Device for controlling a safety-relevant process, method for testing the functionality of the device, and motor vehicle with the device

A method for testing operability of a device for the control of a safety-relevant process, wherein the device includes a primary control unit, a secondary control unit, wherein the primary and secondary control units are redundant to one another and the secondary control unit carries out functionality of the primary control unit in response to a fault, wherein the control of the safety-relevant process is performed based on analysis of signals generated by at least one sensor, and a communications bus coupling the primary and secondary control units that enables exchange of data between the primary and secondary control units, wherein the at least one sensor is connected to the primary control unit and to the secondary control unit, and wherein the device further comprises respective sensor arrangement isolation circuits associated with each of the primary control unit and the secondary control unit, which, when activated, isolates the associated primary or secondary control unit from the at least one sensor, wherein the method comprises:

• breaking a connection between the primary control unit and the at least one sensor using the sensor arrangement isolation circuit associated therewith;
• the primary control unit notifying the secondary control unit of entry into the test mode via the communications bus;
• making a connection between the secondary control unit and the at least one sensor using the sensor arrangement isolation circuit associated therewith;
• the secondary control unit sending the sensor data via the communications bus to the primary control unit;
• and
• checking, by the primary control unit, checking the correct reception of the sensor data;
• and
• initiating an automated driving function in response to a positive checked result.

A motorized transportation vehicle comprising a device for control of a safety-relevant process, the device including:

• a primary control unit;
• a secondary control unit, wherein the primary and secondary control units are redundant to one another and the secondary control unit carries out functionality of the primary control unit in response to a fault, wherein the control of the safety-relevant process is performed based on analysis of signals generated by at least one sensor;
• a communications bus coupling the primary and secondary control units that enables exchange of data between the primary and secondary control units,
• wherein the at least one sensor is connected to the primary control unit and to the secondary control unit,
• wherein the device further comprises respective sensor arrangement isolation circuits associated with each of the primary control unit and the secondary control unit, which, when activated, isolates the associated primary or secondary control unit from the at least one sensor;
• and
• wherein the safety-relevant process, during a test mode, includes:
• breaking a connection between the primary control unit and the at least one sensor using the sensor arrangement isolation circuit associated therewith;
• the primary control unit notifying the secondary control unit of entry into the test mode via the communications bus;
• making a connection between the secondary control unit and the at least one sensor using the sensor arrangement isolation circuit associated therewith;
• sending, by the secondary control unit, the sensor data via the communications bus to the primary control unit;
• and
• checking, by the primary control unit, the correct reception of the sensor data;
• and
• initiating an automated driving function in response to a positive checked result.