EP3642717A1

EP3642717A1 - Device and method for controlling a vehicle module

Info

Publication number: EP3642717A1
Application number: EP18726393.4A
Authority: EP
Inventors: B lent SARI
Original assignee: ZF Friedrichshafen AG
Current assignee: ZF Friedrichshafen AG
Priority date: 2017-06-19
Filing date: 2018-05-15
Publication date: 2020-04-29
Also published as: DE102017210156B4; DE102017210156A1; WO2018233934A1; US20210146939A1; CN110770707A; JP2020524352A; JP7089026B2

Abstract

The invention relates to a device for controlling a vehicle module with plausible information, comprising a multi-core safety processor which is designed to control processed information for plausibility. In addition, a control device for a vehicle module is provided, comprising a power processor, the evaluated information of which is checked for plausibility via an information interface in the safety processor of the device according to the invention. A driver assistance system is further provided, in which a control device according to the invention is used.

Description

Device and method for driving a vehicle module

The invention relates to a device for driving a vehicle module according to claim 1, a control device for a vehicle module according to claim 8 and a driver assistance method according to claim 16.

Control units, also called electronic control units, abbreviated ECUs, are electronic components for controlling and regulating. In the automotive sector, ECUs are used in several electronic areas to control and regulate vehicle functions. The ECUs known in the prior art each control and regulate a vehicle function, for example, a function for ejecting a CD from a CD player of a car radio is controlled and regulated by an ECU, the function of setting a radio station from another ECU.

In current semi-automated vehicles, more than 100 functions are controlled and regulated by individual ECUs during a journey. Each additional added function requires an additional ECU. In the development towards highly automated, fully automated and autonomously driving vehicles, even more functions arise that need to be controlled and regulated. Particularly in view of the large number of information resulting from road traffic, a large number of functions must already be controlled and regulated in a partially automated vehicle in order to be able to record and evaluate all the information in order to enable a safe journey.

Since an ECU consumes energy in the form of computing power, the energy consumption increases with each function to be controlled and regulated. The aim is not to control and regulate each individual function, each with a single ECU, but to merge several inter-related functions in one ECU, on the one hand to reduce energy consumption and, on the other hand, to evaluate information more efficiently.

Vehicle areas that form a functional unit have functions that are related to each other. Such vehicle areas are called Fahrzeugdo- mänen. Examples of vehicle domains are the infotainment system, the chassis, the drive, the interior or the safety. Functions for the infotainment system include, for example, operating a radio, a CD player, establishing a telephone connection, connecting to a hands-free unit, etc. When the music CD is playing, for example, the music is stopped when a telephone connection is made. Such ECUs, which control and regulate vehicle domains and thus several interrelated functions, are called domain ECUs.

ECUs for vehicles must provide the required functionality reliably and safely and be available, especially in the chassis, drive and safety. Reliability means that the vehicle should bring occupants without failure from a starting point to a destination point, provided that the vehicle functions properly at the starting point. In principle, safety means that the vehicle does not pose any danger to humans. Availability means that the vehicle is ready for use at any time and not, for example. continuously defective in the workshop stands.

The Automotive Standard Functional Safety Standard ISO 26262 also requires that in the event of malfunction, in particular electrical malfunction, an ECU, e.g. Failure of the ECU due to a voltage dip, countermeasures in the form of security measures should ensure that unjustifiable injury risks are avoided. An error caused by a voltage dip can be avoided for example by a redundant power supply.

For partially automated vehicles, domain ECUs for driver assistance systems, also known as advanced driver assistance systems, abbreviated ADAS, are the subject of current research. For example, ADAS systems capture environment of a vehicle by means of environment detection sensors such as a camera, evaluate it, and relay corresponding information to vehicle modules to assist the driver in a safe journey. A domain ECU for an ADAS system is called ADAS domain ECU. Functions that are controlled and controlled by an ADAS domain ECU are, for example, recognition of driving track markings, vehicles, traffic signs, pedestrians, etc. These functions are centrally controlled and regulated by the ADAS domain ECU.

For domain ECUs, in particular for ADAS domain ECUs, which process data from environment detection sensors, safety risks exist even if the ECU is electrically in a faultless state. For example, For example, a camera as an electronic system may be in a good condition, but still misinterpret and misinterpret a detected object.

This is where the invention starts. The object of the invention is to improve the security of the domain ECUs known from the prior art, in particular of ADAS domain ECUs.

This object is achieved with a device having the features of claim 1, with a control device having the features of claim 8 and with a driver assistance method having the features of claim 16.

Advantageous embodiments and further developments are specified in the subclaims.

The vehicle module driver comprises a security processor having at least one information interface at an input of the security processor and a control interface at an output of the security processor, the security processor including at least a first core, a second core, and a third core. It is essential to the invention that the first core is designed to execute a first plausibility check of at least one first information passed to the security processor via the information interface with at least one second information passed to the security processor via the information interface, the second core being configured, a second plausibility check of the first information to perform with the second information, the third core is formed, a comparison of a forward to the third core result of the performed on the first core first plausibility control with a forwarded to the third core result of execute the second core trained plausibility check and forward the information for which in the first plausibility check and in the second plausibility check a plausibility has been determined to the control interface, wherein the vehicle module is controlled with the information found to be plausible via the control interface.

A vehicle module is a component of a vehicle. For example, a steering wheel of a vehicle is a vehicle module. Electrical / electronic systems, abbreviated E / E systems, are also vehicle modules. Even functional units, which may consist of several components, form a vehicle module.

A processor is an electronic circuit that captures and processes commands. As a result of processing instructions, the processor can control and regulate other electrical circuits, thereby promoting a process.

A kernel is a part of a processor which forms a computing unit and which itself is capable of executing one or more instructions.

The security processor is thus a multi-core processor in which a plurality of cores are arranged on a single chip, that is, a semiconductor device. Multi-core processors achieve higher computing power and are more cost effective to implement in a single chip than multiple cores. The security processor is also called multicore micro control unit, abbreviated multicore MCU.

An interface is a device between at least two functional units at which an exchange of logical quantities, for example data or physical quantities, for example electrical signals, takes place, either only unidirectionally or bidirectionally. The exchange can be analog or digital. An interface may exist between software and software, hardware and hardware, and software and hardware, and hardware and software.

Plausibility check is a method by which a value, or generally a result, is superimposed to check whether it is at all plausible, ie acceptable, plausible and / or comprehensible or not. Plausibility checks can be carried out both in hardware and in software. Plausibility checks are, in particular, the monitoring of signals that may only occur in certain combinations and sequences. For example, measured values can be checked for their plausible value range and their time course. The plausibility check of a variable, whether it belongs to a specific data type or lies in a given value range or set of values, is a plausibility check. In a plausibility check, furthermore, two or more sensors, which detect different information, are compared with each other during operation in order to detect disturbances, such as deviations or failure. In addition, short circuits and / or ground contacts can be detected by means of plausibility checks.

Information is a subset of knowledge that a sender can convey to a receiver through a particular medium. The first information is preferably different from the second information. For example, subject objects in a digital camera image that the camera transmits via electrical power to a processor for further processing are certain first image information. Spatial distances of the objects to the camera form the second information.

First information is plausible to second information if the content of the first information is acceptable in terms of the content of the second information. If the first information matches in content with the content of the second information, then the first information is plausible to the second information.

The first plausibility check and the second plausibility check may differ in their respective procedures. With different plausibility checks, hardware and software with which the plausibility checks are carried out can be checked for errors. For example, measured values can be checked in a first plausibility check as integers, in a second plausibility check as floating point numbers. The device according to the invention has the advantage that the vehicle module is not directly controlled with processed information. Processing information itself can be compliant with ISO 26262. However, the information may pose further security risks that can not be mapped with ISO 26262. For example, environment information may incorrectly reflect the environment. In order to avoid these additional security risks, the information in the security processor is first checked for plausibility in order to exclude further security risks. The plausibility checks determine whether the hardware and software are functioning without errors and which information is correct for the safe control of the vehicle module. If an information in the plausibility check is detected as faulty, it is not forwarded to the control interface. The vehicle module is thus controlled only with plausible information. The vehicle module, which is controlled with the information found to be plausible, is then in a safe state. Driving with information also means that when there is more information, the information is first merged and the vehicle module is driven with the information or information resulting from the merger. In particular, the invention thus provides a security architecture for ADAS domain ECUs.

With the device according to the invention, a secure state for the vehicle module is thus in particular acceptable in the event that an environment is detected incorrectly, since in this case the vehicle module is controlled with plausible information. Due to the redundant signal conditioning of the different sensor signals such as camera, radar or lidar, it is possible to carry out a plausibility check. Thus, it is possible to detect the faulty signal in the event of an error. In the event of a fault, damage is minimized by triggering with plausible information. The device is thus fail-safe, also called fail-safe.

The fact that the first plausibility check on the first core and the second plausibility check on the second core are executed, wherein the second plausibility check in the procedure may differ from the first plausibility check, has the advantage that both hardware and software errors are detected. can be known by comparing on the third core. In principle, the first core calculates the same as the second core, preferably with different approaches. If a deviation from the result obtained with the second core is found on the third core when comparing the result obtained with the first core, there is a hardware and / or software error.

In a further development of the invention, the first core is designed to execute the first plausibility check for the first information, the second information and at least one third information supplied to the security processor via the information interface, the first information the second information and the third information each against each other for plausibility are controllable. This makes it possible to detect incorrect information comparatively easily. For example, if the first information is plausible with the second information and with the third information, and the second information is plausible with the third information, no information is erroneous. If, for example, the first information is not plausible with the second information and not plausible with the third information, but the second information is plausible with the third information, then the first information is erroneous.

Advantageously, the second core is designed to execute the second plausibility check for the first information, the second information and at least one third information supplied to the security processor via the information interface, wherein the first information, the second information and the third information can each be checked for plausibility. This results in the same advantages for the second core as compared to the first core. In addition, three pieces of information can be compared to the third core.

In a development of the invention, the result of the first plausibility check carried out on the first core and / or the result of the second plausibility check carried out on the second core is a majority selection of the information with a majority plausibility. However, the information, which is mostly not plausible with the other information, is faulty. The majority vote is also known as voting. If three pieces of information are checked for plausibility, and if one of the three pieces of information is detected as being defective, only two of the three pieces of information are forwarded to the control interface for activating the vehicle module. This majority voting is also known as 2oo3 voting, that is, two out of three.

The safety processor, in particular in each case the first core, the second core and the third core, preferably has a redundant power supply. Redundancy is the additional presence of functionally identical or comparable resources of a technical system, if they are normally not required for trouble-free operation. If a power supply fails due to an error, the device is in a manageable state due to the additional redundant power supply. With a voltage dip in a single power supply to the security processor, the entire security processor would fail with the first, second, and third cores. Such a multi-component failure that occurs as a result of a single failure cause or a single event is called common cause failure. The redundant power supply thus prevents a common cause failure caused by a voltage dip in a power supply.

In particular, the security processor preferably has in each case the first core, the second core and the third core, a monitoring device. The monitoring device, also known as watchdog, is a component of a system that monitors the functions of other components, in this case the security processor, in particular the first, the second and the third core. If a possible malfunction is detected, this is either signaled according to the security agreement or a suitable jump instruction is initiated, which corrects the pending problem. The term watchdog includes both hardware watchdogs and software watchdogs. The hardware watchdog is an electronic component with communication to the component being controlled. The software watchdog is a checking software in the component to be checked, which checks whether all important program modules are executed correctly within a given time frame or whether a module is not allowed to be used for the required length of time. needed. In particular, watchdogs can be implemented in safety-critical applications and allow monitoring of E / E systems for compliance with IS026262.

The information interface is preferably a redundant information interface. Thus, in the event that an information interface fails, an additional information interface is available, which keeps the device in a manageable state.

The inventive control device for a vehicle has a device according to the invention and a power processor, wherein the information interface of the device is arranged between the power processor and the security processor, with the features that the power processor has a detection device and an evaluation device, the detection device is formed, at least one to acquire, ie to acquire, the first signal and a second signal, the evaluation device is designed to generate at least first information from the first signal and second information from the second signal, and at least the first signal generated from the first signal by means of the information interface Information and the second information generated from the second signal to the security processor is controllable for driving the vehicle module. The control device according to the invention has the advantage that the information generated by the evaluation of the signals are not used directly for driving the vehicle module, but are previously checked for plausibility by means of the device according to the invention. This ensures that the vehicle module is controlled only with plausible information and not with faulty information.

According to a preferred embodiment of the invention, the power processor has at least a first channel and a second channel separated from the first channel, wherein the first signal can be detected in the first channel and the first information can be generated from the detected first signal, and wherein in the second channel second signal detectable and the second information can be generated independently of the first information. This ensures that the first signal and the second Signal are processed independently of each other. According to the ISO standard 26262, this guarantees freedom from interference. An error in channel 2 does not cause an error in channel 1 due to its independence and vice versa.

The power processor, in particular in each case the first channel and the second channel or respectively the detection device and the evaluation device, preferably has a redundant power supply. The redundant power supply prevents a common cause failure caused by a voltage dip in a power supply.

In one development of the invention, the power processor, in particular in each case at least the first channel and the second channel, has a monitoring device, a so-called watchdog. The watchdog can be a hardware and / or software watchdog.

According to a particularly preferred embodiment of the invention, the evaluation device on an artificial intelligence. Artificial intelligence means recreating a human-like intelligence, that is, trying to build or program a computer that can handle problems on its own. Artificial intelligence can be realized in particular with artificial neural networks. An artificial neural network is an algorithm that is executed on an electronic circuit and programmed on the model of the neural network of the human brain. Functional units of an artificial neural network are artificial neurons whose output is generally evaluated as the value of an activation function over a weighted sum of the inputs plus a systematic error, the so-called bias. By testing multiple predetermined inputs with different weighting factors and activation functions, artificial neural networks, similar to the human brain, are trained or trained. The training of artificial intelligence by means of predetermined inputs is called machine learning. A subset of machine learning is deep learning, in which a series of hierarchical layers of neurons, so-called hidden layer, is used to perform the process of machine learning.

An evaluation device with an artificial intelligence can process signals more efficiently than a deterministic evaluation device. In particular, the algorithm underlying the artificial intelligence can be executed on a graphics processor, a so-called Graphics Processor Unit, abbreviated GPU. A GPU has the advantage of being able to process several processes simultaneously, which increases the efficiency of the evaluation device.

Expediently, signals detected by the detection device are the signals of surroundings detection sensors, in particular camera signals, radar signals and / or lidar signals. Surround detection sensors provide input to driver assistance systems. For example, if the device of the present invention determines that the camera information is not plausible with the radar information but is plausible with the lidar information, and the radar information is not plausible with the lidar information, then the radar information is the erroneous information.

Particularly preferably, the vehicle module is a vehicle domain, in particular infotainment, chassis, drive, interior and / or security.

According to the invention, a driver assistance system comprising an inventive control device is also provided.

In the driver assistance method according to the invention, an inventive control unit is used. The driver assistance method according to the invention has the following steps:

Detecting signals from the environment of a vehicle with the detection device of the power processor, Evaluating the signals and generating information from the signals in separate channels of the power processor by means of the evaluation device,

- forwarding the information via the information interface to the

Security processor,

Executing the first plausibility check of each of the information with each of the other information on the first core of the first security processor, wherein a majority selection of the information that is mostly plausible with the other information occurs,

Executing the second plausibility check of each of the information with each of the other information on the second core of the security processor, wherein a majority selection of the information that is mostly plausible with the other information takes place

Forwarding the result of the plausibility check carried out on the first core and the result of the second plausibility check carried out on the second core to the third core of the security processor,

Comparing the results of the first plausibility check and the second plausibility check on the third core,

- Forwarding the information for which a plausibility has been determined in the first plausibility check and in the second plausibility check to the control interface and

- Control the vehicle module with the information found to be plausible

With the driver assistance method according to the invention, it is ensured that only those information items are used to control the vehicle module, which were classified as safe by means of the plausibility checks.

The invention will be explained in detail with reference to the following figures. Show it:

1 shows an embodiment of a device according to the invention, Fig. 2: an embodiment of a control device according to the invention, and

3 shows an exemplary embodiment of a driver assistance method according to the invention.

The same reference numerals designate the same or functionally identical features. In the respective figures, for reasons of clarity, only the respective relevant reference numbers are given.

1 shows a device 1 according to the invention for driving a vehicle module 2. The device 1 has an information interface 20, a safety processor 10 and a control interface 21. About the information interface 20, a first information 31, a second information 32 and a third information 33 is passed to the security processor 10. The security processor 10 has a first core 11, a second core 12 and a third core 13. Each individual core is connected to a redundant power supply 14. In addition, each core is controlled by a monitoring device 15.

It is also within the scope of the invention that the first information 31, the second information 32 and the third information 33 each enter the device 1 as a two-channel object.

In the first core 11, the information 31, 32 and 33 are mutually checked for plausibility in a first plausibility check 30. In the second core 12, the information 31, 32 and 33 are mutually checked for plausibility by means of a second plausibility check 40, which is different from the first plausibility check 30.

In the case where the first information 31 is the environment information acquired with a camera, the second information 32 is the information detected by radar, and the third information 33 is the lidar-acquired environmental information, the majority selection is based on the following scheme of majority scheme : 1: not plausible majority voter

0: plausible

faulty

Camera / Radar Camera / Lidar Radar / Lidar Information

Combinations 0 0 0 none

Com ments 1 0 0 none

Combinations 0 1 0 none

Combinations 0 0 1 none

Com merations 1 1 0 Camera

Combinations 0 1 1 Li dar

Combinations 1 0 1 Radar

Combinations 1 1 1 all

If, for example, the camera information 31 is plausible with the radar information 32, but not with the lidar information 33, and if the radar information 32 is not plausible with the lidar information 33, the device 1 recognizes that the lidar information 33 is faulty.

The information 31, 32 and 33 determined to be mutually plausible in the first plausibility check 30 and in the second plausibility check 40 are passed on to the third core 13, in which a comparison 45 of the incoming information is made. If the information found to be mutually plausible in the first core 11 is also recognized as the plausible information in the core 12, which can be determined by a comparison 45, the vehicle module 2 is actuated via the control interface 21 with the mutually plausible information.

Should the result of the comparison 45 be that the information found in the first core 11 to be mutually plausible should deviate from the information found to be plausible in the second core 12, the third core 13 will detect a hardware and / or software error.

2 shows an exemplary embodiment of a control device 3 according to the invention. The control device 3 is used to connect a power processor 50 with a security process. sor 10 via the information interface 20, which is arranged between the power processor 50 and the security processor 10, brought together.

The power processor has a detection device 51 and an evaluation device 52. The detection device 51 has a redundant power supply 14. In the detection device, a first signal 53, a second signal 54 and a third signal 55 are collected. The signals 53, 54 and 55 may be, for example, signals from environment detection sensors. For example, the first signal 53 may be a signal from a camera sensor, the second signal 54 may be the signal from a radar sensor, and the third signal 55 may be a signal from a lidar sensor.

The signals 53, 54 and 55 are detected and processed in separate channels of the power processor, namely a first channel 56, a second channel 57 and a third channel 58.

In the evaluation device 52 corresponding information 31, 32, 33 are generated from the signals 53, 54 and 55, which arrive via the information interface 20 in the security processor 1. The information from, for example, a camera signal 53 is then a corresponding camera image. Depending on the camera used, the camera image may be an apron image, a rear field image or a side field image of a vehicle.

The evaluation device 52 has an artificial intelligence. Artificial intelligence is an artificial neural network that is trained to recognize traffic situations.

The function of the power processor 50 is controlled by a watchdog 15.

As a power processor 50 in particular a high-performance processor is used. The chip on which the power processor 50 is implemented is also called a performance or power chip. As a security processor, a processor with less power can be used. FIG. 3 shows an exemplary embodiment of a driver assistance method 5 according to the invention that can be executed with a driver assistance system 4. The signals 53, 54 and 55 are first detected by means of the detection device 51 in the method step 60 of the detection. Subsequently, the evaluation 61 of the signals 53, 54 and 55 takes place in the evaluation device 52. The detection 60 and the evaluation 61 of the signals 53, 54 and 55 for the information 31, 32 and 33 takes place in the power processor 50.

The evaluated information 31, 32 and 33 are sent via the information interface in the method step 62 of forwarding the information in the security processor 10.

The following method steps take place in the security processor 10: The execution of the first plausibility check 30 takes place in the first core 11.

Execution 64 of the second plausibility check 40 is carried out in the second core 12. The results of the first plausibility check 30 carried out on the first core 1 1 and the results of the second plausibility check 40 carried out on the second core 12 are forwarded to the third in the method step 65 Core 13 of the security processor headed. A comparison 66 of the results of the plausibility checks 30 and 40 is carried out in the third core 13 of the security processor 10. Subsequently, the information is forwarded 67 for which a plausibility has been determined in the first plausibility check 30 and in the second plausibility check 40 Control interface 22 to the vehicle module 2, wherein the vehicle module 2 is controlled in the method step 68 of the control with the information determined to be plausible.

In the context of the invention, the activation of a vehicle module can take place in such a way that the activation is perceptible in a haptic manner. For example, a steering wheel can be controlled in a detected non-compliance of a traffic lane so that the steering wheel vibrates, what the driver perceives with his sense of touch. The control can also be done visually or acoustically or via actuators, in particular mechatronic actuators. Reference device

vehicle module

control unit

Driver assistance system

Driver assistance process

security processor

first core

second core

third core

power supply

monitoring device

Information interface

Control Interface

first plausibility check

first information

second information

third information

second plausibility check

comparison

performance processor

detector

evaluation

first signal

second signa

third signal

first channel

second channel

third channel

To capture

Evaluate

Forward information Execute first plausibility check Execute second plausibility check Forward

to compare

Forwarding plausible information

Claims

claims

A device (1) for driving a vehicle module (2) comprising a security processor (10) having at least one information interface (20) at an input of the security processor (10) and a control interface (21) at an output of the security processor (10) the security processor (10) has at least a first core (11), a second core (12) and a third core (13), with the further features that

a. the first core (11) is embodied, a first plausibility check (30) of at least one first information (31) directed via the information interface (20) to the security processor (10) with at least one via the information interface (20) to the security processor (10). directed second information

(32) execute;

b. the second core (12) is adapted to execute a second plausibility check (40) of the first information (31) with the second information (32);

c. the third core (13) is adapted to compare (45) a result of the first plausibility check (30) carried out on the first core (11) to the third core (13) with a result forwarded to the third core (13) execute the second plausibility check (40) carried out on the second core (12) and send the information (31, 32), for which a plausibility has been determined in the first plausibility check (30) and in the second plausibility check (40), to the control interface (22 ), wherein the vehicle module (2) with the information (31, 32) determined to be plausible can be activated via the control interface (22).

2. Device (1) according to claim 1, characterized in that

the first core (11) is formed, the first plausibility check (40) for the first information (31), the second information (32) and at least one third information supplied to the security processor (10) via the information interface (20)

(33), wherein the first information (31), the second information (32) and the third information (33) are mutually plausibility-controllable.

3. Device (1) according to one of the preceding claims, characterized in that the second core (11) is formed, the second plausibility check (40) for the first information (31), the second information (32) and at least one safety processor (10) via the information interface (20) supplied to perform third information (33), wherein the first information (31), the second information (32) and the third information (33) are each mutually plausibility controllable.

Device (1) according to claim 2 and / or claim 3, characterized in that the result of the first plausibility check (30) carried out on the first core (11) and / or the result of the second executed on the second core (12) Plausibility check (40) is a majority selection of the information (31, 32, 33) with a majority plausibility.

5. Device (1) according to one of the preceding claims, characterized in that the safety processor (10), in particular in each case the first core (11), the second core (12) and the third core (13), a redundant power supply (14 ) having.

6. Device (1) according to one of the preceding claims, characterized in that the safety processor (10), in particular in each case the first core (11), the second core (12) and the third core (13), a monitoring device (15). having.

7. Device (1) according to one of the preceding claims, characterized in that the information interface (20) is a redundant information interface (20).

A control module (3) for a vehicle module (2) comprising a device (1) according to any one of the preceding claims and a power processor (50), the information interface (20) of the device (1) between the power processor (50) and the security processor (10) is arranged, with the features that a. the power processor (50) comprises a detection device (51) and an evaluation device (52);

b. the detection means (51) is adapted to detect at least a first signal (53) and a second signal (54);

c. the evaluation device (52) is designed to generate first information (31) at least from the first signal (53) and second information (32) from the second signal (54), and

d. at least the first information (31) generated from the first signal (53) and the second information (32) generated from the second signal (54) can be conducted to the security processor by means of the information interface (20) for activating the vehicle module (2).

9. Control unit (3) according to claim 8, characterized in that the power processor (50) has at least a first channel (56) and a second channel (57) separated from the first channel (56), wherein in the first channel (56 ) the first signal (53) can be detected and from the detected first signal, the first information (31) can be generated and wherein in the second channel (57), the second signal (54) detectable and the second information (32) independently of the first information (31) is producible.

10. Control device (3) according to claim 8 or claim 9, characterized in that

the power processor (50), in particular in each case the first channel (56) and the second channel (57) or in each case the detection device (51) and the evaluation device (52), a redundant power supply (14).

11. Control device (3) according to any one of claims 8 to 10, characterized in that the power processor (10), in particular in each case at least the first channel (56) and the second channel (57), a monitoring device (15).

12. Control device (3) according to one of claims 8 to 11, characterized in that the evaluation device (52) has an artificial intelligence.

13. Control device (3) according to one of claims 8 to 12, characterized in that the detection device (51) detected signals (53, 54, 55), the signals (53, 54, 55) of Umfeldfassungssensoren, in particular camera signals (53). , Radar signals (54) and / or lidar signals (55).

14. Control device (3) according to one of claims 8 to 13, characterized in that the vehicle module (2) is a vehicle domain, in particular infotainment, chassis, drive, interior and / or safety.

15. Driver assistance system (4) comprising a control device (3) according to one of claims 8 to 14.

16. Driver assistance method (5), in which a control device (3) having the features according to one of claims 8 to 14 is used, and comprising the following steps:

a. Detecting (60) signals (53, 54, 55) from the environment of a vehicle with the detection means (51) of the power processor (50);

b. Evaluating (61) the signals (53, 54, 55) and generating information (31, 32, 33) from the signals (53, 54, 55) in separate channels (56, 57, 58) of the power processor (50) by means of the evaluation device (52);

c. Forwarding (62) the information (31, 32, 33) to the security processor (10) via the information interface (20);

d. Executing (63) the first plausibility check (30) of each of the information (31, 32, 33) with each of the other information (31, 32, 33) on the first core (11) of the security processor (10), wherein a majority vote of the Information (31, 32, 33) that is mostly plausible with the other information (31, 32, 33);

e. Executing (64) the second plausibility check (40) of each of the information (31, 32, 33) with each of the other information (31, 32, 33) on the second core (12) of the security processor (10), wherein a majority vote of the Information (31, 32, 33) that is mostly plausible with the other information (31, 32, 33); f. Forwarding (65) the result of the first plausibility check (30) carried out on the first core (11) and the result of the second plausibility check (40) carried out on the second core (11) to the third core (13) of the security processor (10);

G. Comparing (66) the results of the first plausibility check (30) and the second plausibility check (40) on the third core (13);

H. Forwarding (67) the information (31, 32) for which a plausibility has been determined in the first plausibility check (30) and in the second plausibility check (40) to the control interface (21), and

i. Driving (68) of the vehicle module (2) with the information determined to be plausible (31, 32).