Method for redundant monitoring of driving functions

A vehicle system of an automatedly driving motor vehicle, the system being configured for redundant monitoring of a driving function of the automatedly driving motor vehicle, the vehicle system comprising:

• a first control system including a first control unit, a first actual-value sensor, and a first controller, wherein the first control system is configured such that, during operation of the vehicle system, the first control unit performs a control, the control being:
• the first control unit controlling the first controller with control values, selected by the first control unit based on ascertained first actual values of the first actual-value sensor representing a first characterization of an operating state of the motor vehicle and control specification values representing a target vehicle state, to influence a drive operation of the motor vehicle to transition the vehicle to the target vehicle state from the operating state as characterized by the first characterization;
• and
• a redundant second control system including a second control unit, a second actual-value sensor, and a second controller, the second controller being:
• controllable by the second control unit using control values ascertained based on ascertained second actual values of the second actual-value sensor representing a second characterization of the operating state of the motor vehicle and the control specification values to influence the drive operation of the motor vehicle to transition the vehicle from the operating state as characterized by the second characterization to the target vehicle state, as the target vehicle state is ascertained by the second control system from the control specification values;
• wherein the redundant second control system is configured to:
• after the first control unit has performed the control of the first controller, measure, using the second actual-value sensor, a further set of the second actual values representing a third characterization of the operating state of the motor vehicle;
• compare a third characterization of the operating state of the motor vehicle to the target vehicle state as ascertained by the second control system from the control specification values, thereby determining a deviation between the third characterization of the operating state and the target vehicle state as ascertained by the second control system from the control specification values;
• and
• ascertain a defect in the first control system when the deviation is above a specified limit value.