Monitoring concept in a control device

A computing element including three program modules by which a performance of the motor vehicle is influenced, and wherein the computing element generates, by the program modules and dependently on at least one input quantity, at least one quantity for controlling at least one function of the motor vehicle, wherein:

• the first program module is a functional module for functional control of the motor vehicle,
• the second program module is a safety module for checking the functional module,
• the third program module is a monitoring module at least for checking the safety module,
• wherein
• the monitoring module comprises a first monitoring element assigned to a first monitoring unit for monitoring the second program module, and a second monitoring element assigned to a second monitoring unit for monitoring the third program module, the first monitoring unit being independent of the second monitoring unit and being configured by respective and independent state machines to monitor the respective second and third program modules if both state machines are passed through successfully.

A processor with a computing element, the computing element including:

• three program modules by which a performance of the motor vehicle is influenced, and wherein the computing element generates, by the program modules and dependently on at least one input quantity, at least one quantity for controlling at least one function of the motor vehicle, wherein:
• the first program module is a functional module for functional control of the motor vehicle,
• the second program module is a safety module for checking the functional module,
• the third program module is a monitoring module at least for checking the safety module,
• wherein the monitoring module comprises two independent monitoring elements that configure the associated monitoring units, wherein the processor comprises a functional computer and a monitoring computer, and wherein the functional module, the safety module and the monitoring module are executed on the functional computer and the monitoring computer communicates with the functional computer by a dialog method via an interface,
• wherein the functional computer and the monitoring computer are physically independent of each other and the monitoring computer comprises two monitoring units that are independent of each other, and
• wherein for monitoring the proper processing of the program instructions of the functional computer, one check each can be performed in the functional computer by each monitoring unit.