Method and device for providing measurement data for a system

Abstract

In the method, a first sensor signal (SEN1) which is representative of a first measured variable is read in, wherein a first function (A) is executed depending on the first measured variable. It is detected whether at least one diagnosed first error symptom (Sym1, Sym2) is present, wherein the diagnosed first error symptom(s) (Sym1, Sym2) occur depending on the first sensor signal (SEN1). If one or more first error symptoms (Sym1, Sym2) are present, a first function-specific sensor signal (SEN1A) for the first function (A) is determined from a predetermined first set of signals and / or selected depending on predetermined rules. Furthermore, a quality indicator (Qi_1A) is selected from a predetermined set of quality indicators (Qi) for the first function-specific sensor signal (SEN1A) of the first function (A) on the basis of the predetermined rules, in particular on the basis of a decision matrix (9), depending on the at least one provided diagnosed first error symptom (Sym1, Sym2).The first function-specific sensor signal (SEN1A) and the quality indicator (Qi_1A) determined for the first function (A) are forwarded to the first function (A).

Description

The present disclosure relates to a method and a corresponding device for providing measurement data for a system, in particular for a vehicle. The disclosure further relates to a control unit and a computer program and a computer-readable storage medium.In modern vehicles, more and more control units are integrated and more functionalities are implemented. As a result of their increasing networking and complexity, the realization of the functional safety likewise becomes increasingly complex.In addition, the development tendency toward the autonomous driving vehicle drastically increases the functional safety requirements. Where the driver has often had to make the last decision in safety-relevant situations, this decision is increasingly shifted toward the vehicle, or the vehicle controller itself, by using numerous driver assistance systems.For this purpose, numerous sensor signals are determined or detected, which are used, for example, as guide or manipulated variables. If the sensor signals cannot be provided or cannot be provided with sufficient quality and / or integrity, this can lead to limited operation of the vehicle or to a failure of the vehicle.In the implementation of functional safety, the focus in the past was almost exclusively on switching the system inactive ("fail-safe") when a fault in the system is detected. However, in the case of systems for autonomously driving vehicles, it is necessary to implement a significantly more complex fault response in order to achieve the lowest-risk state of the vehicle ("fail-operational"). Thus, for example, instead of shutting down the vehicle as quickly as possible in the event of a fault, it may be necessary to initially accelerate the vehicle again, if necessary, in order to move the vehicle away from the rails, for example, when crossing a railway crossing.An essential prerequisite for this is that the relevant measurement data are available in any situation in sufficient quality and with sufficient integrity.An object to be achieved is therefore to provide a method which enables reliable and flexible provision of measurement data for a system, in particular for a vehicle.The object is achieved by the features of the independent claims. Advantageous further developments of the invention are characterized in the dependent claims.According to a first aspect and a second aspect, the object is achieved by a method and a corresponding device for providing measurement data to a system. The system is, for example, a vehicle or a subsystem of a vehicle. The system is configured to perform at least a first function. The function is, for example, a vehicle function.In the method, a first sensor signal, which is provided by a sensor device of the system and is representative of a first measured variable, is read in, wherein the first function is executed as a function of the first measured variable during its execution.The term sensor signal in the sense of this document comprises both analog sensor signals and digital sensor signals, which are transmitted in series or in parallel, and sensor data, which are transmitted, for example, via a predefined network, for example an Ethernet network, or predefined bus, for example a CAN bus, by means of a protocol.It is detected whether at least one diagnosed first fault symptom is present, wherein the diagnosed first fault symptom or symptoms occur as a function of the first sensor signal. The diagnosed first fault symptoms may be provided by diagnostic devices of the system. Preferably, all first fault symptoms that occur as a function of the first sensor signal are provided and read in. The respective diagnosed fault symptom can be provided, for example, in the form of a specific fault code.If there is no diagnosed first fault symptom, a first quality indicator indicating a valid first sensor signal is assigned to the first sensor signal, and the first sensor signal and the assigned first quality indicator are forwarded to the first function.If one or more first fault symptoms are present, a first function-specific sensor signal for the first function is determined from a predefined first set of signals and / or selected depending on predefined rules.The rules can comprise a decision matrix which relates possible diagnostic first fault symptoms possible for the first function to predefined requirements of the first function on a signal quality and / or on a signal integrity on a signal which represents the first measurement variable.Furthermore, a quality indicator is selected from a predefined set of quality indicators for the first function-specific sensor signal of the first function on the basis of the predefined rules, in particular on the basis of the decision matrix, depending on the at least one provided diagnosed first fault symptom. The first function-specific sensor signal and the associated ascertained quality indicator are forwarded to the first function. The forwarding of the first function-specific sensor signal and the associated ascertained quality indicator to the first function has the effect, in particular, that the first function, depending on the ascertained quality indicator, is either executed differently as in a fault-free case, executed differently than in the fault-free case, or not executed, and / or executed only for a specific duration.Advantageously, this allows the evaluation of the sensor signal to be performed centrally and not to be performed by the first function, and if necessary, another suitable signal may be provided for the first function.In at least one advantageous embodiment according to the first and second aspects, the determination and / or selection of the first function-specific sensor signal for the first function and / or the selection of the quality indicator for the first function takes place as a function of a comparison of the first sensor signal with a reference, wherein the reference can comprise a further first sensor signal which is likewise representative of the first measurement variable, but is detected and / or determined differently than the first sensor signal.In at least one advantageous configuration according to the first and second aspects, the reference comprises a further first sensor signal which is likewise representative of the first measurement variable, but is detected and / or determined differently from the first sensor signal. This makes it possible to detect a faulty first sensor signal in a simple manner.In at least one advantageous configuration according to the first and second aspect, the first set of signals comprises at least two of the following signals:the first sensor signal and / orthe further first sensor signal and / ora constant first signal having a value that is equal to a maximum value of the first sensor signal, and / orconstant second signal having a value which is equal to a minimum value of the first sensor signal, and / ora constant third signal having a value which is equal to a stored last valid sensor value, and / ora first model signal which is determined as a function of a predetermined model and is representative of the first measurement variable.In at least one advantageous embodiment according to the first and second aspect, the set of quality indicators comprises at least two of the following indicators:the first quality indicator, which indicates a valid first sensor signal, and / ora second quality indicator which indicates an invalid first sensor signal, and / ora third quality indicator indicating that a stored last valid first sensor signal value is provided, and / ora fourth quality indicator, which indicates that the further first sensor signal is provided, and / ora fifth quality indicator indicating that the model signal is provided, and / ora sixth quality indicator, which indicates that the maximum value of the first sensor signal is provided, and / ora seventh quality indicator, which indicates that a minimum value of the first sensor signal is provided, and / oran eighth quality indicator indicating that an initialization value is provided.In at least one advantageous configuration according to the first and second aspects, the system is designed to execute at least one second function in addition to the first function. The second function is executed as a function of the first measured variable during its execution. For this purpose, the method comprises the further steps described below.If no diagnosed first fault symptom is present, the first sensor signal and the associated first quality indicator are forwarded to the second function.If one or more diagnosed first fault symptoms are present, a second function-specific sensor signal for the second function is determined from the predefined first set of signals depending on the predefined rules, in particular on the basis of the decision matrix, depending on the diagnosed first fault symptom or symptoms provided. For this purpose, the decision matrix additionally comprises requirements of the second function for the signal quality and / or for the signal integrity of the signal representing the first measurement variable, which requirements are predefined for the second function, and the decision matrix relates the possible diagnostic first fault symptoms to the requirements of the second function for the signal quality and / or for the signal integrity of the signal representing the first measurement variable. Furthermore, a quality indicator is selected from the predefined set of quality indicators for the second function-specific sensor signal of the second function as a function of the predefined rules, in particular on the basis of the decision matrix as a function of the diagnosed first fault symptom or symptoms provided. The second function-specific sensor signal and the associated ascertained quality indicator are forwarded to the second function. The forwarding of the second function-specific sensor signal and the associated ascertained quality indicator to the second function has the effect, in particular, that the second function, depending on the ascertained quality indicator, is either executed differently as in a fault-free case, executed differently than in the fault-free case, or not executed, and / or executed only for a specific duration.Advantageously, this makes it possible for different signals or the relevant measurement data and different quality indicators to be made available for the functions depending on the requirement, and the availability of the system can thus be increased.In at least one advantageous embodiment, in response to a request for the first and / or the second function, which has an instruction to adapt the decision matrix, the decision matrix is adapted with respect to the selection of the quality indicators and / or the selection of the first function-specific sensor signal or the second function-specific sensor signal, wherein the request is dependent on predefined criteria for a behavior of the first or the second function in the event of occurrence in different fault situations. In particular, the request may be dependent on a period of time for which the respective first fault symptom already occurs and / or whether a fault causing the at least one fault symptom is confirmed.This advantageously allows that in a fault scenario each function can configure its requirement characteristic with respect to signal quality and / or signal integrity on the basis of the provided fault symptoms. Each of the functions can thus decide which measured values or "substitute values" and which quality indicator it is allowed to obtain or wants in a specific fault-symptom-active case.In at least one advantageous embodiment, a tolerance is determined and provided for each of the first sensor signal and / or the first function-specific sensor signal and / or the second function-specific sensor signal, wherein the tolerance represents a difference between the first sensor signal and the further first sensor signal.According to a third aspect, the object is achieved by a control unit which has a device according to the second aspect, a reception interface and an output interface. The receiving interface is configured to receive the first sensor signal and the further first sensor signal from predetermined sensor devices and to forward the instructions from units which execute the first and / or second function to the device, The output interface is configured to transmit the first sensor signal, the first function-specific sensor signal and the second function-specific sensor signal and the quality indicators to the units which execute the first and / or second function.The apparatus includes a processor and a program memory. The processor may be a central processing unit (CPU), the processor may further be another general purpose processor, a microcontroller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or another programmable logic device. The general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like.The object is achieved according to a fourth aspect by a computer program comprising instructions which, when executed by a computer, cause the computer to execute the method according to the first aspect.For the purposes of this document, the denomination of such a computer program is synonymous with the term a program element or a computer program product which contains instructions for controlling a computer system in order to coordinate the operation of a system or a method in a suitable manner in order to achieve the effects associated with the method according to the invention. The computer program may be implemented as computer readable instruction code in any suitable programming language such as JAVA, C++, etc. The instruction code may program a computer or other programmable devices to perform the desired functions.According to a fifth aspect, the object is achieved by a computer-readable storage medium on which the computer program according to the fourth aspect is stored.The computer program can be stored on a computer-readable storage medium (CD-ROM, DVD, Blu-ray Disk, removable drive) or in a volatile or non-volatile memory, a built-in memory / processor, a random access memory (RAM for short), a read-only memory (ROM for short), an erasable programmable read-only memory (EPROM for short), etc. The computer readable storage medium is configured to store associated program instructions and associated data.Further, the computer program may be provided on a network such as the Internet from which it may be downloaded by a user as required.Advantageous embodiments of the first and second aspect also apply here to the third, fourth and fifth aspect.Further advantageous embodiments are disclosed in the appended claims and in the following description of exemplary embodiments with reference to the appended figures. The description of the subject matter provided herein is not limited to the particular specific embodiments. Features of different exemplary embodiments can be combined with one another-insofar as technically expedient-in order to form further exemplary embodiments. For example, variations or modifications described with respect to one of the embodiments may also be applicable to other embodiments unless otherwise stated.It shows: FIG. 1 shows a schematic block diagram of an exemplary embodiment of a control unit having a measurement data provision module for a system.In the figures, like reference numerals are used for elements having substantially the same function, but these elements need not be identical in all details.FIG. 1 shows a simplified exemplary block diagram for a control unit 1 with a measurement data provision module 5 for a system.The system is, for example, a vehicle or a subsystem of a vehicle. The subsystem may be, for example, a high-voltage system of the vehicle.The system is designed to execute at least one first function A. The system is preferably designed to carry out a plurality of functions. In the exemplary embodiment shown in FIG. 1, a first function A and a second function B are shown by way of example. The functions A, B are vehicle functions in the case of a vehicle.The control unit 1 has a reception interface 3, an output interface 7 and the measurement data provision module 5. The measurement data provision module 5 can also be referred to as a device for providing measurement data or as a sensor signal integrity coordinator.The measurement data providing module 5 includes, for example, a processor and a program memory, and functions as a computing unit that executes a computing program.The reception interface 3 is designed to receive a first sensor signal. The first sensor signal SEN 1 is representative of a first measured variable which is used by the first function A and the second function B. In particular, the first function A and the second function B are executed as a function of the first measured variable during their execution.The first measured variable is, for example, a cell voltage of a battery cell of a high-voltage battery of the vehicle.The receiving interface 3 is further configured to receive at least one diagnosed first fault symptom Sym 1, Sym 2, for example in the form of a fault code, wherein the at least one diagnosed first fault symptom Sym 1, Sym 2 occurs depending on the first sensor signal SEN 1. For example, the diagnosed first fault symptom Sym 1 occurs when the first sensor signal SEN 1 is faulty, for example exceeds a predefined tolerance range.The at least one diagnosed fault symptom Sym 1, Sym 2 is sent to the receiving interface 3 by a diagnostic device of the sensor device that provides the first sensor signal SEN 1, for example.In a cell voltage measurement, for example, a main analog-to-digital converter and an auxiliary analog-to-digital converter, also referred to as a redundant analog-to-digital converter, are used and the results are compared. If the results deviate too strongly from one another, an error message, which can also be referred to as error symptom, is output. Information on the actual cause of the fault is not contained in the fault message.The receiving interface 3 can furthermore be configured to receive a diagnosed further first fault symptom Sym 2, wherein the diagnosed further first fault symptom Sym 2 likewise occurs depending on the first sensor signal SEN 1. For example, the diagnosed further first fault symptom Sym 2 occurs when the first sensor signal SEN 1 has a constant level of 0 volts, for example.Preferably, a plurality of diagnosed first fault symptoms Sym 1, Sym 2 are provided to the measurement data provision module 5. It is advantageous if the receiving interface 3 is designed to receive all first fault symptoms Sym 1, Sym 2 that occur as a function of the first sensor signal SEN 1 and to provide them to the measurement data provision module 5.The measurement data provision module 5 has a decision matrix 9. The decision matrix 9 can also be referred to as a decision table.The measurement data provision module 5 is designed to select and / or determine a first output sensor signal for the first function A from a predefined first set of signals with the aid of the decision matrix 9 as a function of the at least one received diagnosed first fault symptom.The measurement data provision module 5 is, for example, further configured to select and / or determine a second output sensor signal for the second function B from the predefined first set of signals with the aid of the decision matrix 9 depending on the at least one received diagnosed first fault symptom Sym 1, Sym 2.The decision matrix 9 sets the possible diagnostic first fault symptoms, which occur as a function of the first sensor signal SEN 1, with respect to predefined requirements of the first function A to a signal quality and / or a signal integrity of a signal representing the first measurement variable.Furthermore, the decision matrix 9 sets, for example, the possible diagnostic first fault symptoms which occur as a function of the first sensor signal SEN 1, in relation to predefined requirements of the second function B, to a signal quality and / or a signal integrity of a signal which represents the first measurement variable.In FIG. 1, a diagnosed first fault symptom Sym 1 and a diagnosed further first fault symptom Sym 2 are provided by way of example.The measurement data provision module 5 thus selects, with the aid of the decision matrix 9, the first function-specific sensor signal SEN 1A for the first function A and a second function-specific sensor signal SEN 1B for the second function B from the predefined first set of signals as a function of the diagnosed first fault symptom Sym 1 and the diagnosed further first fault symptom Sym 2. The first and the second function-specific sensor signal SEN 1A, SEN 1B may be the same or different.The first set of signals comprises at least two of the following signals: the first sensor signal SEN 1 and / or the further first sensor signal SEN_red and / or a constant first signal having a value which is equal to a maximum value of the first sensor signal SEN 1 and / or a constant second signal having a value which is equal to a minimum value of the first sensor signal SEN 1 and / or a constant third signal having a value which is equal to a stored last valid sensor value and / or a first model signal which is determined depending on a predetermined model and is representative of the first measurement variable.The measurement data provision module 5 is further configured to select a quality indicator Qi_ 1A from a predefined set of quality indicators Qi for the first function-specific sensor signal SEN 1A of the first function A with the aid of the provided decision matrix 9 depending on the at least one provided diagnosed first fault symptom Sym 1, Sym 2.The measurement data provision module 5 is further configured, for example, to select a quality indicator Qi_ 1B from the predefined set of quality indicators Qi for the second function-specific sensor signal SEN 1B of the second function B with the aid of the provided decision matrix 9 depending on the provided diagnosed first fault symptom Sym 1 and depending on the diagnosed further first fault symptom Sym 2.The quality indicator Qi_ 1A of the first function-specific sensor signal SEN 1A and the quality indicator Qi_ 1B of the second function-specific sensor signal SEN 1B may be the same or different.The set of quality indicators Qi comprises at least two of the following indicators: the first quality indicator which indicates a valid first sensor signal and / or a second quality indicator which indicates an invalid first sensor signal and / or a third quality indicator which indicates that a stored last valid first sensor signal value is provided and / or a fourth quality indicator which indicates that the further first sensor signal SEN1_red is provided and / or a fifth quality indicator which indicates that the model signal is provided and / or a sixth quality indicator which indicates that the maximum value of the first sensor signal SEN1 is provided and / or a seventh quality indicator which indicates that a minimum value of the first sensor signal SEN1 is provided and / or an eighth quality indicator, indicating that an initialization value is provided.The measurement data provision module 5 is configured, for example, if there is no diagnosed first fault symptom Sym 1, Sym 2, to associate the first quality indicator, which indicates a valid first sensor signal, with the first sensor signal and to forward the first sensor signal SEN 1 and the associated first quality indicator to the first function A and the second function B.If, on the other hand, the diagnosed first fault symptom Sym 1 and / or the diagnosed further first fault symptom Sym 2 is detected for the first time, the second quality indicator indicating an invalid first sensor signal can be selected for the first function A, which makes a very high requirement for the signal quality, and the first sensor signal SEN 1 can be forwarded to the first function A. In contrast, for example, for the second function B and a third function, depending on which of the two signals has a higher value, the first sensor signal SEN 1 or the further first sensor signal SEN_red can be selected (the first sensor signal SEN 1 and the further first sensor signal SEN_red are still available, but deviate from one another beyond a tolerance limit). In addition, for the second function B and the third function, the second quality indicator indicating an invalid first sensor signal may be selected.If, on the other hand, the diagnosed first fault symptom Sym 1 or the diagnosed further first fault symptom Sym 2 occurs longer or repeatedly and / or a permanent fault is confirmed by the occurrence of an additional first fault symptom, the second quality indicator indicating an invalid first sensor signal can be selected for the second function B, for example, since the second function B can tolerate a poorer signal quality for a specific period of time only (for example, fault tolerance time, FTT, for a specific safety goal).For example, the first quality indicator can still be selected for the third function, since the third function can be executed with the "limp home" value as long as a certain tolerance is not violated.The measurement data provision module 5 is thus also configured, for example, to adapt the decision matrix 9 with respect to the selection of the quality indicators Qi and / or the selection of the first function-specific sensor signal SEN 1A or the second function-specific sensor signal SEN 1B in response to a request for the first and / or the second function B and / or the third function which has an instruction to adapt the decision matrix 9, wherein the request and / or the sending of the request is dependent on predefined criteria for a behavior of the first, the second or the third function when occurring in different fault situations.List of reference characters1 Control unit 3 Reception interface 5 Measurement data provision module 7 Output interface 9 Decision matrix A First function B Second function SEN 1 First sensor signal SEN 1_red Further first sensor signal Smy 1, Sym 2 First fault symptoms SEN 1A First function-specific sensor signal SEN 1B Second function-specific sensor signal Qi, Qi_ 1A, Qi_ 1B Quality indicator T_ 1A, T_ 1B Tolerance

Claims

Method for providing measurement data for a system, wherein the system is designed to execute at least one first function (A) and the method comprises the following steps: - reading in a first sensor signal (SEN1) which is provided by a sensor device of the system and is representative of a first measurement variable, wherein the first function (A) is executed as a function of the first measurement variable when it is executed, - detecting whether at least one diagnosed first fault symptom (Sym1, Sym2) is present, wherein the diagnosed first fault symptom or symptoms (Sym1, Sym2) occur as a function of the first sensor signal (SEN1), - if no diagnosed first fault symptom (Sym1, Sym2) is present, - assigning a first quality indicator which indicates a valid first sensor signal, to the first sensor signal (SEN 1), and forwarding the first sensor signal (SEN 1) and the associated first quality indicator to the first function (A), and if one or more first fault symptoms (Sym 1, Sym 2) are present, ascertaining and / or selecting a first function-specific sensor signal (SEN 1A) for the first function (A) from a predefined first set of signals depending on predefined rules and depending on the diagnosed first fault symptom or symptoms (Sym 1, Sym 2) provided, selecting a quality indicator (Qi_1A) from a predefined set of quality indicators (Qi) for the first function-specific sensor signal (SEN1A) of the first function (A) as a function of the predefined rules and as a function of the at least one diagnosed first fault symptom (Sym1, Sym2) provided, forwarding the first function-specific sensor signal (SEN1A) and the associated ascertained quality indicator (Qi_1A) to the first function (A).Method according to Claim 1, wherein the predefined rules comprise a decision matrix (9) which relates possible diagnostic first fault symptoms which occur as a function of the first sensor signal (SEN1), to predefined requirements of the first function (A) on a signal quality and / or a signal integrity of a signal which represents the first measurement variable.Method according to Claim 1 or 2, wherein the determination and / or selection of the first function-specific sensor signal (SEN1A) for the first function (A) and / or the selection of the quality indicator (Qi_1A) takes place as a function of a comparison of the first sensor signal (SEN1) with a reference.Method according to Claim 3, wherein the reference comprises a further first sensor signal (SEN1_red), which is likewise representative of the first measurement variable, but is detected and / or determined differently from the first sensor signal (SEN_1).Method according to one of the preceding claims, wherein the first set of signals comprises at least two of the following signals: the first sensor signal (SEN1) and / or the further first sensor signal (SEN1_red) and / or a constant first signal having a value which is equal to a maximum value of the first sensor signal (SEN1) and / or a constant second signal having a value which is equal to a minimum value of the first sensor signal (SEN1), and / or a constant third signal having a value which is equal to a stored last valid sensor value, and / or a first model signal which is determined as a function of a predefined model and is representative of the first measurement variable.Method according to any of the preceding claims, wherein the set of quality indicators (Qi) comprises at least two of the following indicators: the first quality indicator indexing a valid first sensor signal and / or a second quality indicator indexing an invalid first sensor signal and / or a third quality indicator indexing a stored last valid first sensor signal value is provided and / or a fourth quality indicator indexing the further first sensor signal (SEN1_red) is provided and / or a fifth quality indicator indexing the model signal is provided and / or a sixth quality indicator indexing the maximum value of the first sensor signal (SEN1) is provided and / or a seventh quality indicator indexing, providing a minimum value of the first sensor signal (SEN1) and / or an eighth quality indicator indicating that an initialization value is provided.Method according to one of the preceding claims, wherein the system is designed to execute at least one second function (B) in addition to the first function (A), wherein the second function (B) is executed as a function of the first measured variable during its execution, and the method has the further steps: - if there is no diagnosed first fault symptom (Sym1, Sym2), - forwarding the first sensor signal (SEN1) and the associated first quality indicator (Q1) to the second function (B), and - if there are one or more diagnosed first fault symptoms (Sym1, Sym2), determining and / or selecting a second function-specific sensor signal (SEN 1B) for the second function (B) from the predefined first set of signals on the basis of the decision matrix (9) as a function of the diagnosed first fault symptoms (Sym 1, Sym 2) provided, wherein the decision matrix (9) additionally relates, for the second function (B), the possible diagnostic first fault symptoms which occur as a function of the first sensor signal (SEN 1), to predefined requirements of the second function (B) on the signal quality and / or on the signal integrity on the signal which represents the first measurement variable, selecting a quality indicator (Qi_1B) from the predefined set of quality indicators (Qi) for the second function-specific sensor signal (SEN1B) of the second function (B) on the basis of the decision matrix (9) as a function of the diagnosed first fault symptoms (Sym1, Sym2) provided, forwarding the second function-specific sensor signal (SEN1B) and the associated ascertained quality indicator (Qi_1B) to the second function (B).Method according to one of the preceding claims, in which, in response to a request (A_A, A_B) for the first and / or the second function (A, B) which has an instruction to adapt the decision matrix (9), the decision matrix (9) is adapted with regard to the selection of the quality indicators (Qi) and / or the selection of the first function-specific sensor signal (SEN1A) or of the second function-specific sensor signal (SEN1B), the request (A_A, A_B) being dependent on predefined criteria for a behavior of the first or the second function (A, B) in the event of occurrence in different fault situations.Method according to one of the preceding claims, in which a tolerance (T_1A, T_1B) is determined and provided in each case for the first sensor signal (SEN1) and / or the first function-specific sensor signal (SEN1A) and / or the second function-specific sensor signal (SEN2A), wherein the tolerance (T_1A, T_1B) represents a difference between the first sensor signal (SEN1) and the further first sensor signal (SEN1_red).An apparatus comprising a processor and a program memory and configured to perform the method of any of the preceding claims 1 to 7.Control unit (1), comprising - an apparatus according to claim 10, - a receiving interface (3) which is designed to receive the sensor signals (SEN1, SEN1_red) from predetermined sensor devices and the instructions (A_A) from units which execute the first and / or second function (A, B) and to forward them to the apparatus, - an output interface (7) which is designed to transmit the first sensor signal (SEN1) and the first function-specific sensor signal (SEN1A) and the second function-specific sensor signal SEN1B) and the quality indicators (Q1, Qi_1A, Qi_1B) to the units which execute the first and / or second function (A, B).A computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method of any one of claims 1 to 9.A computer readable storage medium having stored thereon the computer program of claim 12.

Images