Method and device for operating a drive system for a motor vehicle including an acceleration monitoring system

1. A method of operating an engine of a motor vehicle, the method comprising:

obtaining, by processing circuitry, inputs identifying whether a braking request is present and identifying driver-input drive requests;

cyclically performing, by the processing circuitry, an acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle, wherein the acceleration monitoring is performed by executing an algorithm that:

defines to determine whether the unintentional acceleration is present using a primary check based on signals of a first sensor that indicates a longitudinal acceleration of the vehicle when no fault is detected in the first sensor and its output signals, and without using a secondary check;

defines to determine whether the unintentional acceleration is present using the secondary check based on signals of a second sensor in response to satisfaction of a first condition that (a) a fault is detected in the first sensor or its output signals and (b) the inputs indicate that the braking request is present;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a second condition that (a) the fault is detected in the first sensor or its output signals and (b) the inputs indicate that an identified driver-input drive request is below a predefined threshold value;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a third condition that (a) the fault is detected in the first sensor or its output signals and (b) an unintentional acceleration is indicated to be present by the primary check using a substitute vehicle longitudinal acceleration value that is obtained by reconstructing the longitudinal acceleration of the vehicle using a signal of a third sensor; and

defines that the unintentional acceleration is not present, independent of the secondary check, in response to a combination of (a) the fault being detected in the first sensor or its output signals, (b) no braking request being indicated to be present by the inputs, (c) the identified driver-input drive request not being below the predefined threshold value, and (d) the unintentional acceleration being indicated not to be present by a result of the primary check using the substitute vehicle longitudinal acceleration value; and

modifying, by the processing circuitry, an operation of the engine in response to a result of the acceleration monitoring being that the unintentional acceleration is present.

2. The method as recited in claim 1 , wherein the secondary check is not performed when there is a combination of conditions that (a) a result of the primary check using the substitute signal is obtained without detection of the unintentional acceleration, the driver-input drive request is not below the predefined threshold value, and the braking request is not present.

3. The method as recited in claim 1 , wherein the secondary check includes comparing a speed of the engine to a value which is dependent on driver input.

4. The method as recited in claim 1 , wherein the secondary check includes comparing of a torque of the engine to a value which is dependent on driver input.

5. The method as recited in claim 1 , wherein the third sensor is a wheel speed sensor on a primary or secondary axle.

6. A drive system of a motor vehicle, the drive system comprising:

a first sensor, output signals of which indicate a longitudinal acceleration of the vehicle;

a second sensor;

a third sensor;

an engine; and

processing circuitry;

wherein:

the processing circuitry is configured to obtain inputs identifying whether a braking request is present and identifying driver-input drive requests;

the processing circuitry is configured to cyclically perform an acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle;

the acceleration monitoring is performed by executing an algorithm that:

defines to determine whether the unintentional acceleration is present using a primary check based on signals of the first sensor when no fault is detected in the first sensor and its output signals, and without using a secondary check;

defines to determine whether the unintentional acceleration is present using the secondary check based on signals of the second sensor in response to satisfaction of a first condition that (a) a fault is detected in the first sensor or its output signals and (b) the inputs indicate that the braking request is present;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a second condition that (a) the fault is detected in the first sensor or its output signals and (b) the inputs indicate that an identified driver-input drive request is below a predefined threshold value;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a third condition that (a) the fault is detected in the first sensor or its output signals and (b) an unintentional acceleration is indicated to be present by the primary check using a substitute vehicle longitudinal acceleration value that is obtained by reconstructing the longitudinal acceleration of the vehicle using a signal of the third sensor; and

defines that the unintentional acceleration is not present, independent of the secondary check, in response to a combination of (a) the fault being detected in the first sensor or its output signals, (b) no braking request being indicated to be present by the inputs, (c) the identified driver-input drive request not being below the predefined threshold value, and (d) the unintentional acceleration being indicated not to be present by a result of the primary check using the substitute vehicle longitudinal acceleration value; and

the processing circuitry is configured to modify an operation of the engine in response to a result of the acceleration monitoring being that the unintentional acceleration is present.

7. A non-transitory computer-readable medium on which are stored instructions that (1) are executable by a processor of a motor vehicle that includes an engine, a first sensor that outputs signals that indicate a longitudinal acceleration of the vehicle, a second sensor, and a third sensor, and (2) when executed by the processor, cause the processor to perform a method of operating the engine of the motor vehicle, the method comprising:

obtaining inputs identifying whether a braking request is present and identifying driver-input drive requests;

cyclically performing an acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle, wherein the acceleration monitoring is performed by executing an algorithm that:

defines to determine whether the unintentional acceleration is present using a primary check based on signals of the first sensor when no fault is detected in the first sensor and its output signals, and without using a secondary check;

defines to determine whether the unintentional acceleration is present using the secondary check based on signals of the second sensor in response to satisfaction of a first condition that (a) a fault is detected in the first sensor or its output signals and (b) the inputs indicate that the braking request is present;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a second condition that (a) the fault is detected in the first sensor or its output signals and (b) the inputs indicate that an identified driver-input drive request is below a predefined threshold value;

defines to determine whether the unintentional acceleration is present using the secondary check in response to satisfaction of a third condition that (a) the fault is detected in the first sensor or its output signals and (b) an unintentional acceleration is indicated to be present by the primary check using a substitute vehicle longitudinal acceleration value that is obtained by reconstructing the longitudinal acceleration of the vehicle using a signal of the third sensor; and

defines that the unintentional acceleration is not present, independent of the secondary check, in response to a combination of (a) the fault being detected in the first sensor or its output signals, (b) no braking request being indicated to be present by the inputs, (c) the identified driver-input drive request not being below the predefined threshold value, and (d) the unintentional acceleration being indicated not to be present by a result of the primary check using the substitute vehicle longitudinal acceleration value; and

modifying an operation of the engine in response to a result of the acceleration monitoring being that the unintentional acceleration is present.

8. A method of operating an engine of a motor vehicle, the method comprising:

obtaining, by processing circuitry, inputs identifying whether a braking request is present and identifying driver-input drive requests;

cyclically performing, by the processing circuitry and while no fault is detected in a first sensor that indicates a longitudinal acceleration of the vehicle and in its output signals, a primary acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle based on the signals of the first sensor;

upon occurrence of a fault in the first sensor or in its signals:

determining, by the processing circuitry and based on the inputs, that at least one of the braking request is present and a driver-input drive request identified by the inputs is below a predefined threshold value; and

responding to the determination that the at least one of the braking request is present and the driver-input drive request identified by the inputs is below the predefined threshold value by performing, by the processing circuitry, a secondary acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle based on signals of a second sensor; and

modifying, by the processing circuitry, an operation of the engine in response to a result of the secondary acceleration monitoring being that the unintentional acceleration is present, wherein the processing circuitry is configured to also modify the operation of the engine whenever a result of the primary acceleration monitoring, performed while no fault is detected in the first sensor and its output signals, is that the unintentional acceleration is present.

9. A method of operating an engine of a motor vehicle, the method comprising:

cyclically performing, by the processing circuitry and while no fault is detected in a first sensor that indicates a longitudinal acceleration of the vehicle and in its output signals, a primary acceleration monitoring that includes checking whether there is an unintentional acceleration of the motor vehicle based on the signals of the first sensor;

respond to an occurrence of a fault in the first sensor or in its signals by:

continuing, by the processing circuitry, performance of the primary acceleration monitoring using signals of a second sensor, instead of the first sensor, by reconstructing the longitudinal acceleration of the vehicle using the signals of the second sensor;

obtaining, by the processing circuitry, a result of the primary acceleration monitoring using the signals of the second sensor that indicates that the unintentional acceleration of the motor vehicle is present;

in response to the result, performing, by the processing circuitry, a secondary acceleration monitoring that includes checking whether the unintentional acceleration of the motor vehicle is present based on signals of a third sensor; and

in response to a result of the secondary acceleration monitoring indicating that the unintentional acceleration of the motor vehicle is present, modifying, by the processing circuitry, an operation of the engine.