In general, a plausibility check is a method within whose scope a value or a result, in general, is checked for whether it is plausible at all, i.e., whether it may be acceptable, evident, and comprehensible. For this purpose, a present obvious inaccuracy, in particular, is to be detected to be able to initiate appropriate countermeasures.
Plausibility checks in the automotive field usually relate to monitoring specific signals of various functional units within the motor vehicle. Such plausibility checks are, in particular, necessary in the case of specific driver input sensors, such as a plausibility check of the two driver input sensors “accelerator pedal” and “brake.” For example, the simultaneous operation of these two pedals may result in a lack of plausibility since an operation of the accelerator pedal and an operation of the brake usually counteract one another and it is thus not possible that they correspond to the driver input and/or to a particular driving situation at the same time. During a plausibility check, other boundary conditions are usually also taken into account to be able to assess the most likely instantaneous driver input in order to thus reverse or cancel an instantaneous accelerator pedal value in favor of a brake request, for example.
A safety function “accelerator pedal brake plausibility check” (ABP) which carries out a plausibility check of the two driver input sensors “accelerator pedal” and “brake” in an engine control unit is known from the related art. In this case, the safety function ABP is only carried out in a so-called “user software” architecture plane (plane 1) and is thus not subject to additional control-unit internal safety measures which are customary for control unit monitoring functions, for example. In the corresponding software architecture of the motor vehicle, there is usually another plane, referred to in the following as plane 2, in which a functional monitoring software is stored and which is configured to be able to check control units even with regard to their calculations and to thus implement a double check, so to speak.
Against the background of the related art, it was now an object of the present invention to provide a plausibility check of a first driver input sensor with regard to a second driver input sensor, in addition to a previously known calculation in a user software (plane 1), from now on also in a functional monitoring software (plane 2) in order to thus be able to eliminate a possible control-unit internal erroneous plausibility check.