Method for operating a vehicle with an x-by-wire device using a fleet watchdog, and vehicle

Abstract

The invention relates to a method for operating a vehicle (10), in which at least one sensor signal is captured, said sensor signal indicating actuation of an actuating element (16, 18) of an X-by-wire device (12, 14) of the vehicle (10) that is carried out by a user of the vehicle (10). At least one target value assigned to the sensor signal is compared with at least one actual value which corresponds to an actual behaviour of at least one component of the vehicle (10). If there is a predetermined deviation of the actual value from the target value, at least one measure is taken. The at least one target value and the at least one actual value are transmitted to a monitoring device (76) which is outside the vehicle, compares the actual value with the target value and, if the deviation is present, causes at least one device (70) inside the vehicle to take the at least one measure. The invention also relates to a vehicle (10).

Description

[0001] Description

[0002] Method for operating a vehicle with X-by-wire device using a fleet watchdog and vehicle

[0003] The invention relates to a method for operating a vehicle, in which at least one sensor signal is detected, which indicates an actuation of an actuating element of an X-by-wire device of the vehicle by a user of the vehicle. At least one target value assigned to the sensor signal is compared with at least one actual value. The at least one actual value corresponds to the actual behavior of at least one component of the vehicle. If a predetermined deviation of the actual value from the target value occurs, at least one measure is taken. Furthermore, the invention relates to a vehicle designed to carry out the method.

[0004] DE 11 2017 005 108 T5 describes a vehicle with a steer-by-wire system in which the wheels on the front and rear axles are steered by electric actuators. A watchdog control unit is provided to detect fault conditions in the actuators or steering control units. If the watchdog control unit detects a fault condition in the steering control unit, the steering control unit is deactivated or switched off. When the steering control unit is switched off, a warning message can be issued to the driver or the vehicle's speed can be reduced.

[0005] Furthermore, DE 11 2017 004 195 T5 describes a watchdog control unit for an electric vehicle that compares an observed dynamic vehicle response with an expected range of dynamic vehicle responses. If a deviation exceeds a threshold value, a functionality of the electric vehicle is restricted.

[0006] Mechanical braking systems and mechanical steering systems are common in today's vehicles. In the mechanical braking system, a purely mechanical coupling exists between a brake pedal and a mechanotronic brake pressure actuator. This means that if the mechanics or electronics of the brake pressure actuator fail or fail, the driver must apply the brake pressure without electronic assistance, i.e., purely mechanically through their foot force. This allows high braking force to be achieved even if the brake pressure actuator fails.

[0007] The same applies to the mechanical steering system. Even in such a mechanical steering system, there is a purely mechanical coupling between the steering mechanism, such as a steering wheel, and a mechanotronic steering actuator, which is usually located on the front axle of the vehicle. This means that in the event of a failure or malfunction of the mechanics or electronics of the steering actuator, the driver must apply the required steering forces solely using the strength of their arms.

[0008] In vehicle development, there are approaches to eliminating these mechanical fallback systems in the steering or braking systems. When a braking system no longer has a mechanical connection between an actuating element, such as a brake pedal, and the vehicle's brake, such a mechanically decoupled braking system is referred to as a brake-by-wire braking system.

[0009] In an analogous manner, a steering system in which there is no longer a mechanical connection between a steering handle such as a steering wheel and the steering actuator that executes the steering command is referred to as a steer-by-wire device or steer-by-wire system (steer-by-wire = steering by cable).

[0010] Such mechanically decoupled systems or devices can therefore generally be referred to as X-by-wire devices or X-by-wire systems. In this context, the X-by-wire device of the vehicle is understood to mean, in particular, a steer-by-wire device and / or a brake-by-wire device of the vehicle.

[0011] Such steer-by-wire and / or brake-by-wire systems can be used particularly in vehicles designed for fully automatic or autonomous driving. However, even in conventional vehicles not designed for autonomous ferry operation, improvements in safety, comfort, and personalization can be achieved through the use of steer-by-wire and / or brake-by-wire systems. Due to the elimination of a mechanical fallback level in by-wire steering and by-wire braking systems, challenges arise with regard to the reliability of such x-by-wire systems.

[0012] For greater reliability, an interface between an electronic brake pedal and a brake pressure actuator of a brake-by-wire system can comprise a first data bus and a second, redundant data bus. This can be provided analogously for an interface between an electronic steering wheel and a steering actuator of a steer-by-wire system. However, other concepts are also possible to provide a fallback level in the event of a fault occurring in a by-wire steering system or by-wire braking system.

[0013] In particular, when so-called common cause failures (i.e., errors or failures attributable to a common cause) or cascading failures occur, the additional fallback level may not be available. For example, it may occur that both a main path and a redundant path fail simultaneously due to a common cause of failure or due to a coupling mechanism.

[0014] Common cause failures or cascading failures can occur due to the installation of similar hardware or software components in multiple control units of the X-by-Wire system. If a specific fault cause is present in this hardware or software component, a failure can occur simultaneously in all affected control units. Furthermore, error chains based on a single fault cause can lead to multiple control units failing one after the other in quick succession.

[0015] Accordingly, it is desirable for faults in a vehicle's X-by-wire system to be detected at an early stage so that any necessary measures or countermeasures can be initiated in a timely manner.

[0016] The object of the present invention is to provide a method of the type mentioned at the outset which brings about increased operational safety, and to create a vehicle designed to carry out the method.

[0017] This object is achieved by a method having the features of patent claim 1 and by a vehicle having the features of patent claim 10. Advantageous embodiments with expedient further developments of the invention are described in the dependent

[0018] patent claims and in the following description.

[0019] In the method according to the invention for operating a vehicle, at least one sensor signal is detected, wherein the sensor signal indicates an actuation of an actuating element of an X-by-wire device of the vehicle by a user of the vehicle. At least one target value assigned to the sensor signal is compared with at least one actual value. The at least one actual value corresponds to an actual behavior of the vehicle or at least one component of the vehicle. If a predetermined deviation of the actual value from the target value occurs, at least one measure is taken. In the method, the at least one target value and the at least one actual value are transmitted to a vehicle-external monitoring device, which compares the actual value with the target value.If the deviation occurs, the vehicle-external monitoring device causes at least one vehicle-internal device to take at least one measure.

[0020] Advantageously, the vehicle-external monitoring device provides an independent control instance that is not affected by the fault even if the X-by-wire device in the vehicle is faulty. Consequently, the provision or introduction of the vehicle-external monitoring device results in increased operational reliability. The presence of the predetermined deviation of the actual value from the target value can be determined by the vehicle-external monitoring device, which then prompts the at least one vehicle-internal device to take the at least one measure.

[0021] The vehicle-external monitoring device, i.e., one located separate from and outside the vehicle, which is preferably configured for wireless communication with the vehicle, also makes it possible to monitor a plurality of vehicles or a vehicle fleet for any deviations of the respective actual value from the respective target value. This is advantageous in that it allows clusters of undesirable deviations to be detected early on. Accordingly, appropriate measures can be initiated early on, for example, measures that can be implemented directly in the vehicle using the in-vehicle device and / or maintenance or repair measures.In such an application, in which a plurality of vehicles or the vehicle fleet is monitored with regard to deviations of the respective actual value from the respective target value, the vehicle-external monitoring device can be referred to as a fleet watchdog.

[0022] The corresponding advantages apply both when the at least one X-by-wire device of the vehicle is designed, for example, as a steer-by-wire device, and when the X-by-wire device is designed, for example, as a brake-by-wire device. Furthermore, the vehicle can have both the steer-by-wire device and the brake-by-wire device.

[0023] If the vehicle's X-by-wire system is designed as a by-wire steering system or steer-by-wire system, the actuating element actuated by the user can be a steering handle, for example in the form of a steering wheel. Accordingly, the at least one sensor signal can indicate, for example, an actuating force applied to the steering wheel and / or a rotation of the steering wheel by a respective angle of rotation. A behavior of the entire vehicle corresponding to this actuation of the steering wheel and / or a behavior of at least the vehicle component corresponding to the actuation of the steering wheel can be assigned as a target value to such sensor signals.

[0024] The actual behavior of the entire vehicle can be described by, or detected via, driving dynamics data such as a yaw rate and / or a longitudinal acceleration and / or a lateral acceleration and / or a longitudinal speed and / or a lateral speed of the vehicle, or the like. The target values ​​associated with the at least one sensor signal, which relate to the actual behavior of the entire vehicle, can accordingly be expected values ​​of the driving dynamics variables mentioned above as examples, depending on the sensor signal.

[0025] The actual behavior of at least the component of the vehicle can be, for example, the behavior of a steering actuator designed to steer the vehicle's steerable wheels. A steering angle to be set by the steering actuator can therefore be considered a target value assigned to the sensor signal. This is because the actuating force applied to the steering wheel and / or the rotation of the steering wheel corresponds to a target value of the steering angle by which the steerable wheels are to be pivoted by the steering actuator. These statements apply analogously to the target values ​​and actual values ​​if the vehicle's X-by-Wire system is designed as a brake-by-wire system.Then, the actuating element that can be actuated by the user of the vehicle can be, for example, an electronic brake pedal, wherein the at least one sensor signal can comprise an actuating force applied to the electronic brake pedal and / or a distance traveled by the brake pedal.

[0026] Such sensor signals relating to the brake-by-wire device can also be assigned target values ​​for the dynamic driving behavior of the entire vehicle and / or target values ​​of a brake actuator or similar braking device that brakes the vehicle. For example, an actuating force applied to the electronic brake pedal and / or a pedal travel when changing a brake pedal position can correspond to an expected brake pressure at the brake actuator of the brake-by-wire device as a target value. The actual value of at least the component of the vehicle can therefore be, for example, the actual behavior of the brake actuator, which is designed to brake the vehicle.

[0027] By comparing such target values ​​with such actual values, where the actual values ​​correspond to the actual behavior of the vehicle or at least of the vehicle component, it can be determined whether there is a deviation of the actual value from the target value and whether this deviation exceeds a predetermined or permissible deviation. If the latter is the case, the vehicle-external monitoring device can cause the at least one vehicle-internal device to take the at least one measure.

[0028] Various measures can be taken to respond to the deviation of the actual value from the target value. For example, a first measure may be to simply inform the vehicle user that there is a problem with the X-by-Wire device. For this purpose, a corresponding vehicle communication device, such as a display or indicator, can be used as an internal device.

[0029] Furthermore, the vehicle user can be warned that there is a problem with the X-by-Wire system. Accordingly, the information can be provided with an additional warning notice, which makes the vehicle user more aware of the problem of the impaired functionality of the X-by-Wire system than a mere information notice. This emphatic warning or information can be implemented, for example, by flashing a corresponding warning message and / or by emitting an additional warning tone or similar.

[0030] Additionally or alternatively, the vehicle user may be advised to visit a workshop, or the user may be informed that such a workshop visit is necessary, as otherwise the vehicle's continued use will be restricted, at least in the near future. Such warnings or recommendations can be issued to the user by the vehicle's internal device, for example, via the vehicle's communication system.

[0031] A further measure could be to allow the vehicle to continue driving at a speed limited to a certain maximum speed and / or for a certain limited time and / or for a certain limited distance. This could include automatically and forcibly bringing the vehicle to a standstill after the time limit has expired and / or after the distance has been covered. This could be achieved by a corresponding speed-limiting device on the vehicle and / or a device on the vehicle that limits the remaining time and / or the remaining distance.

[0032] Another measure that could be considered is bringing the vehicle to a standstill immediately and automatically. This forced standstill can be achieved, for example, by means of the vehicle's braking system.

[0033] The measures of increasing severity mentioned above as examples can be taken, in particular, depending on the magnitude of the deviations between the actual value and the target value. Additionally or alternatively, if a fault or problem with the X-by-wire device persists, it is possible to take the measures of increasing severity in a cascading manner, i.e., one after the other.

[0034] When determining the at least one measure to be taken, the vehicle-external monitoring device preferably takes into account the magnitude of the deviation of the at least one actual value from the at least one target value. For example, it can be provided that different measures are available with regard to influencing a driving state of the vehicle and / or that the at least one measure comprises informing and / or warning the user of the vehicle, in particular a driver of the vehicle. By taking into account the magnitude of the deviation of the actual value from the target value when determining the measure to be taken, the severity of a fault in the X-by-wire device can be taken into account very well, in particular in a well-graded manner.

[0035] The vehicle-external monitoring device preferably compares the respective target values ​​and actual values ​​of a plurality of vehicles with each other. This makes it very easy to determine whether errors are occurring in the respective X-by-wire devices of vehicles belonging to a vehicle fleet. This can be used, on the one hand, to initiate at least one measure specifically for the affected vehicles. Additionally or alternatively, such information can be used, for example, to take measures within the framework of quality assurance, which can in particular be located at a manufacturer of the respective vehicle, to help prevent the identified errors from occurring in the future. This is also advantageous with regard to increasing the operational reliability of the affected vehicle.

[0036] When determining the at least one measure to be taken, the vehicle-external monitoring device preferably takes into account the result of a comparison of the respective target values ​​and actual values ​​of the vehicles. This allows the affected vehicle to react very effectively and appropriately to any deviations between the target values ​​and the actual values.

[0037] Preferably, the vehicle-external monitoring device performs an evaluation based on the target values ​​and actual values ​​received from the vehicles, taking into account a number of deviations of the respective actual value from the respective target value. This is helpful for identifying weak points in the respective X-by-wire systems of the vehicles in the fleet. For example, if a design range of the by-wire steering and / or the by-wire braking system is exceeded in a large number of vehicles in the fleet, this can be interpreted as an indication that improvements to the X-by-wire system are advisable.

[0038] Preferably, the number of deviations is taken into account when determining the at least one measure to be taken. This allows for a very effective response to any accumulation of errors, which would result in a correspondingly large number of deviations. Additionally or alternatively, the deviations can be assigned to a respective error type during the evaluation performed by the vehicle-external monitoring device based on the target and actual values ​​received from the vehicles. In this way, specific error types can be easily and effectively identified, allowing targeted remedial action to be taken.

[0039] Preferably, the fault type is taken into account when determining the at least one measure to be taken. This allows the measure to be tailored very precisely to the respective fault type. This contributes to increasing the operational safety of the vehicle.

[0040] Preferably, the vehicle-external monitoring device performs an evaluation based on the target values ​​and actual values ​​received from the vehicles with regard to the occurrence of deviations in time and / or location and / or related to the operation of the respective vehicle. The evaluation with regard to the temporal occurrence of deviations is advantageous in order to be able to determine whether, for example, wear and tear caused by time can be identified as the cause of malfunctions in the X-by-wire devices.

[0041] The evaluation with regard to the local occurrence can provide information about whether local conditions, such as driving the vehicle in a warmer or cooler region and / or in a more humid or more dry region and / or in more flat or more mountainous terrain or the like, and / or other environmental conditions such as the condition of the respective roads, could be considered as reasons for the occurrence of the deviations.

[0042] For example, if it turns out that deviations occur more frequently in unfavorable road conditions, such as due to the presence of potholes or the like, than in good road conditions, this can be used as an indication to improve, for example, the vibration resistance of the X-by-wire system. Accordingly, the measure to be taken may include improving the vibration resistance.

[0043] By evaluating the occurrence of deviations related to the ferry operation of the respective vehicle, it can be determined, for example, whether the driver's driving style and / or operation of the X-by-wire device, such as a high and sudden application of electrical current to components of the device or the like, leads to increased stress on the X-by-wire device. Such increased stresses can then be identified as the reason for the occurrence of the deviations. This is also advantageous for implementing a more robust design of the X-by-wire device if necessary. Accordingly, the action to be taken can include a more robust design.

[0044] Preferably, a result of the evaluation is taken into account when determining the at least one measure to be taken. The measure may, in particular, consist of a design of the X-by-wire device that takes the evaluation into account.

[0045] Furthermore, the temporal and / or spatial and / or vehicle-operation-related occurrence of the deviations can advantageously be taken into account when selecting the at least one measure to be implemented by the at least one in-vehicle device. This is advantageous.

[0046] Additionally or alternatively, the vehicle-external monitoring device can perform an evaluation based on the target values ​​and actual values ​​received from the vehicles with regard to a temporal and / or spatial and / or vehicle-related frequency of deviations. By taking into account the frequency of occurrence of the deviations, a decision can be made, for example, as to whether it is advisable to instruct the at least one vehicle-internal device to take at least one measure.

[0047] In this regard, it is also advantageous to consider the results of the evaluation when determining at least one action to be taken. If deviations occur frequently in a number of vehicles, this can be used as an indication for maintenance or repair of the X-by-wire system. Additionally or alternatively, it is possible and advantageous to make the type of action to be taken dependent on whether the deviations occur frequently or rarely.

[0048] Preferably, the vehicle-external monitoring device sends a status request to at least one control unit of the X-by-wire device. If there is no response to the status request after a first period of time, the vehicle-external monitoring device prompts the at least one vehicle-internal device to take a first measure. This allows a very timely response if the control unit of the X-by-wire device at least temporarily does not send a response to the status request. Furthermore, this allows preparation to be made in order to be better equipped for a further or second measure to be taken. In particular, this ensures that the second measure can take effect very quickly. This is advantageous.

[0049] Preferably, the vehicle remains readily controllable by the user or driver while the first action is being taken. This ensures that even in the event of a false activation, for example, when taking the first action would not have been necessary in the first place, taking the first action does not result in an undesirable impairment of the vehicle's driving condition for the user or driver.

[0050] Additionally or alternatively, an in-vehicle monitoring device can send a status request to at least one control unit of the X-by-wire device. If no response to the status request is received after a first period of time, the in-vehicle monitoring device causes the at least one in-vehicle device to take a first action. The in-vehicle monitoring device can also be referred to as the vehicle's watchdog.

[0051] Such an in-vehicle monitoring device can preferably be operated independently of the at least one control unit of the X-by-wire device, for example, by providing a separate power supply. Furthermore, by designing the in-vehicle monitoring device independently of the at least one control unit of the X-by-wire device, it can be ensured that a problem occurring in the at least one control unit of the X-by-wire device does not simultaneously affect the in-vehicle monitoring device. This allows the in-vehicle monitoring device to effectively fulfill its function of monitoring the X-by-wire device.

[0052] Additionally or alternatively, it can be provided that the vehicle-external monitoring device and / or the vehicle-internal monitoring device checks whether the at least one control unit sends a status message to the monitoring device at predetermined time intervals, in particular periodically, without a status request preceding this sending of the status message. Accordingly, if the status message is not received after the expiration of the first time period, the at least one vehicle-internal device can be prompted by the vehicle-external monitoring device and / or the vehicle-internal monitoring device to take the first measure. This is also advantageous for monitoring the functionality of the X-by-Wire device.

[0053] If, for example, it is provided that the at least one control unit sends a status message to the vehicle-external monitoring device and / or to the vehicle-internal monitoring device every 50 milliseconds, the vehicle-internal device can be prompted to take the first measure, for example, after 60 milliseconds have elapsed.

[0054] Such an in-vehicle monitoring device can also be used in a method in which no transmission of the at least one target value and the at least one actual value to the external monitoring device is provided. Accordingly, in such a method, instead of the external monitoring device, the in-vehicle monitoring device can compare the at least one actual value with the at least one target value and, if the predetermined deviation is present, cause the at least one in-vehicle device to take the at least one measure.

[0055] The advantages and preferred embodiments described for the vehicle-external monitoring device therefore apply analogously to the vehicle-internal monitoring device, particularly in a method in which no vehicle-external monitoring device is used at all, but instead the vehicle-internal monitoring device. However, the vehicle-internal monitoring device can also be present in addition to the vehicle-external monitoring device.

[0056] In one variant of the method, monitoring the vehicle's X-by-wire system can be performed during at least partially automated and / or autonomous driving. The use of the X-by-wire system is particularly advantageous in at least partially automated driving, in which a corresponding vehicle system independently performs functions such as acceleration, braking, lane changing, or the like. This also applies to highly automated, particularly autonomous, driving. Accordingly, it is advantageous here if the functionality of the X-by-wire system is monitored using the vehicle-internal monitoring device and / or the vehicle-external monitoring device.In such a variant of the method, instead of the at least one sensor signal resulting from the actuation of the actuating element of the X-by-wire device, a signal is detected that indicates, for example, a steering request and / or a braking request to be implemented by the X-by-wire device. Accordingly, in this method, a target value associated with this signal is compared with the actual value, and if the actual value deviates from the target value, at least one measure is taken.

[0057] The comparison of the target value with the actual value can be carried out by the vehicle-external monitoring device and / or by the vehicle-internal monitoring device, which, if the deviation occurs, causes the at least one vehicle-internal device to take at least one measure.

[0058] In this way, for example, in an automated ferry operation of the vehicle, in particular in a highly automated ferry operation, a failure or malfunction of at least one component of the X-by-wire device can be detected or identified.

[0059] This is particularly advantageous when environmental and / or operating conditions exist which make failure or malfunction of the component or the X-by-wire device more likely, or when reduced performance of the X-by-wire device could lead to an undesirable driving situation due to the environmental conditions, in particular due to the environmental conditions in the direction of travel in front of the vehicle.

[0060] Preferably, if there is no response to the status request after a second time period following the first time period, the vehicle-external monitoring device and / or the vehicle-internal monitoring device causes the at least one vehicle-internal device to take a second measure.

[0061] Additionally or alternatively, if a status message from the at least one control unit is not received after the expiration of the second time period following the first time period, the vehicle-external monitoring device and / or the vehicle-internal monitoring device can cause the at least one vehicle-internal device to take the second measure. For example, the second measure can be prepared by taking the first measure, and the second measure is then taken. If the status message from the at least one control unit to the vehicle-external monitoring device and / or to the vehicle-internal monitoring device is expected every 50 milliseconds, a preparatory first measure can be taken, for example, after 60 milliseconds have elapsed, and the second measure after 70 milliseconds have elapsed.

[0062] If the second action involves braking or slowing down the vehicle's movement, particularly during an emergency braking maneuver, the first action may involve preparing for or initiating braking. For example, braking may be initiated after a period of 60 milliseconds and carried out after a period of 70 milliseconds if the status message expected every 50 milliseconds is not received.

[0063] By taking such gradual, successive measures, it can be reliably ensured that a problem or malfunction in the vehicle's X-by-Wire system is responded to in a timely and appropriate manner.

[0064] This applies in particular if the second measure influences the vehicle's driving state more than the first measure. In particular, the first measure may not yet influence the vehicle's driving state or may influence it virtually not at all, for example, because the first measure merely provides information or a warning to the user or driver of the vehicle or is issued to the user or driver by the vehicle's internal device.

[0065] However, even if the first action, for example, involves initiating braking without the vehicle actually slowing down, the second action, such as actual braking, can be implemented very quickly. This is because the preparation or initiation of the actual braking process as the first action leads to a very direct and immediate deceleration of the vehicle.

[0066] If the response from at least one control unit to the status request remains elusive even after the second time period has elapsed, the second measure can be implemented, for example, to decelerate the vehicle, in particular to bring it to a standstill. Such an emergency response is particularly advantageous for quickly transferring the vehicle to a particularly safe driving state, for example, by bringing the vehicle to a standstill.

[0067] Preparing for deceleration or braking of the vehicle, or initiating partial braking, can, in particular, involve reducing the existing air gap between the brake pads and a brake disc of at least one brakeable wheel of the vehicle, without any braking effect being present at all, or at most a very slight one. However, such preparation for braking allows the subsequent braking to be carried out very quickly because the brake pads are already very close to the brake disc due to the preparation for braking. This is advantageous.

[0068] If the braking device is designed as a vehicle parking brake, particularly an electronic parking brake, which has a spindle drive, initial rotations of the spindle can be made during preparatory braking without any actual braking effect occurring. However, these rotations already reduce the air gap.

[0069] If the vehicle's braking system is additionally or alternatively configured as a hydraulic brake, the air gap can be reduced by introducing brake fluid into, for example, a brake caliper of the braking system. Depending on the design of the vehicle's braking system, however, other preparatory measures for initiating braking are also possible, apart from those exemplified here.

[0070] Preferably, if communication with the vehicle-external monitoring device fails, an in-vehicle monitoring device compares the actual value with the target value. The in-vehicle monitoring device then prompts the at least one in-vehicle device to take the at least one measure. Accordingly, the in-vehicle monitoring device can be used, in particular, as a fallback if communication with the vehicle-external monitoring device fails.

[0071] Such a situation can occur, for example, if communication with the external or vehicle-external monitoring device is not possible due to a missing or insufficiently stable communication connection. Furthermore, communication with the vehicle-external monitoring device may fail if the vehicle-external monitoring device fails or is impaired for another reason. Especially in such situations, it is advantageous to be able to rely on the vehicle's internal monitoring device, i.e., the vehicle's watchdog.

[0072] The vehicle according to the invention is designed to detect at least one sensor signal, wherein the sensor signal indicates an actuation of an actuating element of an X-by-wire device of the vehicle by a user of the vehicle. The vehicle is designed to assign a target value to the sensor signal and to detect at least one actual value that corresponds to the actual behavior of at least one component of the vehicle. The vehicle has a transmission device by means of which the at least one target value and the at least one actual value can be transmitted to a monitoring device external to the vehicle. The monitoring device external to the vehicle is designed to compare the actual value with the target value and, if a predetermined deviation of the actual value from the target value is present, to output an instruction to a receiving device of the vehicle.The vehicle is further configured to cause at least one in-vehicle device to take at least one action based on the instruction.

[0073] Accordingly, the vehicle is designed to carry out the method according to the invention, whereby the vehicle provides increased operational safety.

[0074] The advantages and preferred embodiments described for the method according to the invention also apply to the vehicle according to the invention and vice versa.

[0075] The invention therefore also includes further developments of the vehicle according to the invention that have features already described in connection with the further developments of the method according to the invention. For this reason, the corresponding further developments of the vehicle according to the invention are not described again here.

[0076] For applications or application situations that may arise with the method and that are not explicitly described here, it can be provided that, according to the method, an error message and / or a request for user feedback is issued and / or a default setting and / or a predetermined initial state is set. The invention also encompasses combinations of the features of the described embodiments.

[0077] Exemplary embodiments of the invention are described below. Shown are:

[0078] Fig. 1 shows a highly schematic view of a vehicle which is designed to communicate with a vehicle-external monitoring device or a fleet watchdog, wherein the vehicle has a steer-by-wire device and a brake-by-wire device;

[0079] Fig. 2 schematically shows a plurality of vehicles according to Fig. 1, which communicate with the vehicle-external monitoring device;

[0080] Fig. 3 schematically shows a method sequence in which an in-vehicle monitoring device or a watchdog of the vehicle is used to monitor the X-by-wire devices of the vehicle; and

[0081] Fig. 4 schematically shows a process flow in which the vehicle-external monitoring device monitors the X-by-wire devices of a plurality of vehicles.

[0082] The exemplary embodiments explained below are preferred exemplary embodiments of the invention. In the exemplary embodiments, the described components each represent individual, independently considered features of the invention, which also further develop the invention independently of one another and are thus also to be considered as components of the invention, either individually or in a combination other than that shown. Furthermore, the described exemplary embodiments can also be supplemented by further features of the invention already described.

[0083] In the figures, functionally identical elements are provided with the same reference numerals.

[0084] Fig. 1 shows a highly schematic representation of a vehicle 10, embodied, for example, as a motor vehicle, which has at least one X-by-wire device. For example, the vehicle can have a steer-by-wire device 12 and / or a brake-by-wire device 14 as the at least one X-by-wire device. The steer-by-wire device 12 can have a steering wheel 16 or similar steering handle as an actuating element, which a user of the vehicle 10, in particular the driver of the vehicle 10, can actuate. In the brake-by-wire device 14, the actuating element, which can be actuated by the user or driver of the vehicle 10, can be designed, for example, as a brake pedal 18.

[0085] However, in the steer-by-wire device 12, there is no mechanical connection from the steering wheel 16 to a steering actuator 20 of the vehicle 10. By means of the steering actuator 20, a steering angle of steerable wheels 22 of the vehicle 10 can be adjusted.

[0086] Analogously, in the brake-by-wire device 14 there is no mechanical connection from the brake pedal 18 to a braking device 24 or similar brake actuator of the vehicle 10. The braking device 24 is designed here to brake the wheels 22 of the vehicle 10, wherein for reasons of clarity the braking device 24 is only shown in the area of ​​the front wheels of the vehicle 10.

[0087] Instead of the mechanical coupling of the steering wheel 16 to the steering actuator 20 and the mechanical coupling of the brake pedal 18 to the braking device 24, a control unit 26 is provided in the respective X-by-wire device, which electronically transmits the driver's command to the steering actuator 20 or to the braking device 24 when the driver actuates the steering wheel 16 or the brake pedal 18. For reasons of clarity, only a single such control unit 26 is shown in Fig. 1, although not only the respective X-by-wire device can have a plurality of such control units 26. Rather, the respective X-by-wire device can have or comprise a respective control unit 26, for example, the steer-by-wire device 12 can have at least a first such control unit 26 and the brake-by-wire device 14 can have at least a second such control unit 26.

[0088] According to Fig. 1, the vehicle 10 has a control entity in the form of an in-vehicle monitoring device 28, which is designed independently of the steer-by-wire device 12 and the brake-by-wire device 14 and can also be referred to as a vehicle watchdog. This in-vehicle monitoring device 28 or control entity is installed within the vehicle 10 and monitors a desired function and an actual function of the steer-by-wire device 12 and the brake-by-wire device 14. If a design range of the steer-by-wire device 12 or the brake-by-wire device 14 is left, then a driving function of the vehicle 10 can be

[0089] be downgraded or prevented at the request of the vehicle watchdog.

[0090] This can be provided, for example, if the vehicle 10 no longer follows a driver steering command, which the driver expresses by operating the steering wheel 16. The same applies if the vehicle 10 no longer follows a driver braking command, which the driver expresses by operating the brake pedal 18. Such a departure from the design range can be determined by comparing target values ​​30 or target data (see Fig. 3) with actual values ​​32 or actual data (see Fig. 3).

[0091] The target values ​​30 correspond to sensor signals of the (in this case electronic) steering wheel 16 and to sensor signals of the (in this case electronic) brake pedal 18. For example, a sensor of the steering wheel 16 can detect an actuating force 34 (see Fig. 3) that the driver of the vehicle 10 applies to the steering wheel 16. Additionally or alternatively, the sensor of the steering wheel 16 can detect an angle 36 (see Fig. 3) by which the steering wheel 16 is turned by the driver from an initial position of the steering wheel 16.

[0092] The same applies to the target values ​​30, which describe the target behavior of the vehicle 10 with respect to the brake pedal 18. Thus, at least one sensor of the brake pedal 18 can detect an actuation force 38 (see Fig. 3) applied to the brake pedal 18 by the driver of the vehicle 10. Additionally or alternatively, the at least one sensor can detect, as a sensor signal, a distance 40 (see Fig. 3) traveled by the brake pedal 18 or by which the brake pedal 18 is pivoted when the driver of the vehicle 10 actuates the brake pedal 18.

[0093] The target values ​​30 corresponding to such sensor signals (see Fig. 3) can be compared by the in-vehicle monitoring device 28 with actual values ​​32, which correspond to the actual behavior of the vehicle 10 and / or to the behavior of at least one component of the vehicle 10. For example, driving dynamics data 42 (see Fig. 3) come into consideration as such actual values ​​32, for example in the form of a yaw rate 44 of the vehicle 10 and / or a longitudinal acceleration 46 of the vehicle 10 and / or a lateral acceleration 48 of the vehicle 10 and / or a longitudinal speed 50 of the vehicle 10 and / or a lateral speed 52 of the vehicle 10. Further or different actual values ​​32 than those mentioned here as examples can also be used, which, as driving dynamics data 42, correspond to the actual behavior of the vehicle 10.

[0094] Furthermore, according to Fig. 3, sensor-detectable data from actuators 54 of the steer-by-wire device 12 or the brake-by-wire device 14 can be used as actual values ​​32. For example, these sensor-detectable actual values ​​32 can be a brake pressure 56 applied by the braking device 24 or an axle steering angle 58 adjusted by the steering actuator 20.

[0095] The vehicle watchdog or the in-vehicle monitoring device 28 can determine a deviation of the at least one actual value 32 from the at least one target value 30 by forming a difference 60 (see Fig. 3). This deviation can be compared with a threshold value 62 to determine whether a predetermined deviation exists or whether the existing deviation is greater than the predetermined threshold value 62.

[0096] If the comparison of the deviation with the threshold value 62 reveals that the predetermined deviation of the at least one actual value 32 from the at least one target value 30 exists, then, according to Fig. 3, at least one measure to be taken can be selected from a measure block 64. For example, the at least one measure can comprise informing 66 the driver of the vehicle 10 or warning 68 the driver of the vehicle 10. For the informing 66 and / or warning 68, an in-vehicle device 70 (see Fig. 1) can be used, which can be designed, for example, as a display device or display of the vehicle 10.

[0097] A further measure can be embodied as a limitation 72 (see Fig. 3) of the onward travel of the vehicle 10. For example, the limitation 72 of the onward travel of the vehicle 10 can consist in only permitting the vehicle 10 to continue traveling at a reduced speed, for example when the vehicle 10 is traveling on a highway at a speed of no more than 130 km / h. Additionally or alternatively, the limitation 72 can consist in the vehicle only being able to be driven for a certain limited time, for example 40 minutes, and / or only on a limited route, for example a route of 25 kilometers. In this case, after this time limit and / or route limit has expired, the vehicle 10 can be automatically and forcibly brought to a standstill.This limiting 72 of the driving speed of the vehicle 10 and / or the limiting 72 of the driving time and / or the driving distance can also be carried out by the at least one in-vehicle device 70 of the vehicle 10, which for this reason is shown only in a highly schematic manner in Fig. 1.

[0098] A further measure to be taken may include an immediate stop 74 (see Fig. 3) of the vehicle 10. Accordingly, the vehicle 10 is immediately brought to a standstill automatically and forcibly. The stop measure 74 can also be initiated by the in-vehicle device 70, for example, by the device 70 activating the braking device 24.

[0099] In particular, when taking measures in the form of informing 66, warning 68 and limiting 72, the driver of the vehicle 10 may be recommended to visit a workshop or be required to do so.

[0100] Whether informing 66, warning 68, limiting 72, or stopping 74 is selected as the measure can depend on the specific fault pattern in the vehicle 10. This fault pattern can be described, for example, by the magnitude of the deviation between the target values ​​30 and the actual values ​​32. In particular, if the deviation of the at least one actual value 32 from the at least one target value 30 is greater, a measure that has a greater influence on the driving state of the vehicle 10 can be selected, such as limiting 72 or even stopping 74. In contrast, if the deviation of the at least one actual value 32 from the at least one target value 30 is smaller, informing 66 or warning 68 may be sufficient.

[0101] Additionally or alternatively, it is possible to implement the measures mentioned above in a cascading manner, for example, first informing 66, then warning 68, then limiting 72, and finally stopping 74, although not all of these measures need to actually be provided. To implement measures in a cascading manner, it is generally sufficient to first implement a first measure and then a second measure.

[0102] In the situation shown in Fig. 1, an external monitoring device 76 is present, which is an external control instance located outside the vehicle 10. This external monitoring device 76 can, for example, be located on a server 78, which is shown highly schematically in Fig. 1. The vehicle 10 is configured to communicate with the external monitoring device 76. For this purpose, the vehicle 10 has a transmission device 80, by means of which the target values ​​30 and the actual values ​​32 can be transmitted to the external monitoring device 76.

[0103] According to Fig. 2, such transmission to the vehicle-external monitoring device 76 can also be carried out by a plurality of vehicles 10, 82, wherein in addition to the vehicle 10 according to Fig. 1, only one further vehicle 82 is shown in Fig. 2. In this case, the at least one further vehicle 82 can be constructed correspondingly or similarly to the vehicle 10 described with reference to Fig. 1 with regard to its functionalities. At least in the present case, the further vehicle 82 shown as an example in Fig. 2 also has the transmission device 80 and the at least one X-by-wire device. By way of example, the (electronic) steering wheel 16 and the (electronic) brake pedal 18 of the associated X-by-wire device are therefore shown schematically in the further vehicle 82 in Fig. 2.

[0104] Since the respective target values ​​30 and actual values ​​32 of a plurality of vehicles 10, 82 can be transmitted to the vehicle-external monitoring device 76, the vehicle-external monitoring device 76 can also be referred to as a fleet watchdog.

[0105] According to Fig. 4, when the vehicle-external monitoring device 76 is deployed or used, the target values ​​30 and the actual values ​​32 can be determined as explained with reference to Fig. 1 and Fig. 3 for the vehicle watchdog and the vehicle-internal monitoring device 28, respectively. These target values ​​30 and actual values ​​32 can be referred to as vehicle fleet data 84 when the fleet watchdog is used (see Fig. 4).

[0106] According to Fig. 2, errors of the steer-by-wire device 12 of the respective vehicle 10, 82 and / or the brake-by-wire device 14 of the respective vehicle 10, 82 can be reported to the vehicle-external monitoring device 76.

[0107] As described for the operation of the vehicle watchdog, when using the vehicle-external monitoring device 76, the measures from a corresponding action block 64 shown in Fig. 4 can be applied, as already explained with reference to Fig. 1 and Fig. 3. Accordingly, the vehicle-external monitoring device 76 can cause the at least one vehicle-internal device 70 (not shown in Fig. 2) of the respective vehicle 10, 82 to take at least one measure if there is a deviation of the actual value 32 from the target value 30. Here, too, the difference formation 60 can be carried out, wherein according to Fig. 4, this difference formation 60 is carried out by the vehicle-external monitoring device 76.

[0108] The action block 64 according to Fig. 4 preferably includes the measures of informing 66, warning 68, limiting 72, and stopping 74, as already explained with reference to Fig. 3. At least one of these measures can be taken in particular when a design range of the respective steer-by-wire device 12 and / or brake-by-wire device 14 is exceeded for a corresponding number of vehicles 10, 82 or fleet vehicles. Additionally or alternatively, at least one of these measures can be taken when certain errors occur frequently in the steer-by-wire device 12 and / or the brake-by-wire device 14 of the respective vehicle 10, 82.

[0109] When the vehicle-external monitoring device 76 or the fleet watchdog is used, contrary to the explanations made with reference to Fig. 1 and Fig. 3, the implementation of the respective measure can be determined not only for each individual vehicle 10, 82 by performing a threshold value comparison 86 (see Fig. 4). Rather, an evaluation of the vehicle fleet data 84 advantageously offers the additional possibility of determining fault patterns in the entire vehicle fleet.

[0110] Such error patterns can, for example, include a clustering or frequency 88 of certain errors or anomalies in the X-by-wire devices of the vehicles 10, 82. Additionally or alternatively, a severity 90 of the respective error can be determined by evaluating the vehicle fleet data 84 using the vehicle-external monitoring device 76. The severity 90 of the respective error can be detected, for example, by determining the magnitude of the deviation of the respective actual value 32 from the respective target value 30.

[0111] Additionally or alternatively, it can be determined that certain errors occur frequently with respect to a time 92 or occur at all. An evaluation regarding the temporal occurrence and / or the temporal accumulation of deviations is also advantageous in order to be able to take appropriate measures. Additionally or alternatively, an evaluation regarding a location 94 of the occurrence and / or the location 94 of the accumulation of certain errors can be performed by the vehicle-external monitoring device 76. This is because an evaluation of the vehicle fleet data 84 with regard to the local occurrence and / or the local accumulation is very informative for taking possible measures, in particular in the form of maintenance and / or repair of the respective X-by-Wire device of the respective vehicle 10, 82.

[0112] Additionally or alternatively, the evaluation can be conducted with regard to an occurrence and / or accumulation of deviations related to vehicle operation 96 (see Fig. 4) of the respective vehicle 10, 82. Such an analysis of the operational occurrence and / or operational accumulation of certain errors is also beneficial for initiating appropriate measures or countermeasures.

[0113] For example, this can be used to detect whether errors in the steer-by-wire system 12 and / or the brake-by-wire system 14 occur or occur frequently under certain environmental and / or operating conditions of the respective vehicle 10, 82. Appropriate precautions can then be taken with regard to such environmental and / or operating conditions. Such measures can include, for example, a more robust design of the respective X-by-wire system. In particular, a quality assurance department of a respective manufacturer of the respective vehicle 10, 82 can be informed so that appropriate measures can be initiated.

[0114] The procedure described with reference to Fig. 4 can also provide for a cascading of measures, for example in the form of informing 66, warning 68, limiting 72, and stopping 74. Which of these measures is taken can depend on the specific fault pattern identified in the vehicle fleet by the vehicle-external monitoring device 76. As explained above, the fault pattern can be determined by the frequency 88 and / or the severity 90 and / or the time 92 and / or the location 94 of the occurrence or frequent occurrence.

[0115] In this case, the at least one vehicle 10, 82 has a respective receiving device 98, which is configured to receive an instruction from the vehicle-external monitoring device 76. Based on this instruction, the at least one in-vehicle device 70 of the respective vehicle 10, 82 can then take the at least one measure.

[0116] Both when the vehicle-external monitoring device 76 is present and when the vehicle-internal monitoring device 28 is present instead or in addition, the procedure can be as explained below by way of example.

[0117] First, the watchdog or the vehicle-internal monitoring device 28 and / or the fleet watchdog or the vehicle-external monitoring device 76 monitor the functionality of the at least one X-by-wire device of the vehicle 10, 82.

[0118] For example, for this purpose, the monitoring device 28, 76 can send a status request to the at least one control unit 26 of the X-by-wire device. If the X-by-wire device does not send a response after a first time period has elapsed, the monitoring device 28, 76 can take a first action.

[0119] For example, braking of vehicle 10, 82 can be prepared or initiated. Additionally or alternatively, it is possible to inform or warn the driver of vehicle 10, 82 as a first measure. If there is no response to the status request after the initial time period, two options exist.

[0120] If a response to the status request is received by the monitoring device 28, 76 after the first time period has elapsed, but before the expiration of a second time period following the first time period, it can be concluded that there is no failure of the X-by-wire device. The first action, in the form of the first measure, can then be aborted.

[0121] In this case, it is advantageous if the first measure, with regard to the severity of the intervention or an influence on the driving state of the vehicle 10, 82, is such that neither the measure or action itself, nor the cancellation of the measure or action, impedes control of the vehicle 10, 82 by the driver. This ensures that even in the event of an incorrect triggering in the form of the essentially unnecessary taking of the first measure, a driving situation in the vehicle 10, 82 that may be difficult for the driver to control does not arise. However, if at least one control unit 26 of the respective X-by-wire device of the vehicle 10, 82 does not send a response to the status request even after the second time period has elapsed, this can be interpreted by the monitoring device 28, 76 as an indication that the X-by-wire device of the vehicle 10, 82 is not functional or is faulty.

[0122] The in-vehicle device 70 of the vehicle 10, 82 can then be prompted to take a second action. This is particularly advantageous if the second action has a greater impact on the driving state of the vehicle 10, 82 than the first action. For example, after the second time period has elapsed, the complete stop 74 of the vehicle 10, 82 can be effected as an emergency response or second action.

[0123] If the first measure consists of initiating or preparing for braking of the vehicle 10, 82, the complete stop 74 can be configured as an intensification of the braking effect of the braking device 24. This applies in particular if the preparation for deceleration of the vehicle 10, 82 only leads to an extremely slight slowing of the vehicle 10, 82, which is imperceptible to the driver of the vehicle 10, 82.

[0124] During such preparation for deceleration of the vehicle 10, 82, it can be ensured that brake pads of the braking device 24 just barely contact a brake disc of the braking device 24 without the brake pads exerting any noticeable pressure on the brake disc. However, by reducing the air gap between the brake pads and the brake disc in this way, the subsequent stopping 74 can be achieved particularly quickly. A particularly safe state of the vehicle 10, 82 can therefore be achieved, in particular, through such an emergency reaction in the form of the rapid stopping 74 of the vehicle 10, 82.

[0125] In the present case, a two-stage implementation of the measures has been described by way of example: the implementation of the first measure after the expiration of the first time period and the absence of a response to the status request, and the implementation of the second measure after the expiration of the second time period and the continued absence of a response to the status request. However, it is also possible to provide more than two stages in the implementation of respective measures, whereby a corresponding check is carried out to determine whether, after a plurality of time periods have elapsed, no response to the status request has been received by the monitoring device 28, 76. With reference to the example case of initiating braking, after the unsuccessful expiration of the first time period, for example, the component of the braking device 24 to be pressurized with brake fluid can be prefilled.After the second time period has elapsed, the pressure of the brake fluid or similar hydraulic fluid can be increased. Furthermore, after a third time period has elapsed, the pressure can be increased even further. Finally, after a fourth time period has elapsed and there is still no response from the braking device 24 to the status request, a complete braking or deceleration of the vehicle 10 can be effected.

[0126] The monitoring device 28, 76 can ensure all of these cascading interventions in the form of pre-filling, increasing the pressure and finally braking by issuing a corresponding instruction to the at least one vehicle-internal device 70.

[0127] The aforementioned implementation of successive measures after the expiration of a total of four time periods is to be understood merely as an example with regard to the number of time periods and the nature of the measures. Accordingly, fewer measures or more measures can be implemented in succession after the unsuccessful expiration of a respective time period.

[0128] Overall, the examples show how an improved watchdog can be provided for by-wire steering systems and / or by-wire braking systems.

[0129] List of reference symbols

[0130] 10 vehicles

[0131] 12 Steer-by-wire device

[0132] 14 Brake-by-wire device

[0133] 16 Steering wheel

[0134] 18 Brake pedal

[0135] 20 Steering actuator

[0136] 22 wheels

[0137] 24 Braking device

[0138] 26 Control unit

[0139] 28 Monitoring device

[0140] 30 Setpoint

[0141] 32 Actual value

[0142] 34 Actuating force

[0143] 36 angles

[0144] 38 operating force

[0145] 40 Way

[0146] 42 data

[0147] 44 Yaw rate

[0148] 46 Longitudinal acceleration

[0149] 48 Lateral acceleration

[0150] 50 longitudinal speed

[0151] 52 lateral speed

[0152] 54 Actuator

[0153] 56 Brake pressure

[0154] 58 axle steering angle

[0155] 60 Difference formation

[0156] 62 Threshold

[0157] 64 block of measures

[0158] 66 Information

[0159] 68 Warning

[0160] 70 furnishings

[0161] 72 Limit

[0162] 74 Stop

[0163] 76 Monitoring device

[0164] 78 Server Transmission device Vehicle Fleet data Threshold comparison

[0165] frequency

[0166] Severe

[0167] Time

[0168] Location

[0169] Vehicle operation

[0170] Reception facility

Claims

A method for operating a vehicle (10), in which at least one sensor signal is detected which indicates an actuation of an actuating element (16, 18) of an X-by-wire device (12, 14) of the vehicle (10) carried out by a user of the vehicle (10), in which at least one setpoint value (30) assigned to the sensor signal is compared with at least one actual value (32) which corresponds to an actual behavior of at least one component of the vehicle (10), and in which, in the presence of a predetermined deviation of the actual value (32) from the setpoint value (30), at least one measure (66, 68, 72, 74) is taken, characterized in that the at least one setpoint value (30) and the at least one actual value (32) are transmitted to a vehicle-external monitoring device (76), which carries out the comparison of the actual value (32) with the setpoint value (30),and which, in the presence of the deviation, causes at least one vehicle-internal device (70) to take the at least one measure (66, 68, 72, 74). Method according to claim 1, characterized in that the vehicle-external monitoring device (76) takes into account a magnitude of the deviation of the at least one actual value (32) from the at least one target value (30) when determining the at least one measure (66, 68, 72, 74) to be taken. Method according to one of the preceding claims, characterized in that the vehicle-external monitoring device (76) compares the respective target values ​​(30) and actual values ​​(32) of a plurality of vehicles (10, 82) with one another, wherein the vehicle-external monitoring device (76) takes into account a result of the comparison when determining the at least one measure (66, 68, 72, 74) to be taken. Method according to claim 3, characterized in that the vehicle-external monitoring device (76) carries out an evaluation based on the target values ​​(30) and actual values ​​(32) received from the vehicles (10, 82), in which evaluation a number of deviations of the respective actual value (32) from the respective target value (30) is taken into account and / or the deviations are assigned to a respective error type, wherein the number of deviations and / or the error type is taken into account when determining the at least one measure (66, 68, 72, 74) to be taken.Method according to claim 3 or 4, characterized in that the vehicle-external monitoring device (76) carries out an evaluation with regard to a temporal and / or spatial and / or vehicle operation-related occurrence of deviations of the respective vehicle (10, 82) based on the target values ​​(30) and actual values ​​(32) received from the vehicles (10, 82), wherein a result of the evaluation is taken into account when determining the at least one measure (66, 68, 72, 74) to be taken.Method according to one of claims 3 to 5, characterized in that the vehicle-external monitoring device (76) carries out an evaluation with regard to a temporal and / or spatial and / or vehicle operation-related accumulation of deviations on the basis of the target values ​​(30) and actual values ​​(32) received from the vehicles (10, 82), wherein a result of the evaluation is taken into account when determining the at least one measure (66, 68, 72, 74) to be taken.Method according to one of the preceding claims, characterized in that the vehicle-external monitoring device (76) and / or a vehicle-internal monitoring device (28) sends a status request to at least one control unit (26) of the X-by-wire device (12, 14), and if there is no response to the status request after a first time period has elapsed, causes the at least one vehicle-internal device (70) to take a first measure (66, 68, 72, 74). Method according to claim 7, characterized in that. If there is no response to the status request after a second time period following the first time period, the vehicle-external monitoring device (76) and / or the vehicle-internal monitoring device (28) causes the at least one vehicle-internal device (70) to take a second measure (66, 68, 72, 74), in particular one that influences a driving state of the vehicle (10) more strongly than the first measure (66, 68, 72, 74). Method according to one of the preceding claims, characterized in that if there is no communication with the vehicle-external monitoring device (76), a vehicle-internal monitoring device (28) compares the actual value (32) with the target value (30) and causes the at least one vehicle-internal device (70) to take the at least one measure (66, 68, 72, 74). Vehicle (10) which is designed to detect at least one sensor signal,which indicates an actuation of an actuating element (16, 18) of an X-by-wire device (12, 14) of the vehicle (10) carried out by a user of the vehicle (10), wherein the vehicle (10) is designed to assign a target value (30) to the sensor signal and to detect at least one actual value (32) which corresponds to an actual behavior of at least one component of the vehicle (10), characterized in that the vehicle (10) has a transmission device (80) by means of which the at least one target value (30) and the at least one actual value (32) can be transmitted to a vehicle-external monitoring device (76), which is designed to compare the actual value (32) with the target value (30) and, in the event of a predetermined deviation of the actual value (32) from the target value (30), to output an instruction to a receiving device (98) of the vehicle (10), and wherein the Vehicle (10) is designed tobased on the instruction, to cause at least one in-vehicle device (70) to take at least one action (66, 68, 72, 74).

Images