WO2017167820A1

WO2017167820A1 - Electronic control unit for a vehicle with separate data connection, assistance system and method

Info

Publication number: WO2017167820A1
Application number: PCT/EP2017/057446
Authority: WO
Inventors: Tomas Daujotas; Mutlu AYDIN; John Tynan; Arturo CRESPO DE LA VINA
Original assignee: Connaught Electronics Ltd.
Priority date: 2016-03-31
Filing date: 2017-03-29
Publication date: 2017-10-05
Also published as: DE102016105876A1

Abstract

The invention relates to an electronic control unit (9) for a motor vehicle (1), with a first computing device (14) for receiving vehicle data of the vehicle (1) and with a second computing device (15) for receiving sensor data of at least one sensor (3) of the vehicle (1) and for determining safety-relevant data for a safety-relevant component (12) of the vehicle (1) based on the sensor data, wherein the first computing device (14) and the second computing device (15) are connected for transmitting the vehicle data and/or the safety-relevant data, wherein the first computing device (14) and the second computing device (15) are connected via a first data connection (30) for transmitting the vehicle data and via a second data connection (31) separate from the first data connection (30) for transmitting the safety-relevant data.

Description

ELECTRONIC CONTROL UNIT FOR A VEHICLE WITH SEPARATE DATA

CONNECTION, ASSISTANCE SYSTEM AND METHOD

The present invention relates to an electronic control unit for a vehicle with a first computing device for receiving vehicle data of the vehicle and with a second computing device for receiving sensor data of at least one sensor of the vehicle and for determining safety-relevant data for a safety-relevant component of the vehicle based on the sensor data, wherein the first computing device and the second computing device are connected for transmitting the vehicle data and/or the safety-relevant data. Further, the present invention relates to an assistance system for a vehicle. Furthermore, the invention relates to a vehicle with such an assistance system. Finally, the present invention relates to a method for operating an electronic control unit for a vehicle.

Presently, the interest is directed to electronic control units for vehicles, in particular for motor vehicles. In modern motor vehicles, a plurality of electronic control units is used. These electronic control units can for example be associated with different driver assistance systems of the motor vehicle. These electronic control units can include one or more computing devices, which can for example be formed as a microcontroller, as a digital signal processor, as a selectable output control, as an integrated circuit or the like. Signals can be received from a vehicle data bus or signals can be transmitted over the vehicle data bus by these computing device. Furthermore, the computing devices can be connected to sensors of the motor vehicle and driver assistance system, respectively, and receive sensor data from these sensors.

Based on the received sensor data, safety-relevant data can also be determined with the aid of the computing devices. Such safety-relevant data can for example be associated with safety-relevant components or safety-relevant functions of the vehicle. If such a safety-relevant component in the vehicle fails, a significant risk can for example result for the vehicle occupants and/or the environment. In order to generate such safety-relevant data, it is required that the computing device is formed according to a safety standard. In the same manner, the data connections, via which the safety-relevant data is transmitted, have to be formed according to a safety standard. For example, the computing device and/or the data connection can be formed according to a predetermined safety integrity level. Such a safety integrity level is also known under the designation ASIL (Automotive Safety Integrity Level). Hereto, US 2015/0057908 A1 describes an electronic control unit for an internal combustion engine of a motor vehicle. The electronic control unit includes a

microcontroller and an integrated circuit, which can communicate with each other via a data line. Safety-relevant functions with a predetermined safety integrity level can be performed by the microcontroller. The integrated circuit can also perform safety-relevant functions with a safety integrity level lower compared to the microcontroller. For each safety-critical function, a diagnostic function can additionally be performed by the integrated circuit to recognize errors in performing the safety-critical function.

It is the object of the present invention to demonstrate a solution, how an electronic control unit for a vehicle can be more safely and reliably operated.

According to the invention, this object is solved by an electronic control unit, by an assistance system, by a vehicle as well as by a method having the features according to the respective independent claims. Advantageous developments of the present invention are the subject matter of the dependent claims.

According to an embodiment, an electronic control unit for a vehicle includes a first computing device for receiving vehicle data of the vehicle. In particular, the electronic control unit includes a second computing device for receiving sensor data of at least one sensor of the vehicle. Preferably, the second computing device is adapted to determine safety-relevant data for a safety-relevant component of the vehicle based on the sensor data. In particular, the first computing device and the second computing device are connected for transmitting the vehicle data and/or the safety-relevant data. Therein, it is preferably provided that the first computing device and the second computing device are connected via a first data connection for transmitting the vehicle data and via a second data connection separate from the first data connection for transmitting the safety-relevant data.

An electronic control unit according to the invention for a vehicle includes a first computing device for receiving vehicle data of the vehicle. Further, the electronic control unit includes a second computing device for receiving sensor data of at least one sensor of the vehicle and for determining safety-relevant data for a safety-relevant component of the vehicle based on the sensor data. Therein, the first computing device and the second computing device are connected for transmitting the vehicle data and/or the safety-relevant data. Furthermore, the first computing device and the second computing device are connected via a first data connection for transmitting the vehicle data and via a second data connection separate from the first data connection for transmitting the safety-relevant data.

The electronic control unit can be employed in a vehicle, in particular in a motor vehicle. The electronic control unit can for example be a part of an assistance system of the vehicle, which assists the driver in driving the vehicle. The electronic control unit includes two computing devices, which can for example be formed as a microcontroller, as a selectable output control (SOC), as an integrated circuit, as a digital signal processor or the like. Vehicle data of the vehicle can be received by the first computing device. This vehicle data can for example be received via a vehicle data bus, which is for example formed as a CAN bus or as an Ethernet connection. Sensor data of at least one sensor of the vehicle can be received by the second computing device. Hereto, the second computing device can be connected to the at least one sensor via corresponding data lines. This sensor data can for example describe the environment of the vehicle.

With the aid of the second computing device, the safety-relevant data can then be determined based on the sensor data. Such safety-relevant data can be predetermined safety-relevant data. This safety-relevant data can be determined for a safety-relevant component or a safety-relevant function of the vehicle. In particular, this safety-relevant data can also serve for controlling the safety-relevant component or the safety-relevant function of the vehicle. Such a safety-relevant component or a safety-relevant function is defined in that they imply a significant risk for the occupants of the vehicle, for other traffic participants or generally for the environment upon failure. Therein, the safety-relevant components or the safety-relevant functions can be formed according to a predetermined safety standard, for example the standard ISO 26262.

Further, it is provided that the vehicle data and/or the safety-relevant data are exchanged between the first computing device and the second computing device. For example, the vehicle data can be transmitted from the first device to the second computing device and the safety-relevant data can be transmitted from the second computing device to the first computing device. Hereto, a single data connection is used in the prior art. However, this entails the disadvantage that a reliable transmission of the safety-relevant data and in particular the transmission of the safety-relevant data within a certain transmission time cannot be reliably ensured.

According to the invention, it is now provided that the first computing device and the second computing device are connected via a first data connection for transmitting the vehicle data. Thus, the first computing device and the second computing device are connected to the first data connection for data transmission. In particular, only the vehicle data is transmitted via this first data connection. Therein, it is in particular provided that the vehicle data is transmitted from the first computing device to the second computing device via the first data connection. Furthermore, a second data connection is provided, which is formed separate from the first data connection. The first and the second data connection thus differ from each other. The first and the second computing device are connected via this second data connection for transmitting the safety-relevant data.

Preferably, only the safety-relevant data is transmitted via this second data connection. In particular, the safety-relevant data is transmitted from the second computing device to the first computing device. Thereby, it can be achieved that the safety-relevant data can be reliably transmitted within a predetermined transmission time. In this manner, this safety- relevant data can be reliably transmitted to the safety-critical component of the vehicle. Thereby, safe operation of the vehicle can overall be ensured.

Preferably, the second data connection is formed according to a predetermined safety integrity level. This predetermined safety integrity level can in particular be the so-called Automotive Safety Integrity Level (ASIL). It represents a measure of the safety relevance of a malfunction. This safety integrity level can for example be classified in levels from A to D. Further, the level can be provided not safety-relevant, which can also be referred to as QM (Quality Management). Thereto, the severity of the effect, the frequency of the driving situation and the controllability of the malfunction of the respective driving situation can individually be estimated for each identified danger. In particular, the second data connection is formed according to the safety integrity level ASIL B. Further, it can be provided that the first data connection is formed according to the safety level requirement QM.

In an embodiment, the second computing device has a first processor and a second processor, wherein the first processor is connected to a first data line of the first data connection and the second processor is connected to a second data line of the second data connection. The second computing device can in particular include a multi-core processor. The first and the second processor can be constituted by processor cores of the multi-core processor. Therein, a first processor core can be connected via the first data connection and the second processor core via the second data connection to the first computing device. The respective processors or processor cores can have respective interfaces, at which the data line can be disposed. Therein, the first processor and the second processor can be formed in isolated manner. This means that a separate program is run on each of the processors. In particular, the first processor and the second processor can be operated independently of each other and data exchange is not effected between the first processor and the second processor. Thus, two separate data connections can be provided in reliable manner.

In a further configuration, the electronic control unit has a storage device for storing the sensor data and the second processor is adapted to determine the safety-relevant data based on the sensor data stored on the storage device. The second computing device can for example include a corresponding data input, by which the sensor data can be received from the at least one sensor. This data input can be connected to the storage device. Thus, the sensor data can be transmitted to the storage device. Therein, it can further be provided that the respective processors can access the storage device or the stored sensor data independently of each other. The second processor can now determine the safety-relevant data based on this stored sensor data. This allows reliable determination of the safety-relevant data.

Furthermore, it is advantageous if the second computing device has a third processor, which is adapted to store calibration data describing a calibration of the at least one sensor and/or state data describing a state of the at least one sensor on the storage device and that the second processor is adapted to determine the safety-relevant data additionally based on the calibration data and/or state data stored on the storage device. The third processor can also be constituted by a processor core of the multi-core processor. The calibration data can be provided by the third processor, which for example describes a current calibration or setting of the at least one sensor. Further, the state data describing the current state of the at least one sensor can be provided by the third processor. The state data can for example describe the functionality of the at least one sensor. For example, the state data can describe if the at least one sensor is polluted. The calibration data and/or the state data can be used to correspondingly process the sensor data stored on the storage unit. This allows the second processor additionally determining the safety-relevant data based on the current calibration and/or the current state of the at least one sensor.

Furthermore, it is advantageous if the first computing unit includes a communication unit for receiving the vehicle data from a vehicle data bus of the vehicle and for transmitting the safety-relevant data received from the second computing device via the vehicle data bus of the vehicle. The communication unit can represent an interface, which connects the first computing device to the vehicle data bus. The vehicle data for example provided by other control units can be received on the one hand via this communication unit. In addition, the safety-relevant data transmitted from the second computing device to the first computing device can be emitted via the vehicle bus. This safety-relevant data can then be used by the safety-relevant component or the safety-relevant function.

Therein, it is in particular provided that the first computing device has a separate data line between the communication unit and the second data connection. The first computing device can have a first interface for transmitting the vehicle data and a separate, second interface for transmitting the safety-relevant data. This second interface can be directly connected to the communication unit via the separate data line. This data line is in particular formed isolated from the remaining components of the first computing unit. This allows reliable transmission of the safety-relevant data within the first computing device.

Preferably, the first computing device is adapted to receive video data from at least one camera of the vehicle as the sensor data. In this case, the at least one sensor is a camera. Image sequences or video data can be provided by this camera, which for example describes the environment of the vehicle. It can also be provided that the second computing device is adapted to capture the respective video data from multiple cameras.

Preferably, the second computing device is adapted to recognize roadway markings of the roadway in the video data and to determine the safety-relevant data based on the recognized roadway markings. With the aid of corresponding object recognition algorithms, the second processor can then recognize the roadway markings in the video data or the frames based on the video data stored on the storage device. In particular, the relative position of the vehicle to the roadway markings on the roadway can be

determined. Thus, it can for example be determined if the vehicle is currently on a lane of the roadway bounded by the roadway markings or is at least partially outside of the lane. Based on the recognized roadway markings, the safety-relevant data can then be provided, which for example can describe if the vehicle is within the lane or partially outside. It can also be determined depending on the time if departure from the lane by the vehicle impends. This data can then be transmitted with the safety-relevant data from the second computing device to the first one and from it to the safety-relevant component via the vehicle data bus.

In a further embodiment, the first computing device is adapted to receive data as the vehicle data, which describes a current position and/or the current movement of the vehicle. This vehicle data can for example be provided by a further sensor of the vehicle or a further electronic control unit. The vehicle data can in particular be odometry data, which describes the current position and/or the current movement of the vehicle. This vehicle data can then be transmitted from the first computing device to the second computing device. In the second computing device, the second processor can then determine the safety-relevant data additionally based on the vehicle data or the odometry data. For example, based on the recognized roadway markings and the current movement of the vehicle, it can be recognized if departure from the lane by the vehicle impends.

An assistance system according to the invention for a vehicle includes an electronic control unit according to the invention and at least one sensor. The assistance system is in particular formed as a driver assistance system. The assistance system can also include multiple sensors, which are for example disposed distributed on the vehicle. The at least one sensor can in particular be a camera.

Preferably, the assistance system includes the safety-critical component, which is adapted to receive the safety-relevant data and to output control signals for controlling a vehicle function depending on the safety-relevant data. The safety-critical component can for example be a further electronic control unit. As a result of the emitted control signal, intervention in the steering, a drive engine and/or a brake system of the vehicle can for example be effected. If for example - as described above - the safety-relevant data has been determined based on the roadway markings, intervention in the steering can be performed if the vehicle departs from the lane or departure from the lane impends.

A vehicle according to the invention includes an assistance system according to the invention. The vehicle is in particular formed as a motor vehicle, in particular preferably as a passenger car. Basically, it can also be provided that the vehicle is an airplane.

A method according to the invention serves for operating an electronic control unit of a vehicle. Therein, vehicle data of the vehicle is received by means of a first computing device and sensor data of at least one sensor of the vehicle is received by means of a second computing device. In addition, safety-relevant data is determined for a safety- relevant component of the vehicle based on the sensor data by the second computing device. Further, the vehicle data and/or the safety-relevant data are transmitted between the first computing device and the second computing device. Therein, it is provided that the vehicle data is transmitted via a first data connection and the safety-relevant data is transmitted via a second data connection separate from the first data connection between the first computing device and the second computing device. The preferred embodiments presented with respect to the electronic control unit according to the invention and the advantages thereof correspondingly apply to the assistance system according to the invention, to the vehicle according to the invention as well as to the method according to the invention.

Further features of the invention are apparent from the claims, the figures and the description of figures. The features and feature combinations mentioned above in the description as well as the features and feature combinations mentioned below in the description of figures and/or shown in the figures alone are usable not only in the respectively specified combination, but also in other combinations or alone without departing from the scope of the invention. Thus, implementations are also to be considered as encompassed and disclosed by the invention, which are not explicitly shown in the figures and explained, but arise from and can be generated by separated feature combinations from the explained implementations. Implementations and feature combinations are also to be considered as disclosed, which thus do not have all of the features of an originally formulated independent claim. Moreover, implementations and feature combinations are also to be considered as disclosed, in particular by the explanations set out above, which extend beyond or deviate from the feature combinations set out in the relations of the claims.

Now, the invention is explained in more detail based on preferred embodiments as well as with reference to the attached drawings.

There show:

Fig. 1 a vehicle according to an embodiment of the present invention, which has an assistance system with a plurality of sensors as well as an electronic control unit;

Fig. 2 a schematic representation of an electronic control unit; and

Fig. 3 a schematic representation of the electronic control unit according to a further embodiment.

In the figures, identical and functionally identical elements are provided with the same reference characters. Fig. 1 shows a vehicle 1 according to an embodiment of the present invention in a plan view. Presently, the vehicle 1 is formed as a passenger car. The vehicle 1 includes an assistance system 2, which includes a plurality of sensors 3. The respective sensors 3 are presently formed as cameras 4. With the aid of the sensors 3 or the cameras 4, an environment 5 of the vehicle 1 can be captured. Presently, the cameras 4 are disposed distributed on the vehicle 1 . Therein, one of the cameras 4 is disposed in a front area 6, one of the cameras 4 is disposed in a rear area 7 and two of the cameras 4 are disposed in respective lateral areas 8 of the vehicle 1 . Video data or image sequences describing the environment 5 can be provided by the cameras 4 as sensor data.

Moreover, the assistance system 2 includes an electronic control unit 9, which is connected to the respective cameras 4 for data transmission. The electronic control unit 9 is further connected to a display device 10 of the assistance system 2. The electronic control unit 9 can provide a display on the display device 10 based on the respective video data of the cameras 4. For example, the environment 5 of the motor vehicle 1 can for example be displayed to a driver of the vehicle 1 . Furthermore, the assistance system 2 includes a vehicle data bus 1 1 , which can for example be formed as a CAN bus or Ethernet bus. Therein, the electronic control unit 9 and the display device 10 are connected to the vehicle data bus 1 1 for data transmission. Moreover, a safety-relevant component 12 is connected to the vehicle data bus 1 1 . The safety-relevant component 12 can for example be a further electronic control unit 13.

Fig. 2 shows a schematic representation of the electronic control unit 9. In addition, a vehicle data bus 1 1 is illustrated, which presently is connected to multiple further control units 13. Therein, one of the control units 13 represents the safety-relevant component 12. The electronic control unit 9 includes a first computing device 14 and a second computing device 15. The first computing device 14 is connected to the vehicle data bus 1 1 with interposition of a communication module 16. The first computing device 14 can receive vehicle data via the vehicle data bus 1 1 . This vehicle data can for example be provided by one of the control units 13. In particular, the vehicle data describes the current position and/or the current movement of the vehicle 1 . The vehicle data can in particular be odometry data.

The second computing device 15 is connected to the cameras 4 for data transmission and can receive the sensor data or video data from the respective cameras 4. The second computing device 15 can in particular be formed as a selectable output control (SOC). The second computing device 15 includes a data input 17, which can be formed as a so- called video input port. The data input 17 can receive the video data or sensor data and store it on a buffer storage 18 of a storage device 19 of the electronic control unit 9.

Furthermore, the second computing device 15 includes an image processing unit 23. It is informed by the data input 17 via the data line 24 that new video data has been received.

The second computing device 15 further includes a first processor 20, which is connected to the first computing device 14 for data transmission as explained in more detail below. Furthermore, the second computing device 15 includes a second processor 21 , which can for example include a digital signal processor and a so-called Embedded Video Engine (EVE). The second processor 21 too is connected to the first computing device 14 for data transmission. Furthermore, the second computing device 15 has a third processor 22, by which calibration data 25 and/or state data 26 can be provided. The calibration data 25 can for example relate to a current calibration of the cameras 4. The state data 26 can for example describe if a lens of the respective cameras 4 is polluted. The image processing unit 23 controls the second processor 21 via the data line 27 and notifies that new video data has arrived. The second processor 21 can now access the video data stored in the storage unit 19 as well as the calibration data 25 and the state data 26. Moreover, the vehicle data received from the first computing device 14 and transmitted to the second computing device 15 can be transmitted from the first processor 20 to the second processor 21 via the data line 28. The second computing device 15 additionally includes a buffer 29.

Now, the second processor 21 is formed to recognize roadway markings on a roadway, on which the vehicle 1 is currently located, based on the video data optionally considering the calibration data 25 and the state data 26. Therein, the second processor 21 can further use the movement data or the odometry data. Thus, it can for example be determined if the vehicle 1 is currently on a lane of the roadway, which is bounded by the roadway markings. It can also be determined if the vehicle 1 is outside of the lane at least in certain areas. In addition, it can also be determined if traversing the roadway marking by the vehicle 1 impends. Hereto, safety-relevant data can be provided by the second processor 21 , which is determined based on the roadway markings and optionally the movement data. This safety-relevant data can be used for controlling the safety-relevant component 12.

Presently, a first data connection 30 as well as a separate, second data connection 31 is provided between the first computing device 14 and the second computing device 15. The first data connection 30 includes a first data line 32 and the second data connection 31 includes a second data line 33. The first data line 32 and the second data line 33 can in particular be formed as a serial data line or as a serial data bus, for example as a Serial Peripheral Interface (SPI), as an Inter-Integrated Circuit (I2C), as a System Management Bus (SMBus), as a two-wire line, as an universal Asynchronous Receiver Transmitter (UART), as an SSI bus or the like. In the first computing device 14, a first interface 34 is associated with the first data line 32 and a second interface 35 is associated with the second data line 33. Further, the first processor 20 has a first processor interface 40, which is connected to the first data line 32. The second processor 21 has a second processor interface 41 , which is connected to the second data line 33.

The first computing device 14, which is preferably formed as a microcontroller, additionally includes a communication unit 36 for transmitting data to the vehicle data bus 1 1 and/or for receiving data from the vehicle data bus 1 1 . Furthermore, the first computing device 14 includes a plurality of software modules 37. Therein, one of the software modules 38 is connected to a watchdog timer 38. A separate data line 39 is provided within the first computing device 14, which connects the second interface 35 to the communication unit 36. Overall, thus, the safety-relevant data can be transmitted from the second processor 21 via the second data connection 31 and within the first computing device 14 via the data connection 39 to the vehicle data bus 1 1 .

The transmission of the safety-relevant data or the second data connection 31 thus complies with a predetermined safety integrity level, in particular the level ASIL B. The first data connection 30 can for example be formed according to the safety integrity level QM. Thereby, the safety-relevant data can be received by the safety-relevant component 12. If the safety-relevant data for example yield departure from the lane by the vehicle 1 , a control signal can be output to a vehicle function or a functional unit of the vehicle 1 by the safety-relevant component 12 or the control unit 13. Thereby, intervention in the steering can for example be performed such that the vehicle 1 is again steered into the lane.

Fig. 3 illustrates the transmission of the data within the electronic control unit 9. Herein, the data input 17 of the second computing device 15 receives the sensor data or video data from the four cameras 4 of the vehicle 1 . The video data is stored on the storage device 19. In addition, the calibration data 25 for the four cameras 4 and the state data 26 for the four cameras 4 are stored on the storage device 19. Intrinsic camera data 43 for the four cameras 4 are provided by a further storage 42 and transmitted to the second processor 21 . The video data, the calibration data 25 and the state data 26 are also transmitted to the second processor 21 . Moreover, the second processor 21 receives the vehicle data or odometry data received via the processor interfaces 40, 41 and buffered on a storage 44. Furthermore, the two data connections 30 and 31 are provided between the processor interfaces 40, 41 and the interfaces 34, 35 of the first computing device 14. Here too, the communication unit 36 of the first computing device is connected to the vehicle data bus 1 1 via the communication module 16. The vehicle data bus 1 1 is again connected to the safety-relevant component 12 or the at least one control unit 13.

Claims

1 . Electronic control unit (9) for a vehicle (1 ), with a first computing device (14) for receiving vehicle data of the vehicle (1 ) and with a second computing device (15) for receiving sensor data of at least one sensor (3) of the vehicle (1 ) and for

determining safety-relevant data for a safety-relevant component (12) of the vehicle (1 ) based on the sensor data, wherein the first computing device (14) and the second computing device (15) are connected for transmitting the vehicle data and/or the safety-relevant data,

characterized in that

the first computing device (14) and the second computing device (15) are connected via a first data connection (30) for transmitting the vehicle data and via a second data connection (31 ) separate from the first data connection (30) for transmitting the safety-relevant data.

2. Electronic control unit (9) according to claim 1 ,

characterized in that

the second data connection (31 ) is formed according to a predetermined safety integrity level.

3. Electronic control unit (9) according to claim 1 or 2,

characterized in that

the second computing device (15) has a first processor (20) and a second processor (21 ), wherein the first processor (20) is connected to a first data line (32) of the first data connection (30) and the second processor (21 ) is connected to a second data line (33) of the second data connection (31 ).

4. Electronic control unit (9) according to claim 3,

characterized in that

the electronic control unit (9) has a storage device (19) for storing the sensor data and the second processor (21 ) is adapted to determine the safety-relevant data based on the sensor data stored on the storage device (19).

5. Electronic control unit (9) according to claim 4,

characterized in that the second computing device (15) has a third processor (22), which is adapted to store calibration data (25) describing a calibration of the at least one sensor (3) and/or state data (26) describing a state of the at least one sensor (3) on the storage device (19) and that the second processor (21 ) is adapted to determine the safety- relevant data additionally based on the calibration data (25) and/or state data (26) stored on the storage device (19).

6. Electronic control unit (9) according to any one of the preceding claims,

characterized in that

the first computing device (14) includes a communication unit (36) for receiving the vehicle data from a vehicle bus (1 1 ) of the vehicle (1 ) and for transmitting the safety- relevant data received from the second computing device (15) via the vehicle bus (1 1 ) of the vehicle (1 ).

7. Electronic control unit (9) according to claim 6,

characterized in that

the first computing device (14) has a separate data line (39) between the

communication unit (36) and the second data connection (31 ).

8. Electronic control unit (9) according to any one of the preceding claims,

characterized in that

the second computing device (15) is adapted to receive video data from at least one camera (4) of the vehicle (1 ) as the sensor data.

9. Electronic control unit (9) according to claim 8,

characterized in that

the second computing device (15) is adapted to recognize roadway markings of a roadway in the video data and to determine the safety-relevant data based on the recognized roadway markings.

10. Electronic control unit (9) according to any one of the preceding claims,

characterized in that

the first computing device (14) is adapted to receive data as the vehicle data, which describes a current position and/or movement of the motor vehicle (1 ).

1 1 . Assistance system (2) for a vehicle (1 ) with an electronic control unit (9) according to any one of the preceding claims and with at least one sensor.

12. Assistance system (2) according to claim 1 1 ,

characterized in that

the assistance system (2) includes the safety-critical component (12), which is adapted to receive the safety-relevant data and to output a control signal for controlling a vehicle function depending on the safety-relevant data.

13. Vehicle (1 ) with an assistance system (2) according to claim 1 1 or 12.

14. Method for operating an electronic control unit (9) of a vehicle (1 ), in which vehicle data of the vehicle (1 ) is received by means of a first computing device (14) and sensor data of at least one sensor (3) of the vehicle (1 ) is received by means of a second computing device (15) and safety-relevant data for a safety-relevant component (12) of the vehicle (1 ) is determined based on the sensor data, wherein the vehicle data and/or the safety-relevant data is transmitted between the first computing device (14) and the second computing device (15),

characterized in that

the vehicle data is transmitted via a first data connection (30) and the safety-relevant data is transmitted via a second data connection (31 ) separate from the first data connection (30) between the first computing device (14) and the second computing device (15).