the inertial signal, a signal indicating a reduced signal accuracy of the inertial signal, or a signal indicating the non - existence of the signal accuracy of the inertial signal. The better the signal accuracy, the more unrestrictedly the inertial signal can be used for further applications. Appropriate determination rules can be used to determine the corresponding accuracy status.

[0012] For example, if the first status signal and the second status signal respectively indicate an effective status, then the quality signal can be determined as a signal indicating the maximum signal accuracy. If both measurement signals are effective, it can be assumed that both inertial sensors are working properly and both measurement signals are thus correct. If only one of the status signals indicates an effective status, the quality signal can be determined as a signal indicating a reduced signal accuracy. For example, if one of the measurement signals is invalid, the other measurement signal can be used to obtain and provide the inertial signal. Thus, the operation of the subsequent unit using the inertial signal is also ensured. If no status signal indicates an effective status, then the quality signal can be determined as a signal indicating the non - existence of the signal accuracy. In this case, there is no basis for obtaining an available inertial signal.

[0013] In a determination step, a quality signal depending on a first status signal, a second status signal, a first condition signal, and a second condition signal may be determined as a signal indicating a maximum functional safety integrity of an inertial signal or a signal indicating a reduced functional safety integrity of the inertial signal. The functional safety integrity may be a measure of safety, with which it can be assumed that the parameter represented by the inertial signal is correct, and additionally a measure of integrity, with which it can be assumed, for example, that the inertial signal is based on an undistorted measurement signal.

[0014] For example, if the first condition signal indicates a good condition of a first inertial sensor and the second condition signal indicates a good condition of a second inertial sensor, then the quality signal may be determined as a signal indicating a maximum functional safety integrity. Thus, if the first condition signal indicates a damaged condition of the first inertial sensor and the second condition signal indicates a damaged condition of the second inertial sensor, then the quality signal may be determined to have a safety condition indicating a reduced functional safety integrity. For example, if the operating temperature of the inertial sensor exceeds a predetermined threshold or the voltage supply of the inertial sensor does not meet a predetermined characteristic, then there may be a damaged condition, thereby not excluding, yet also not completely ensuring, the correct operation of the inertial sensor.

[0015] Thus, in a reading step, the first condition signal may indicate the temperature of the first inertial sensor as a condition, and the second condition signal may indicate the temperature of the second inertial sensor as a condition. The temperature may be a reliable measure of the functionality of the inertial sensor and can be simply detected.

[0016] The method may include the steps of: detecting a first measurement signal in the case of using a first inertial sensor, and detecting a second measurement signal in the case of using a second inertial sensor. For this purpose, known inertial sensors, such as inertial sensors, may be used.

[0017] Thus, the method may include the steps of: detecting a first condition signal in the case of using a first condition sensor, and detecting a second condition signal in the case of using a second condition sensor. For this purpose, known sensors, such as temperature sensors, may be used.

[0018] The method may include the steps of: reading the first measurement signal through an interface leading to the first inertial sensor, and reading the second measurement signal through an interface leading to the second inertial sensor. Here, the first measurement signal and the second measurement signal may represent mutually redundant signals. In a providing step, an inertial signal may be provided in the case of using the first measurement signal and the second measurement signal.

[0019] In the determination step, the quality signal can be provided as a digital signal with multiple bits, for example a 3-bit value. This can represent multiple different quality situations and, in addition, enable simple evaluation and further processing.

[0020] The method proposed here furthermore provides a device which is configured to perform or implement the steps of a variant of the method proposed here with corresponding means. By means of this implementation variant of the invention in the form of a device, the object of the invention can also be solved quickly and efficiently.

[0021] A device can currently be understood as an electrical component that processes sensor signals and outputs control and / or data signals based thereon. The device can have an interface that can be constructed based on hardware and / or software. In a hardware-based construction, the interface can be, for example, part of a so-called system ASIC that contains different functions of the device. However, it is also possible that the interface is a self-contained integrated circuit or at least partially consists of separate structural elements. In a software-based construction, the interface can be, for example, a software module that exists alongside other software modules on a microcontroller.

[0022] A computer program product having program code is also advantageous, the program code being storable on a machine-readable carrier, such as a semiconductor memory, a hard disk memory or an optical memory, and being used to execute a method according to one of the above-described embodiments when the program product is executed on a computer or a device. Description of the Drawings

[0023] The method proposed here is subsequently explained in detail by way of example with the aid of the drawings. Among them:

[0024] Figure 1 A schematic illustration of an embodiment of a vehicle is shown;

[0025] Figure 2 A circuit block diagram of an embodiment of a device is shown; and

[0026] Figure 3 A flow chart of an embodiment of a method is shown.

[0027] In the following description of advantageous embodiments of the invention, the same or similar reference numerals are used for elements shown in the various figures and having a similar function, where repeated descriptions of these elements are omitted. Detailed Description of the Invention

[0028] Figure 1 A schematic illustration of an embodiment of a vehicle 100 is shown, which vehicle has a driver assistance system 102 and a device 104 for evaluating inertial signals 106 of the driver assistance system 102.

[0029] Optionally, the device 104 includes an inertial measurement unit having at least a pair of inertial sensors for redundantly detecting linear acceleration and additionally or alternatively detecting rotational speed. For example, the inertial measurement unit is configured to detect acceleration in the x-direction, y-direction, and / or z-direction and additionally or alternatively detect rotational speed about the x-direction, y-direction, and / or z-direction. The inertial signal 106 is configured to transmit at least one detected value of acceleration or rotational speed, for example, via a bus or a direct signal line.

[0030] According to an embodiment, the driver assistance system 102 is configured to control at least one function of the vehicle 100 using the inertial signal 106. To avoid malfunction of the driver assistance system 102, the device 104 is configured to provide a quality signal 112 indicating the quality of the inertial signal 106. The driver assistance system 102 is, for example, configured to limit further processing of the inertial signal 106 when the quality signal 112 indicates a quality of the inertial signal 106 that is reduced relative to a normal condition. Here, the quality signal 112 can indicate not only a failure of the inertial measurement unit but also, for example, a reduction in the safety or integrity of the inertial signal 106. Thus, different gradations of signal quality can be indicated by the quality signal 112. For this purpose, according to an embodiment, the quality signal 112 is provided as a digital signal with a multi-bit value.

[0031] According to an embodiment, the quality signal 112 is determined not only using a status signal indicating the valid or invalid state of the measurement signal or the inertial sensor itself that enters the inertial signal 106 but also additionally using a condition signal indicating the condition of the inertial sensor.

[0032] A decisive feature of the inertial measurement unit of the vehicle 100 is to determine its internal system condition and the associated quality of the inertial signal (such as the inertial signal 106) transmitted, for example, on the vehicle field bus. The method described here goes beyond a fault-tolerant IMU architecture in which a minimum binary signal validity (such as a 1-bit qualifier) is transmitted at regular intervals to show an invalid signal to a receiving function at the vehicle level (such as the ESP system in the case of an AB+-control unit). Based on this qualifier, appropriate measures are triggered within the vehicle function to avoid malfunction of safety-critical driving functions. As an extension of binary validity, "potentially" invalid signal conditions are used within the scope of the AB+-function to indicate extreme external events that may lead to temporary invalidity. This can be caused by external vibrations that temporarily disrupt the inertial sensor and cause signal deviation.

[0033] The methods described herein go beyond the indication of signal quality in a binary status bit that indicates to the receiving function a valid or invalid signal condition. While this corresponds to the requirements of classical vehicle control functions (such as ESP systems), new development functions within AD / ADAS (Autonomous Driving / Advanced Driver Assistance Systems) require a more comprehensive display of signal quality, for example, in the case of using quality signal 112.

[0034] In particular, the latest generation of ADAS and AD functions, for example, implemented by the driver assistance system 102, require a high system robustness with respect to internal errors in the hardware and software components that impair the transmitted signal. This property is generally referred to as a fail-safe architecture. In this case, even in the event of an error in the hardware and / or software, the inertial measurement unit must maintain its function within a precisely defined range (the so-called degraded mode). This degraded mode may result in a reduction in functional safety integrity and / or signal power. Most importantly, the extent of the impairment is communicated to the receiving function at the vehicle level, such as the driver assistance system 102, so that appropriate measures can be taken for the driving function. This may include a reduction in speed during AD driving or the activation of the so-called "limp home" function.

[0035] Importantly, this behavior cannot be achieved using a simple Bit qualifier that only differentiates between valid and invalid signals, which represents a significant limitation in the available IMU signal processing methods.

[0036] Therefore, according to the methods described herein, a more extensive qualifier recognition and association scheme is implemented to meet the requirements of advanced AD / ADAS functions. The most important information that must be included in the signal qualifier and transmitted, for example, via quality signal 112 is, on the one hand, the current error condition of the system (which is determined, for example, by evaluating safety integrity and additionally or alternatively evaluating availability and expected metrics), and on the other hand, the expected current signal power, for example, based on signal loss or operating temperature conditions.

[0037] The methods described herein include a detailed signal identification scheme developed specifically for inertial measurement units in motor vehicles according to an embodiment to achieve the error operation behavior required for ADAS / AD functions. The identification scheme described herein extends the commonly used binary verification.

[0038] Here, according to an embodiment, the levels of signal deterioration caused by system errors and / or other limitations are covered:

[0039] 1) Interference-free operation / maximum power, i.e., maximum signal accuracy and functional safety integrity.

[0040] 2) Reduction in functional safety integrity, for example, due to loss of redundancy.

[0041] 3) Reduction in signal accuracy / power, for example due to redundancy loss or temperature range.

[0042] According to an embodiment, the quality signal 112 depicts an authentication scheme with the following conditions:

[0043] In the first case, the IMU status is "fully functional", the operating condition is "normal", the signal accuracy is "maximum", and the safety and integrity are "maximum". The description of the first case is "The system operates within the full range".

[0044] In the second case, the IMU status is "reduced power", the operating condition is "degraded mode (fail-op.)", the signal accuracy is "reduced", and the safety and integrity are "maximum". The description of the second case is "Limited signal accuracy (e.g., due to temperature range)".

[0045] In the third case, the IMU status is "reduced safety", the operating condition is "degraded mode (fail-op.)", the signal accuracy is "maximum", and the safety and integrity are "reduced". The description of the third case is "System error causes damage to safety, for example due to the failure of redundant sensors. Signal accuracy is impaired".

[0046] In the fourth case, the IMU status is "reduced power + safety", the operating condition is "degraded mode (fail-op.)", the signal accuracy is "reduced", and the safety and integrity are "reduced"; the description of the fourth case is "Combination of cases 2 and 3".

[0047] In the fifth case, the IMU status is "invalid", the operating condition is "fail-safe", the signal accuracy is "none", and the safety and integrity are "none". The description of the fifth case is "Signal marked as invalid, for example, unusable due to complete loss of the signal source".

[0048] Therefore, during normal and degraded mode operation of the IMU in a motor vehicle, periodic inertial signals can be authenticated.

[0049] Figure 2 Shows an embodiment of a circuit diagram of a device 104 for authenticating inertial signals 106 of a driving assistance system of a vehicle as described, for example, by Figure 1 The vehicle.

[0050] Optionally, device 104 includes a first inertial sensor 220 and a second inertial sensor 222. The first inertial sensor 220 and the second inertial sensor represent a redundant pair of sensors. The inertial sensors 220, 222 can be of the same or different types. The first inertial sensor 220 is configured to detect a value of acceleration or rotational speed and provide this value via a first measurement signal 224. The second inertial sensor 222 is configured to detect a value of acceleration or rotational speed and provide this value via a second measurement signal 226. In addition, the first inertial sensor 220 is configured to provide a first status signal 227 indicating the valid or invalid state of the first measurement signal 224. Accordingly, the second inertial sensor 222 is configured to provide a second status signal 228 indicating the valid or invalid state of the second measurement signal 226.

[0051] Optionally, device 104 includes a first condition sensor 230 and a second condition sensor 232. The first condition sensor 230 is configured to detect the condition of the first inertial sensor 220 and indicate this condition via a first condition signal 234. The second condition sensor 232 is configured to detect the condition of the second inertial sensor 222 and indicate this condition via a second condition signal 236. According to different embodiments, the first condition sensor 230 can be integrated in the first inertial sensor 220 or coupled to the first inertial sensor 200 so that the condition of the first inertial sensor 220 can be detected. Accordingly, the second condition sensor 230 can be integrated in the second inertial sensor 220 or coupled to the second inertial sensor 220 so that the condition of the second inertial sensor 220 can be detected. Merely by way of example, the condition sensor is implemented as a temperature sensor, and the condition signals 234, 236 indicate the temperature of the inertial sensors 220, 222.

[0052] According to an embodiment, device 104 includes a providing device 240 configured to read the first measurement signal 224 and the second measurement signal 226 via an interface and determine and provide an inertial signal 106 using the first measurement signal 226 and the second measurement signal 226.

[0053] According to an embodiment, device 104 includes a determining device 242 configured to read the first status signal 227 and the second status signal 228 and the first condition signal 234 and the second condition signal 236 via an interface and determine and provide a quality signal 112 using the first status signal 227, the second status signal 228, the first condition signal 234, and the second condition signal 236.

[0054] Optionally, the determination device 242 is configured to provide a quality signal 112 as a signal indicating a maximum signal accuracy, a reduced signal accuracy, or an assumed or existing lack of signal accuracy with respect to the inertial signal 106. The determination device 242 is, for example, configured to evaluate the first status signal 227 and the second status signal 228 in order to determine the quality signal 112. For example, the quality signal 112 is determined to indicate maximum signal accuracy when the two status signals 227, 228 each indicate a valid condition, to indicate reduced signal accuracy when one of the status signals 227, 228 indicates a valid condition and the other status signal 227, 228 indicates an invalid condition, and to indicate a lack of signal accuracy when the two status signals 227, 228 each indicate an invalid condition.

[0055] Optionally, the determination device 242 is configured to determine a quality signal 112 that depends at least on the first condition signal 234 and the second condition signal 236 as a signal indicating a maximum functional safety integrity of the inertial signal 106 or a reduced functional safety integrity of the inertial signal 106. The determination device 242 is, for example, configured such that if the first condition signal 234 indicates a good condition of the first inertial sensor 220 and the second condition signal 236 indicates a good condition of the second inertial sensor 224, then the quality signal 112 is determined as a signal indicating maximum functional safety integrity, or if the first condition signal 234 indicates a damaged condition of the first inertial sensor 220 and the second condition signal 236 indicates a damaged condition of the second inertial sensor 222, then the quality signal is determined as a signal indicating reduced functional safety integrity.

[0056] According to an embodiment, the first inertial sensor 220 represents the primary source, and the second inertial sensor 222 represents the secondary source. The first inertial sensor 220 is configured to provide, in addition to the first measurement signal 224, a first status signal 227 that indicates, for example, in the form of a binary status bit, the valid or invalid state (also referred to as the signal condition) of the first measurement signal 224. The second inertial sensor 220 is configured to provide, in addition to the second measurement signal 226, a second status signal 228 that indicates, for example, in the form of a binary status bit, the valid or invalid state of the second measurement signal 226.

[0057] According to an embodiment, the condition sensors 230, 232 are used for temperature monitoring. According to an embodiment, the condition signals 234, 236 each indicate a temperature range, for example, using 2 bits. For example, the value "00" of one of the condition signals 234, 236 can indicate a low temperature range, the value "01" can indicate a normal temperature range, and the value "11" can indicate a high temperature range.

[0058] According to an embodiment, a device 240 is provided that is configured as a signal selector, which selects, for example, a first measurement signal 224 or a second measurement signal 226 based on a predetermined selection rule to provide and transmit an inertial signal 106.

[0059] According to an embodiment, a determination device 242 is configured as an authentication logic, which is configured to determine a quality signal as a 3-bit signal and provide the 3-bit signal.

[0060] According to an embodiment, the scheme for generating a qualifier takes into account the following inputs:

[0061] 1) The signal quality status (of all redundant measurement signals 224, 226), which is shown here by status signals 227, 228.

[0062] 2) The temperature range display indicating the current operating temperature, which is shown here by condition signals 234, 236.

[0063] By combining all inputs 1) and 2), the current safety and power status of each transmitted inertial signal 106 can be accurately determined and shown by a quality signal 112.

[0064] The correlation of the current system temperature with the qualifier brings significant advantages. Thus, the expectations for signal accuracy, i.e., the system requirements, may vary according to the current temperature range. What can be achieved is, for example, to optimize the system by calibrating to a specific operating temperature point at room temperature. Then, the deviation from this calibrated condition will be reflected in the signal qualifier, which is associated with different signal accuracy levels.

[0065] Importantly, if the remaining accuracy meets the requirements of the reception function under these conditions outside the calibrated area, then this can significantly reduce the calibration work regarding temperature.

[0066] According to an embodiment, a suitable qualifier is set for each transmitted IMU signal (3x acceleration, 3x rotation speed), i.e., an inertial signal 106 in addition, to ensure the above behavior.

[0067] An exemplary design suggestion for this qualifier (signal condition) is a 3-bit qualifier provided on a quality signal 112 for each provided inertial signal 106:

[0068] Value IMU Status Signal Limitation

[0069] 000 Invalid No valid signal is transmitted (safety + power not met) 001 Deterioration of power and safety Level 2 Loss of the second-level redundant signal, reduced accuracy (e.g., low or high temperature range)

[0070] 010 Deterioration of power and safety, Level 1, Loss of the first-level redundant signal, reduced accuracy (e.g., low or high temperature range)

[0071] 011 Safety classification, Level 2, Loss of the second-level redundant signal, maximum accuracy (e.g., calibrated temperature range)

[0072] 100 Safety classification, Level 1, Loss of the first-level redundant signal, maximum accuracy (e.g., calibrated temperature range)

[0073] 101 Deterioration of power, Level 2, Sufficient number of valid signals, reduced accuracy (e.g., high temperature range)

[0074] 110 Deterioration of power, Level 1, Sufficient number of valid signals, reduced accuracy (e.g., low temperature range)

[0075] 111 Full functionality, Sufficient number of valid signals, maximum accuracy (e.g., calibrated temperature range)

[0076] The term "value" herein refers to the digital value transmitted by the quality signal 112.

[0077] The term "level" illustrates the degree of functional limitation.

[0078] The above example is only one of the many possibilities for reproducing the above behavior exemplarily.

[0079] By the method described herein, the IMU signal behavior can be reliably identified in the case of errors and the impact of reduced power (e.g., extreme temperature range).

[0080] Figure 3 A flowchart of an embodiment of a method for identifying inertial signals of a driving assistance system of a vehicle as described with the aid of the previous figures is shown.

[0081] Optionally, the method includes step 301, in which a first measurement signal is detected using a first inertial sensor and a second measurement signal is detected using a second inertial sensor. Optionally, the method includes step 303, in which a first condition signal is detected using a first condition sensor and a second condition signal is detected using a second inertial sensor.

[0082] Read the first status signal and the second status signal in step 305, and read the first condition and the second condition signal in step 307. Optionally, read the first measurement signal and the second measurement signal in step 309. Optionally, in step 309, provide an inertial signal using the first measurement signal and the second measurement signal. In step 313, determine and optionally provide a quality signal using the first status signal, the second status signal, the first condition signal, and the second condition signal.

[0083] Optionally, in step 315, use the inertial signal and the quality signal to perform the functions of the driver assistance system.

Claims

1. A method for evaluating an inertial signal (106) of a driver assistance system (102) of a vehicle (100) based on a first measurement signal (224) and a second measurement signal (226), wherein: The method comprises the following steps: reading (305) a first status signal (227) via an interface to a first inertial sensor (220) for providing the first measurement signal (224), and reading a second status signal (228) via an interface to a second inertial sensor (222) for providing the second measurement signal (226), wherein the first inertial sensor (220) and the second inertial sensor (222) represent sensors that are redundant with one another, and wherein the first status signal (227) indicates the status of the first inertial sensor (220) and the second status signal (228) indicates the status of the second inertial sensor (222); reading (307) a first status signal (234) through an interface to a first status sensor (230), wherein the first status signal (234) indicates a status of the first inertial sensor (220), and reading a second status signal (236) through an interface to a second status sensor (232), wherein the second status signal (236) indicates a status of the second inertial sensor (222); and A quality signal (112) indicative of a quality of the inertial signal (106) is determined (313) using the first state signal (227), the second state signal (228), the first condition signal (234), and the second condition signal (236).

2. The method according to claim 1, wherein: In a determination step (313), the quality signal (112) depending on the first state signal (227), the second state signal (228), the first condition signal (234) and the second condition signal (236) is determined as a signal indicating a maximum signal accuracy of the inertial signal (106), a signal indicating a reduced signal accuracy of the inertial signal (106) or a signal indicating an absence of the inertial signal (106).

3. The method according to claim 2, wherein: In the determination step (313), if the first status signal (227) and the second status signal (228) respectively indicate a valid condition, then the quality signal (112) is determined as a signal indicating maximum signal accuracy, if only one of the status signals (227, 228) indicates a valid condition, then the quality signal is determined as a signal indicating reduced signal accuracy, and if neither of the status signals (227, 228) indicates a valid condition, then the quality signal is determined as a signal indicating non-existent signal accuracy.

4. A method according to any one of the preceding claims, wherein: In a determination step (313), the quality signal (112) depending on the first state signal (227), the second state signal (228), the first condition signal (234) and the second condition signal (236) is determined as a signal indicating a maximum functional safety integrity of the inertial signal (106) or a signal indicating a reduced functional safety integrity of the inertial signal (106).

5. The method according to claim 4, wherein: In the determination step (313), if the first status signal (234) indicates a good status of the first inertial sensor (220) and the second status signal (236) indicates a good status of the second inertial sensor (222), then the quality signal (112) is determined to be a signal indicating maximum functional safety integrity, or if the first status signal (234) indicates a damaged status of the first inertial sensor (220) and the second status signal (236) indicates a damaged status of the second inertial sensor (222), then the quality signal (112) is determined to have a safety status indicating reduced functional safety integrity.

6. A method according to any one of the preceding claims, wherein: In the reading step (307), the first condition signal (234) indicates the temperature of the first inertial sensor (220) as a condition, and the second condition signal (236) indicates the temperature of the second inertial sensor (222) as a condition.

7. The method according to any one of the preceding claims comprises the following steps (301): detecting the first measurement signal (224) when using the first inertial sensor (220), and detecting the second measurement signal (226) when using the second inertial sensor (222); and the following steps (303): detecting the first condition signal (234) when using the first condition sensor (230), and detecting the second condition signal (236) when using the second condition sensor (232).

8. The method according to any of the preceding claims, comprising the following steps (309): reading the first measurement signal (224) via an interface to the first inertial sensor (220) and reading the second measurement signal (226) via an interface to the second inertial sensor (222), wherein: The first measurement signal (224) and the second measurement signal (226) represent signals that are redundant with each other; And the following step (311): providing the inertial signal (106) using the first measurement signal (224) and the second measurement signal (226).

9. A method according to any one of the preceding claims, wherein: In the determination step (313), the quality signal (112) is provided as a multi-bit valued digital signal.

10. A device (104) designed to carry out the steps of the method according to any one of claims 1 to 9 with corresponding means. 11 . A computer program product having a program code for executing the method according to claim 1 when the program product is executed on a device.

Images