DE102014212703A1 - M2XPro monitoring by integrity measure storage - Google Patents

Abstract

The invention relates to a method for monitoring a sensor system (42) in a vehicle (1) for acquiring measured data (14) relating to a physical measured variable based on a sensor fusion (2) of first sensor data (8) to a first sensor variable from a first sensor (6) and second sensor data (13) to a second sensor size from a second sensor (10), which are at least partially redundant to the first sensor data (8), comprising:
Fusing (2) the first sensor data (8) and the second sensor data (13) to the measured data (14),
Determining (27) a progression (28) of an integrity measure (26) for the measurement data (14) dependent on a conflict between the first sensor data (8) and the second sensor data (13) via a progression variable (29), and
- storing (32) the course (28) of the integrity measure (26) from an event value (40) for the progress variable (29), from which the integrity measure (26) fulfills a predetermined condition (31).

Description

The invention relates to a method for monitoring a sensor system in a vehicle and to a control device for carrying out the method.

From the WO 2011/098 333 A1 a sensor system for a vehicle is known which uses different sensor sizes in the vehicle in order to improve existing sensor sizes and thus to increase the detectable information.

It is the task to improve the known sensor system.

The object is solved by the features of the independent claims. Preferred developments are the subject of the dependent claims.

• – Fusionieren der ersten Sensordaten und der zweiten Sensordaten zu den Messdaten,
• – Bestimmen eines Verlaufs eines von einem Widerspruch zwischen den ersten Sensordaten und den zweiten Sensordaten abhängigen Integritätsmaßes für die Messdaten über eine Verlaufsvariable, und
• – Speichern des Verlaufs des Integritätsmaßes ab einem Ereigniswert für die Verlaufsvariable, ab dem das Integritätsmaß eine vorbestimmte Bedingung erfüllt.

According to one aspect of the invention, a method for monitoring a sensor system in a vehicle for acquiring measurement data relating to a physical measurement variable based on a sensor fusion of first sensor data to a first sensor variable from a first sensor and second sensor data to a second sensor variable from a second sensor which are at least partially redundant to the first sensor data, the steps:

• Fusing the first sensor data and the second sensor data to the measured data,
• Determining a course of an integrity measure dependent on a conflict between the first sensor data and the second sensor data for the measurement data via a history variable, and
• - Storing the history of the integrity measure from an event value for the history variable, from which the integrity measure meets a predetermined condition.

The specified method is based on the consideration that with the sensor fusion redundancies between the first sensor data and the second sensor data are utilized in order to achieve an information gain in the vehicle. This information gain lies either in a new measured variable relative to the two sensor variables and / or in a measured variable which describes in more detail at least one of the two sensor variables. For this purpose, the sensor data to the two sensor sizes must at least partially overlap in their information content. This means that the sensor data for one sensor size must be able to be derived at least partially from the sensor data to the other sensor size, so that the detection of at least one of the two sensor variables would in principle at least partially not be necessary. For example, a vehicle dynamics sensor compared to a GNSS (global navigation satellite system) is in principle redundant, because at least a part of the vehicle dynamics data from the vehicle dynamics sensor basically also result from the simple or multiple derivative of the captured via the GNSS position data of the vehicle. It is also possible to deduce the speed directly from the GNSS information.

Here the stated method attacks with the idea to use the fusion of the first sensor data and the second sensor data not only to gain information, but also to simplify a control of the sensor system. For this purpose, it is proposed within the scope of the specified method to monitor the consistency of the sensor data of the two sensor sizes relative to each other and thus the degree of integrity of the measured data describing the measured variable, because the sensor data of the two sensor variables are dependent on one another due to their redundancy. A contradiction would be, for example, if the vehicle according to the above position data from the GNSS travels a curve, but according to vehicle dynamics data from the vehicle dynamics sensor no lateral acceleration acts on the vehicle.

The consistency and thus the measure of integrity need not necessarily be a binary quantity (that is, consistent or contradictory). On the contrary, it is possible to graduate the integrity measure arbitrarily between completely inconsistent (for example to 100%) and completely contradictory (for example to 0%). Depending on the fineness of the graduation, the degree of integrity is subject to varying degrees of change, by means of which the sensor system can be monitored or monitored.

In order to carry out the monitoring of the sensor system, it is proposed in the context of the specified method to record the integrity measure via a progression variable such as the time or the route of the vehicle, that is to say store it. As a result, the function of the sensor system can be reconstructed in a simple manner in order to detect faults and their causes, for example for the maintenance of the sensor system. Such errors can be, for example, wear, aging and defects in the sensors. However, errors in the data processing of the sensor data from the two sensors for determining the measured variable descriptive measurement data, such as model assumptions or algorithms used within the sensor system and derived functions and applications would be conceivable and can be detected at least supportive by the recorded integrity measure.

In order to simplify the analysis and / or the control of the sensor system, it is proposed within the specified method to record the integrity measure only under a predetermined condition, which should in principle be selected arbitrarily but expediently such that the integrity measure is recorded only in case of errors, the means, for example, if the two sensor sizes contradict each other to a certain degree.

With the integrity measure recorded in the context of the specified method, it is finally possible to understand how trustworthy the sensor system works and / or whether there are uncertainties in the output of the measured data describing the measured variable. In this connection it can also be investigated whether a condition can be brought about in which the sensor system can work with a maximum degree of integrity, for example of 100% consistency. This examination can be carried out, for example, in the form of a functional test during initial commissioning or during maintenance of the sensor system.

In addition, the sensor system can also be monitored in the active mode in a simple manner. The specified method allows field experience of the sensor system to be collected, such as whether there have been situations in which the sensor system was untrustworthy over the distance traveled as a history variable and / or in a certain time as a history variable, or if it is too critical in the course of these changes Situations came.

Furthermore, the specified method also makes it easier to clarify warranty claims in the event of a fault or it can at least be used as a quick indicator, because it can be checked immediately whether an uncertainty exists and whether the sensor system can be returned to a state by means of a test which it is most trustworthy, and thus, for example, works 100% without contradictions. This also contributes to the above-mentioned simplifications.

Finally, based on the specified method, it is also possible to determine how several sensor systems behave which are linked together to form a higher-order sensor system. Here, weak points can be identified, such as whether in a higher-level sensor system with three independent sensor systems, two sensor systems are maximally trustworthy and one sensor system untrustworthy. In this case, the comparison could once again serve as an input variable in the virtual sensor system in order, for example, to sort out measurement results from untrustworthy sensor systems.

In principle, the progression variable can be chosen arbitrarily. In other words, the integrity measure can be plotted in the case of an error over any physical history. As a history variable, for example, the driving distance of the vehicle would be expedient for space reasons, because here

the integrity measure is stored only when the vehicle is actually moved. Alternatively, the integrity measure could also be plotted over time.

In a development of the specified method, the predetermined condition comprises a limit value, which the integrity measure achieves to fulfill the predetermined condition. In the context of the specified method, the integrity measure can exceed or fall below the limit value for the fulfillment of the predetermined condition, depending on whether the complete consistency is defined at 0% or at 100%.

In another development of the specified method, the saving comprises an overwriting of a previously stored temporal profile of the integrity measure. This overwriting can be performed arbitrarily. In the simplest way, for example, a ring buffer can be used whose data is constantly overwritten in certain write cycles. For example, a ring memory can be used to store a history with a defined length as seen through the history variable. Instead of the ring memory, however, any other, preferably non-volatile memory can be used, which is fully written and, for example, actively emptied after a control.

In yet another refinement, the specified method comprises the step of recording at least one information describing the vehicle state about the same process variable, via which the integrity measure is also stored. The information describing the state of the vehicle can come, for example, from one of the two sensors, which also supply the sensor data for the sensor fusion. Alternatively or additionally, state data derivable from the sensor data, such as, for example, the float angle of the vehicle derivable from the vehicle dynamics data, can also be stored. However, the information describing the vehicle state need not necessarily come from the sensor system to which the specified method is performed, but can also be read from other systems in the vehicle. The value range of the History variable in which the integrity measure is recorded, with the range of values of the history variable in which the information describing the vehicle state information is recorded overlap.

In an additional development, the specified method comprises the step of reading out the information describing the vehicle state from a buffer memory. In particular, the transfer of information between the sensor system and other systems in the vehicle can be simplified or at least supported by the buffer memory.

In a particular development of the specified method, the buffer memory is set up to store the profile of the information describing the vehicle state over a range of values of the progression variable and thus the progression interval that is greater than a value range of the progression variable over which the integrity measure is stored. This means that the buffer memory should not be written until, for example, the limit value for the integrity measure is violated, but already before that. If the predetermined condition is satisfied, then only a part of the available information is read out, but the rest is available as a history for violating the limits of the integrity measure.

In another development, the specified method comprises the step of storing a time information with the course of the integrity measure from a time from when the integrity measure meets the predetermined condition, wherein the time information is dependent on the time. This time information can then be used as a time stamp and helps to correlate the stored time history for the integrity measure and the physical measured variable from the sensor system as well as possibly other information from other systems not originating from the sensor system.

In yet another embodiment, the specified method comprises the step of issuing a warning from the time when the integrity measure meets the predetermined condition. By issuing the warning, the driver is informed of the deteriorated degree of integrity, so that he can, for example, visit a workshop to get to the bottom of the cause of the deteriorated integrity measure. The presentation of the warning can be done arbitrarily, for example by an implicit information (eg warning lamp) or explicit information that just the temporal course of the integrity measure is stored.

According to another aspect of the invention, a control device is arranged to perform a specified method.

In a development of the specified control device, the specified device has a memory and a processor. The specified method is stored in the form of a computer program in the memory and the processor is provided for carrying out the method when the computer program is loaded from the memory into the processor.

According to a further aspect of the invention, a computer program comprises program code means for performing all the steps of one of the specified methods when the computer program is executed on a computer or one of the specified devices.

In accordance with another aspect of the invention, a computer program product includes program code stored on a computer-readable medium and, when executed on a data processing device, performs one of the specified methods.

In accordance with another aspect of the invention, a vehicle includes a specified controller.

The above-described characteristics, features and advantages of this invention, as well as the manner in which they are achieved, will become clearer and more clearly understood in connection with the following description of the embodiments, which will be described in connection with the drawings, wherein:

1 a schematic diagram of a vehicle with a sensor system,

2 a schematic diagram of the sensor system 1 with a fusion sensor, and

3 a course of the function of the sensor system 1 descriptive integrity measure.

In the figures, the same technical elements are provided with the same reference numerals and described only once.

It will open 1 Reference is made to a schematic view of a vehicle 1 with a per se known vehicle dynamics control and a sensor system 42 with a fusion sensor 2 shows. Details of the vehicle dynamics control can, for example, the DE 10 2011 080 789 A1 be removed.

The vehicle 1 includes a chassis 3 and four wheels 4 , Every bike 4 Can be fixed on the chassis 3 fixed brake 5 opposite the chassis 3 slowed down to a movement of the vehicle 1 to slow down on a road, not shown.

It may happen in a manner known to those skilled in the art that the wheels 4 of the vehicle 1 lose their grip and get the vehicle 1 even moved away from a given example by a steering wheel not shown steering trajectory by understeer or oversteer. This is avoided by known control circuits such as ABS (antilock braking system) and ESP (electronic stability program). In such control circuits, measured values describing sensors are recorded. Controllers then compare the measured data with setpoint data for the measured variable and then use the actuators to introduce the measured variable to the setpoint data. In the present embodiment, the measurement data is obtained by a sensor fusion of sensor data in the fusion sensor 2 won.

In the present embodiment, the vehicle 1 as the first sensor a driving dynamics sensor 6 , the sensor data as a change in position of the vehicle 2 in space in the form of vehicle dynamics data 8th outputs. The driving dynamics data 8th For example, it may include a pitch rate, a roll rate, yaw rate, a lateral acceleration, a longitudinal acceleration, and / or a vertical acceleration.

Furthermore, the vehicle includes 1 a second sensor in the form of a receiver 10 for a signal 11 from a GNSS Global Navigation Satellite System, such as GPS or GLONASS via an antenna 12 , The recipient 10 therefore becomes GNSS receiver below 10 , the signal 11 becomes GNSS signal 11 and the antenna 12 becomes GNSS antenna 12 called. The GNSS receiver 10 determined from the GNSS signal 11 Sensor data in the form of position data 13 of the vehicle 1 ,

Finally, the vehicle includes 1 third sensors in the form of speed sensors 7 at the wheels 4 , the sensor data as the speeds 9 the wheels 4 output.

The recorded driving dynamics data 8th , the speeds 9 and the position data 13 of the vehicle will then be the fusion sensor 2 fed. The fusion sensor 2 determined location data based on these sensor data 14 indicating the location of the vehicle 1 in terms of its absolute position and / or positional change, that is, the pitch rate, roll rate, yaw rate, lateral acceleration, longitudinal acceleration, and / or vertical acceleration with less error in the actual attitude of the vehicle 1 describe as the sensor data from the aforementioned sensors. On the functioning of the fusion sensor system 2 will be discussed later.

The more precise location data 14 can then be used for example in the context of the vehicle dynamics control mentioned above. For this purpose, the specified position data 14 a controller 15 supplied based on the specified location data 14 For example, the yaw rate and / or the lateral acceleration checks whether the vehicle 1 on the roadway deviates from the above given trajectory. In this case, the controller can 15 with a known controller output signal 16 to react to that. The regulator output signal 16 can then be from a control device 17 to be used by means of actuating signals 18 Actuators, like the brakes 5 to drive, which respond to the slippage and the deviation from the given trajectory in a conventional manner.

The more precise location data 14 can also be in a navigation system 19 of the vehicle 1 for precise identification of the absolute position of the vehicle 1 be used.

The use of the specified location data 14 is not on the examples mentioned, that is, the vehicle dynamics control and the navigation system 19 limited. So is the use of the fusion sensor 2 not on the generation of precise situation data 14 limited.

Based on 2 should the functioning of the sensor system 42 with the fusion sensor 2 will be explained in more detail.

Task of the fusion sensor 2 is it from the available sensor data 8th . 9 . 13 (ie from the position data 13 of the vehicle 1 from the GNSS receiver 10 , the vehicle dynamics data 8th from the driving dynamics sensor 6 and the speeds 9 from the wheel speed sensors 7 ) new and more precise knowledge of the available sensor data 8th . 9 . 13 and if necessary to win further events. This new and more precise knowledge is in the context of the present implementation in the specified position data 14 include the actual location and / or location change of the vehicle 1 Describe as error-free as possible with the lowest possible signal / noise margin.

Gaining new and more accurate knowledge about available sensor data 8th . 9 . 13 (ie the specified position data 14 ) is possible because of the sensor data 8th . 9 . 13 described measurement information in their Information content partially overlap, and thus there is a certain metrological redundancy. The redundant information content in the available sensor data 8th . 9 . 13 allows it with the available sensor data 8th . 9 . 13 described location and / or change in position of the vehicle 1 to make it plausible and, if necessary, correct it.

The core of this plausibility check and correction of the situation and / or change in position of the vehicle 1 is one in the fusion sensor 2 existing filter device 20 in which the more precise location data 14 based on the specified position data 14 redundant comparison site data 21 be filtered to a total error 22 in the by the more precise location data 14 described situation and / or change in position of the vehicle 1 to investigate. To the comparison site data 21 , which therefore redundantly the location and / or change in position of the vehicle 1 can describe in the filter device 20 in analogous manner also a total error 23 be determined. Based on the total errors 22 . 23 can then in a manner to be described, the specified location data 14 or the comparative position data are recursively corrected.

Under the filtering in the filter device 20 is intended to fall any analog or digital signal processing measure with which the more precise location data 14 and the comparison site data 21 Let's face the total error 22 in the specified position data 14 to investigate.

For this purpose, it can be determined, for example, to what extent by the specified location data 14 described location and / or change in position of the vehicle 1 deviates from a mean value resulting from the specified position data 14 and the comparison site data 21 is formed. Other disturbances, such as noise, need not be taken into account. If the noise is taken into account, a state observer or a Kalman filter could be considered as a filter. If the shape of the noise is also to be taken into account, it would be possible to use a particle filter which has a basic set of available noise scenarios and selects the noise scenario to be considered for the elimination, for example by means of a Monte Carlo simulation. Conveniently, a Kalman filter should be used, because here precise results for the specified position data 14 can be achieved with a comparatively low computing resource claim.

The above correction of the specified position data 14 may suitably with the generation of the specified position data 14 be merged. That is, the specified location data 14 be corrected recursively. This is in the fusion filter 2 in the context of the present embodiment, for example, from the document DE 10 2006 029 148 A1 known strapdown algorithm 24 present, which is used in so-called inertial navigation systems and the location and / or the change in position of the vehicle 1 based on the vehicle dynamics data 8th from the driving dynamics sensor 6 calculated. In this strapdown algorithm 24 can the total error 22 in the specified position data 14 incorporate so that the more precise location data 14 recursively for their total error 22 can be cleaned up.

Also, the above-mentioned correction of the comparison position data 21 may suitably with the generation of the comparison position data 21 be merged so that also the comparative situation data 21 in the fusion sensor 2 be determined recursively. This is in the fusion sensor 2 for example in model 25 of the vehicle 1 present, with the location and / or the change in position of the vehicle 1 can be simulated. For this the model must 25 However, be supplied with boundary conditions, for example, by the speeds 9 and the position data 13 can be provided. The model 25 For example, can be based on the known two-track model of a vehicle, for example, from the DE 10 2004 017 845 A1 a model for determining the yaw rate of the vehicle 1 is known. In the model 25 can the total error 23 in the comparison site data 21 with, so that the comparison situation data 21 recursively for their total error 23 can be cleaned up.

In the manner described above, the fusion sensor fuses 2 the driving dynamics data 8th with the wheel speeds 9 and the position data 13 to the specified situation data 14 , The more precise location data 14 thus describe the actual physical quantity to be detected, ie the position and / or the position change of the vehicle 1 , In contrast, the driving dynamics data describe 8th a physical output from which the physical quantity is to be determined. The position data 13 and the wheel speeds 9 represent in the context of the present embodiment diverse correction quantities, which overlap in their information content at least partially with the physical output, as already mentioned above, overlap.

The sensor system described above 42 in the vehicle 1 has next to the output of precise location data 14 indicating the location and / or location of the vehicle 1 high-precision describe the advantage that the Kalman filter 20 can compensate for the failure of one of the sensor signals by the fusion of the individual sensor signals. Falling, for example, when driving under a tunnel through the failure of the GNSS the position data 13 away, then the fusion sensor can 2 the more precise location data 14 based solely on the remaining sensor signals, such as the vehicle dynamics data 8th and the wheel speeds 9 , continue without that positional data 13 with an absolute position of the vehicle 1 be detected via the GNSS. In the same way could also the failure of one of the speed sensors 7 be compensated when the fusion sensor 2 is constructed appropriately, so that it in the specified position data 14 also or alternatively speeds of the wheels 4 outputs.

The failure of one of the sensors 6 . 7 . 10 or at least a malfunction of one of the sensors 6 . 7 . 10 however, reduces the precision of the specified position data 14 because of the fusion sensor 2 principle, the information content of the individual sensor signals 6 . 7 . 10 can not increase without comparative information. The one with the GNSS receiver 10 recorded position data 13 For example, by the fusion sensor 2 in the specified position data 14 be specified. A failure of the GNSS receiver 10 over a comparatively short period of time is thereby by the fusion sensor 2 For example, easily compensated for a tunnel trip. The longer the failure of the GNSS receiver 10 however, the more indefinite, unreliable or uncertain the longer they are with the more precise location data 14 described position data 13 of the vehicle 1 , because no metrologically recorded reference information, in particular with regard to the absolute position of the vehicle 1 more is available. Therefore, this information loss can not be sustained by the other sensors 6 . 7 be compensated.

Therefore, the failure of a sensor should be 6 . 7 . 10 detected and, for example, in the context of the maintenance of the vehicle 1 be found in a workshop as soon as possible. Here, the specified embodiment attacks with the consideration of an integrity measure 26 record that of a contradiction between the sensor data 8th . 9 . 13 is dependent. A contradiction in the sensor data 8th . 9 . 13 would inevitably lead to the sensor data 8th . 9 . 13 would no longer overlap in their information content and thus would no longer be redundant. Consequently, those would be the more precise location data 14 described location and / or change in position of the vehicle 1 less trustworthy than when the sensor data 8th . 9 . 13 would not contradict.

A contradiction in the sensor data 8th . 9 . 13 could look arbitrary. For example, could with the vehicle dynamics sensor 6 in the vehicle dynamics data 8th be detected that the vehicle 1 with a yaw rate of greater than zero turns. That is, the vehicle 1 would be in a cornering. In a cornering would have to be on an axle of the vehicle 1 the speeds 9 the wheels 4 differ, because the radially inner wheels 4 turn slower when cornering, so the radially outer wheels. Give the wheel speed sensors 7 at a yaw rate of greater than zero in the vehicle dynamics data 8th therefore no speed difference between the two wheels 4 on an axle of the vehicle 1 that would be a contradiction with the measure of integrity 26 could be spent. This contradiction can be with an integrity monitor 27 be recorded. But also indirect, from the sensor data 8th . 9 . 13 dependent data, such as the specified location data 14 and the comparative data 21 would be suitable for monitoring for a contradiction.

In the context of the present embodiment, the integrity monitoring device detects 27 exemplary the driving dynamics data 8th and the position data 13 of the vehicle 1 and monitor these for contradictions. A contradiction would be, for example, if the position data 13 that would result in the vehicle 1 is decelerated with a negative acceleration while the vehicle dynamics data 8th however, a positive longitudinal acceleration for the vehicle 1 describe.

Each detected contradiction can be assigned a weighting factor that depends, for example, on the size of the contradiction. Thus, the aforementioned contradiction between the vehicle dynamics data 8th and the position data 13 for example, at low speed 15 km / h are assigned much less weight than at a high speed, for example, at more than 130km / h. All with the integrity monitor 27 and contradictions associated with a weighting factor can then be added to the integrity measure 26 between 100% for complete consistency between the individual sensor signals 8th . 9 . 13 and 0% for a complete inconsistency between the individual sensor signals 8th . 9 . 13 can accept any values.

A course 28 the integrity measure 26 is exemplary in 3 via a progression variable in the form of the driving distance of the vehicle 1 descriptive mileage 29 of the vehicle 1 applied, for example, in an odometer 30 from the position data 13 can be derived. Alternatively, the mileage could be 30 also in a conventional manner about the speeds 7 and the resulting ground speed of the vehicle 1 be derived. This course 28 should be under a predetermined condition 31 in a ring buffer 32 in an analysis tool 33 get saved. Alternatively, you can the history 28 also applied over time and in ring buffer 31 get saved.

The predetermined condition 31 includes within the scope of the present embodiment a limit. Below the integrity measure 26 the limit of the predetermined condition 31 , the predetermined condition should be considered fulfilled. However, this is from the definition of integrity measure 26 dependent. Is in the integrity measure 26 defines the complete consistency at 0%, so should the predetermined condition 31 be considered fulfilled if the integrity measure 26 exceeds the limit.

A drive device 34 can determine if the integrity measure 26 the predetermined condition 31 Fulfills. Meets the integrity measure 26 the predetermined condition 31 can the drive device with a switching signal 35 the integrity measure 26 to the ring buffer 32 conduct the integrity measure 26 then about the mileage 29 of the vehicle 1 records. The ring buffer 32 is characterized in that in the fully described state when entering new data always the oldest in the ring buffer 32 overwrites existing data.

In the present embodiment, the analysis tool includes 33 also a buffer memory 36 , the vehicle condition descriptive information about the vehicle 1 stores. In the context of the present embodiment, the vehicle dynamics data 8th by way of example, the information describing the state of the vehicle may be regarded as being of an indicative nature, although this is not restrictive, since this information is also available from outside of the vehicle 2 shown sensor system 42 can come.

Meets the integrity measure 26 the predetermined condition 31 , then along with the integrity measure 26 in the ring buffer 32 also the vehicle state descriptive information about the vehicle 1 , So in the present embodiment, the vehicle dynamics data 8th to be recorded. In principle, there is an intermediate storage in the buffer memory 36 not necessary, the cache 36 however, it allows the vehicle condition descriptive information about the vehicle 1 over a larger value range of the mileage 29 to store, which is greater than that in the ring buffer 32 Recordable value range of the mileage 29 ,

Finally, the switching signal 35 also to trigger a warning message 37 be used. With this example, the driver of the vehicle 1 be asked to visit a workshop to the cause of the relatively poor degree of integrity 26 to get to the bottom of it. In the workshop then the course 28 the integrity measure 26 about the mileage 29 from the ring buffer 32 be read out.

Together with those from the fusion sensor 2 output signals, so for example the more precise location data 14 , In addition, can also have a signal identifier 43 be issued, which shows how the from the fusion sensor 2 output signals were generated. This could be for example a direct measurement, a derivative of measured data, for example by estimation, filtering (as with the Kalman filter 20 ) or modeling (as with the model 25 ), a derivative of a reduced amount of data, such as occurs in a sensor failure or by a linear update of data. In the present case, the identification signal 43 show that the specified location data 14 in the Kalman filter 20 filtered and in the strapdown algorithm 24 are modeled.

In this way, those from the fusion sensor 2 categorized output signals. Another form of categorization could be to subdivide the individual signals according to the real sensor signal, virtual sensor signal (determined from other sensor signals) or linearly updated sensor signal.

In 3 is an exemplary course 28 represented over a larger value range for the mileage 29 is shown when he is in the ring buffer 32 is deposited.

Assuming that the sensor system 42 of the 2 is subject to normal wear, can in 3 be observed, such as the integrity measure 26 in an initial interval 38 initially due to wear slowly decreases. Suppose the driving dynamics sensor 6 then falls at a time of failure 39 out, that would be the integrity measure 26 from this time of failure 39 fall more and at a time of fulfillment 40 below the limit of the predetermined condition 31 fall. From this time of fulfillment 40 the recording interval starts 41 from that the integrity measure 26 in ring buffer 32 is recorded, so that when reading the course 28 from the ring buffer 32 also only the recording interval 41 you can see.

It can with each restarted recording of the course 28 the integrity measure 26 in ring buffer 32 the time of fulfillment 40 be stored as a timestamp.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 2011/098333 A1 [0002]
• DE 102011080789 A1 [0034]
• DE 102006029148 A1 [0050]
• DE 102004017845 A1 [0051]

Claims (10)

Method for monitoring a sensor system ( 42 ) in a vehicle ( 1 ) for acquiring measured data ( 14 ) to a physical quantity based on a sensor fusion ( 2 ) of first sensor data ( 8th ) to a first sensor size from a first sensor ( 6 ) and second sensor data ( 13 ) to a second sensor size from a second sensor ( 10 ) which at least partially matches the first sensor data ( 8th ) are redundant, comprising: - merging ( 2 ) of the first sensor data ( 8th ) and the second sensor data ( 13 ) to the measured data ( 14 ), - determining ( 27 ) of a course ( 28 ) one of a contradiction between the first sensor data ( 8th ) and the second sensor data ( 13 ) dependent integrity measure ( 26 ) for the measured data ( 14 ) via a history variable ( 29 ), and - Save ( 32 ) of the course ( 28 ) of the integrity measure ( 26 ) from an event value ( 40 ) for the history variable ( 29 ), from which the integrity measure ( 26 ) a predetermined condition ( 31 ) Fulfills. Method according to claim 1, wherein the predetermined condition ( 31 ) includes a limit that the integrity measure ( 26 ) to fulfill the predetermined condition ( 31 ) reached. Method according to claim 1 or 2, wherein said storing ( 32 ) overwriting a previously saved history ( 28 ) of the integrity measure ( 26 ). Method according to claim 3, wherein the course ( 28 ) of the integrity measure ( 26 ) to overwrite the previously saved history ( 28 ) of the integrity measure ( 26 ) in a ring buffer ( 32 ) is deposited. Method according to one of the preceding claims, comprising: - recording ( 36 ) a course of at least one information describing the vehicle condition ( 8th ) over the same history variable ( 29 ), about which the integrity measure ( 26 ) is recorded. Method according to claim 5, comprising: reading the course of the information describing the vehicle condition ( 8th ) from a buffer memory ( 36 ). Method according to claim 6, wherein the buffer memory ( 36 ) is set up, the course of the information describing the vehicle condition ( 8th ) over a history interval that is greater than a history interval ( 41 ) of the stored integrity measure ( 26 ). Method according to one of the preceding claims, comprising: receiving the information describing the vehicle condition ( 8th ) from outside the sensor system. Method according to one of the preceding claims, comprising: - storing time information ( 40 ) with the course of the integrity measure ( 26 ) from a date ( 40 ), from which the integrity measure ( 26 ) the predetermined condition ( 31 ), the time information ( 40 ) from the date ( 40 ) is dependent. Method according to one of the preceding claims, comprising: issuing a warning ( 37 ), from the date ( 40 ), from which the integrity measure ( 26 ) the predetermined condition ( 31 ) Fulfills.

Images