Method and apparatus for computing a data model in a safety-critical system

Abstract

The invention relates to a device for calculating a data model, in particular with a possibility for identifying errors occurring during the calculation, the device having at least two calculation units (102, 104), wherein at least one of the at least two calculation units (102, 104) is configured to calculate a master data model as a function of at least one state of a system, wherein at least one other of the at least two calculation units (102, 104) is configured to calculate an approximate data model belonging to the master data model as a function of at least one state of the system, wherein the master data model comprises at least one characteristic of the system as a first data model, wherein the approximate data model comprises at least one identical characteristic of the system approximately as a second data model.

Description

Technical Field

[0001] The invention relates to a method and a device for calculating a data model, in particular with the possibility of detecting errors occurring during calculations in safety-critical systems. Background Art

[0002] In safety-critical systems, such as in automobiles, it is important to detect the occurrence of safety-related errors in order to be able to respond with a corresponding error response. For example, a response to an error detection can result in shutting down the system.

[0003] In digital hardware circuits, transient errors, ie temporary errors such as single bit errors, or permanent errors, ie long-lasting errors, may occur.

[0004] According to safety requirements, errors must be identified with a certain probability and processed accordingly so that these identified errors do not affect safety-critical systems. In the automotive field, the Automotive Safety Integrity Level (ASIL) describes these requirements.

[0005] For example, the same algorithm can be calculated on two different digital computing units of the same type to detect errors. This has the disadvantage of doubling the hardware expenditure, ie the silicon area and correspondingly higher costs.

[0006] Data-based models describe the properties of a physical system by observing and measuring the properties of the system in a preliminary step. In this process, a relationship between input data and output properties is established. This information is stored, for example, as a characteristic field (Kennfeld) and can be called up during the operation of the safety-critical system.

[0007] In this regard, DE 10 2013 212 842 A1 discloses a controller in which a model calculation unit calculates a data-based function model and relieves the main calculation unit of the load.

[0008] Redundant calculation of the data-based model can be used to detect errors in the digital circuits when calculating the data-based model in safety-critical systems. The calculations required for this require a great deal of hardware effort.

[0009] Certain types of data models can be divided for calculation into partial data models, which can then be combined again to form an overall model. Such partial data models are also referred to below as data models. The comparison of calculations of these data models, which will also be described below, also always includes the results of the data models, partial data models and completely or partially combined partial data models.

[0010] When calculating data-based models in safety-critical systems, error detection is desirable which can be implemented with significantly lower hardware complexity than a completely redundant calculation. Summary of the invention

[0011] This is achieved by means of a device and a method according to the independent claims.

[0012] A device for calculating a data model, in particular with the possibility of detecting errors occurring during the calculation, comprising at least two calculation units, wherein at least one of the at least two calculation units is designed to calculate a master data model as a function of at least one state of a system, wherein at least another of the at least two calculation units is designed to calculate an approximate data model belonging to the master data model as a function of at least one state of the system, wherein the master data model comprises at least one property of the system as a first data model, wherein the approximate data model comprises at least one identical property of the system approximately as a second data model, wherein a comparison unit is designed to carry out the following method: comparing a first result of a first calculation of the master data model with a second result of a second calculation of an approximate data model belonging to the master data model, determining information about a deviation of the first result and the second result from one another, and detecting an error based on the information about the deviation if the deviation exceeds a maximum permissible deviation. Redundant hardware formed by the at least two calculation units and the comparison unit makes it possible to detect permanent and transient errors. In this case, the approximate calculation requires less effort and the hardware effort can be reduced compared to conventional redundant systems.

[0013] Advantageously, the device has a control unit which is designed to calculate a first calculation of the master data model on a respective one of the at least two calculation units and to calculate a second calculation of an approximate data model belonging to the master data model on a respective other of the at least two calculation units. The master data model and the associated approximate data model are thus preferably calculated on different calculation units, thereby satisfying increased redundancy requirements.

[0014] In an advantageous embodiment, at least one of the at least two computing units can be designed such that it primarily calculates the main data model and at least one other of the at least two computing units primarily calculates the approximate data model. The control unit is advantageously designed to distribute the main data model primarily to the more powerful computing units and to distribute the associated approximate data models to the less powerful computing units. Depending on the reduced complexity of the approximate data model relative to the main data model, the computing unit for calculating the approximate data model is, for example, significantly less powerful than the computing unit for calculating the main data model, whereby the silicon area required by it is, for example, significantly less.

[0015] In another advantageous embodiment, at least two computing units can be designed in such a way that their computing performance is similar or identical, so that they can each calculate a main data model and an approximate data model. In a supplementary solution to this embodiment, the control unit is designed to sequentially insert parts of a second calculation of the approximate data model between the first calculation of the main data model on each of the at least two computing units, wherein the main data model and the associated approximate data model are each calculated on preferably different computing units. As a result, the complete computing power for calculating the main data model is no longer available, but is reduced. The reduction in computing power depends on the model reduction of the approximate data model relative to the main data model. In the case of a high model reduction, the additional computing effort is relatively low.

[0016] Advantageously, a microprocessor or microcontroller (hereinafter assumed to be equivalent) comprises at least two computing units, a comparison unit and, if applicable, a control unit. This provides an integrated solution.

[0017] In an alternative advantageous embodiment, each of the at least two computing units is arranged on a different microprocessor. A comparison unit designed to compare the first result and the second result and to determine the information about the deviation can be arranged on one of the different microprocessors within or outside one of the computing units. Alternatively, the comparison unit can be arranged on a separate microprocessor or on another external component.

[0018] In an advantageous additional embodiment, at least two calculation units are designed to determine the maximum permissible deviation as a function of the state of the system by calculating a deviation data model, which assigns the maximum permissible deviation between the main data model and the approximation data model to the state of the system. This makes it possible to take into account not only fixed maximum deviation values ​​for all input data of the model, but also maximum deviation values ​​graded as a function of the state of the system, which are generally lower than the highest maximum deviation value, when making the comparison in the comparison unit.

[0019] In a method for calculating a data model, in particular with the possibility of identifying errors occurring during the calculation, a master data model is calculated on at least one of the at least two calculation units as a function of at least one state of the system, wherein an approximate data model belonging to the master data model is calculated on at least one other of the at least two calculation units as a function of at least one state of the system, wherein the master data model comprises at least one property of the system as a first data model, wherein the approximate data model comprises at least one identical property of the system approximately as a second data model, wherein a first result of a first calculation of the master data model is compared with a second result of a second calculation of the associated approximate data model in order to determine information about a deviation of the first result and the second result from one another, wherein an error is identified based on the information about the deviation if the deviation exceeds a maximum permissible deviation. This makes it possible to identify permanent and transient errors with reduced hardware expenditure.

[0020] The main data model and the respectively associated approximate data model are preferably calculated on different computing units. This satisfies the increased redundancy requirements for detecting transient and permanent errors.

[0021] When computing units of different performance strengths are used, preferably, the first calculation of the main data model is mainly performed on the computing unit with stronger performance among the at least two computing units, and the second calculation of the approximate data model is mainly performed on the computing unit with weaker performance among the at least two computing units. As a result, the execution time of the main data model on the computing unit with stronger performance is similar to the execution time of the approximate data model on the computing unit with weaker performance. Due to the reduced complexity of the approximate data model compared to the main data model, the silicon area of ​​the computing unit with weaker performance can be significantly smaller than that of the computing unit with stronger performance.

[0022] When using computing units of similar or identical performance strength, the first calculation of the main data model is preferably distributed to at least two computing units, and the second calculation of the approximate data model is inserted between the first calculation of the main data model, wherein the corresponding main data model and the associated approximate data model are preferably calculated on different computing units. As a result, it is no longer possible to use the entire computing capacity of the at least two computing units for calculating the main data model, but rather it is reduced. The reduction in computing capacity depends on the model reduction of the approximate data model compared to the main data model. In particular, in the case of a high model reduction, the additional computing effort is relatively low. Thus, the increased redundancy requirements are met with only a slight reduction in the computing capacity of the computing units.

[0023] Preferably, the maximum permissible deviation is determined according to the state of the system by calculating a deviation data model, which assigns the maximum permissible deviation between the main data model and the associated approximation data model to the state of the system. Thus, maximum deviation values ​​graded according to the state of the system can be predefined. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Other advantageous designs will become apparent from the following description and accompanying drawings.

[0025] In the accompanying drawings:

[0026] Figure 1 schematically shows the components of a microcontroller device;

[0027] Figure 2 The steps of a basic method for error identification are schematically shown;

[0028] Figure 3 The steps of a method for error detection using two computing units, the computing power of which is similar or identical, are schematically shown. DETAILED DESCRIPTION

[0029] Figure 1 Components of a microcontroller device 100 as part of a device for error detection are shown schematically.

[0030] The device has at least two computing units. In this example, the device has a first computing unit 102 and a second computing unit 104. More than two computing units may also be provided.

[0031] At least one of the at least two computing units is configured to calculate a master data model as a function of at least one state of the system. At least another of the at least two computing units is configured to calculate an associated approximate data model as a function of at least one state of the system.

[0032] In this example, the system is a physical system. In this example, the state is mapped in the form of input data for a main data model and an associated approximate data model.

[0033] The main data model and the associated approximate data model are data-based models that map the characteristics of the physical system by observing and measuring the characteristics of the system in the preceding step. In this case, a relationship between the input data and the output characteristics is established. This information is stored, for example, as one or more characteristic fields and can be called up during operation. It is achievable here that the characteristic fields can be stored directly or in compressed form. In the direct form, the data can be read directly during operation, and the intermediate values ​​are obtained, for example, by interpolation. In contrast, the compressed form requires calculation rules for decompression, i.e., calculation of the model. The compressed model is, for example, a Gaussian process, in which the characteristic field can be represented by a multi-dimensional Gaussian curve. Similarly, for example, a neural network is also a model. The compressed model data, also called grid points (Stützstellen), is usually calculated in advance, i.e. outside the controller, with the aid of a suitable program.

[0034] The system input data and model data required for calculating the main data model and the associated approximate data model can be stored in separate or identical memories. The memory can be implemented, for example, as a register or a RAM (random access memory). The input data can be provided to at least two computing units and / or read in independently by them.

[0035] The master data model includes at least one characteristic of the system as a first data model. The associated approximate data model includes at least one identical characteristic of the system approximately as a second data model. For example, these characteristics are operating points of devices in the system.

[0036] This means that the approximate data model is an approximation of the main data model. The model accuracy is therefore reduced compared to the main data model. Depending on the model type, model data, input data, etc., a significant reduction of the approximate data model compared to the main data model is possible, for example it can be up to a factor of 10, in some cases also significantly more. Depending on the model reduction, a reduced computational effort is achieved compared to a complete double calculation of the main data model.

[0037] The calculation formulas of the two models can be completely identical to the greatest extent. Therefore, a calculation unit that can calculate the main data model can also calculate the approximate data model. The basic structure of the algorithm used for this can remain essentially unchanged. Therefore, there are no alternative algorithms, that is, no alternative calculation models or alternative formulas are given. This reduces the development effort, because only two models with different precision but the same algorithm need to be calculated.

[0038] When two computing units of different performance strengths are arranged, only small additional hardware circuits in the form of the less powerful computing unit and a comparison unit for calculating the approximate data model in the microcontroller arrangement are required for redundant calculations.

[0039] When two computing units of similar or identical performance strength are arranged, only a comparison unit in the microcontroller device is required as an additional hardware circuit for redundant calculations. Therefore, only components whose computing power is already available are used. Therefore, it is not necessary to develop special replacement hardware. With the same algorithm, inaccuracies only occur due to the simplified approximate data model.

[0040] The comparison unit is configured to compare a first result of the first calculation of the master data model with a second result of the second calculation of the approximation data model in order to determine information about a deviation of the first result and the second result from each other, wherein the comparison unit is configured to identify an error based on the information about the deviation when the deviation exceeds a maximum permissible deviation. For example, the result is a state that the system achieves based on the characteristics and the input data according to the corresponding model.

[0041] The device has a control unit 106. In this example, the device includes an interrupt controller of a microprocessor device, hereinafter referred to as an interrupt control unit 109. For reasons of clarity, the control lines for the control unit 106 and for the interrupt control unit 109 to the computing unit are not shown graphically. In this example, the control unit 106 and the interrupt control unit 109 are different units. The control unit 106 is configured to distribute the main data model and the approximate data model. For example, the control unit 106 can be a separate unit or a software component in one of the microprocessors.

[0042] One of the microprocessors may include a comparison unit 108, which is designed to compare the first result with the second result and determine information about the deviation. The comparison unit 108 identifies an error based on the information about the deviation. In the figure, the comparison unit 108 is arranged outside the at least two calculation units, but can also be logically assigned to it as an alternative.

[0043] The microprocessor device may also include an error recognition unit 110 which recognizes or displays the type of error. If an error is indicated by the comparison unit 108, the error recognition unit 110 may react with a specific error response.

[0044] Comparison unit 108 detects, for example, an error, interrupt control unit 109 sends an interrupt when an error is detected, and / or error detection unit 110 reacts.

[0045] The state of the system is transmitted as input data to the first computing unit 102, for example, via a first data line 112, and to the second computing unit 104 via a second data line 114. A first result is transmitted from the first computing unit 102 to the comparison unit 108, for example, via a third data line 116. A second result is transmitted from the second computing unit 104 to the comparison unit 108, for example, via a fourth data line 118.

[0046] A fifth data line 120 connects comparison unit 108 to control unit 106 , interruption control unit 109 and / or error detection unit 110 .

[0047] In this example, a plurality of computing cores 124, a volatile memory 126 (e.g., a random access memory), and a non-volatile memory 128 are connected to a first data line 112 and a second data line 114 via a data bus 122. These data lines may also be part of the data bus. The non-volatile memory 128 contains, for example, model parameters for a primary data model and an approximate data model. The non-volatile memory 128 is, for example, a flash memory or other non-volatile random access memory.

[0048] Control unit 106 may be designed to calculate at least one master data model primarily on a first computing unit, for example 102 , and to calculate at least one associated approximate data model on another computing unit, primarily a second computing unit, for example 104 .

[0049] Compared to the first computing unit 102 with the first hardware, the second computing unit 104 with the second hardware can be limited in performance capabilities and / or also in computational precision, for example, in terms of supported data types, in terms of data width of the data to be processed, or by a limited instruction set. The second maximum data width is, for example, smaller than the first maximum data width. For example, 16 bits are used instead of 32 bits. For example, the second instruction set is reduced relative to the first instruction set. For example, the second data type is a fixed point relative to a floating point of the first maximum data type. For example, the implemented second operation can be an approximation of a complex function such as an exponential function and a trigonometric function, or can be read from a table, while the implemented first operation performs the calculation accurately.

[0050] Alternatively, the control unit 106 can be configured to perform the calculation of the master data model on at least two of the at least two calculation units 102, 104, respectively, and to perform the calculation of the approximate data model belonging to the corresponding master data model on the corresponding calculation unit, which is different from the calculation unit that calculates the master data model. The control unit can also be configured to sequentially insert a part of the second calculation of the approximate data model into the first calculation and / or between successive calculations of the master data model by at least one of the at least two calculation units. For example, the first, second and third master data models are calculated. The first and third master data models are calculated in the first calculation unit 102. For example, the second master data model is further calculated in the second calculation unit 104. The first approximate data model belonging to the first master data model is inserted and calculated in the second calculation unit 104, for example, so that the implementation of the second master data model is first interrupted, then the first approximate data model is implemented, and then the implementation of the second master data model is restarted. For example, the second approximate data model belonging to the second master data model is inserted and calculated in the first calculation unit 102 between the first and third master data models without interrupting one of these master data models. As a result, the entire computing capacity of the computing units 102 and 104 is no longer available for computing the master data model, but is reduced. The reduction in computing capacity depends on the model reduction of the approximate data model compared to the master data model. In the case of a high model reduction, the additional computing effort is relatively low.

[0051] The microprocessor may include at least two computing units, namely in this example a first computing unit 102 and a second computing unit 104. These computing units may also be arranged on different microprocessors.

[0052] At least two computing units can be configured to calculate the maximum permissible deviation from a deviation data model as a function of the state of the system, the deviation data model assigning the maximum permissible deviation between the main data model and the approximation data model to the state of the system. In this case, non-volatile memory 128 includes data of the deviation data model.

[0053] This makes it possible to take into account not only fixed maximum deviation values ​​for all input data of the model in the comparison, but also maximum deviation values ​​graded according to the input data, which are usually lower than the largest maximum deviation value. In order to avoid erroneous high deviations in the event of errors in the deviation data model, for example, a fixed maximum value of the deviation data model which must not be exceeded can also be additionally specified.

[0054] Further optimizations can thereby be performed. For example, further model reductions are possible, which require less computing power than a pure combination of a master data model and an approximate data model without a deviation data model. For example, the error deviation can be reduced, which allows for a higher accuracy of error identification than a pure combination of a master data model and an approximate data model without a deviation data model.

[0055] The aforementioned algorithms are stored, for example, as instructions in at least two computing units or are stored completely or partially in the non-volatile memory 128 .

[0056] The following will refer to Figure 2 Describe the basic methods used for error identification.

[0057] In step 202, input data for the main data model are transmitted to the first computing unit 102, and input data for the associated approximate data model are transmitted to the second computing unit 104. Optionally, in step 203, input data for the deviation data model are preferably transmitted to the second computing unit 104.

[0058] Subsequently or in parallel thereto, in step 204, the master data model is read in by first computing unit 102. Subsequently or in parallel thereto, in step 205, the associated approximation data model is read in by second computing unit 104. Optionally, in step 206, the deviation data model is preferably read in by second computing unit 104.

[0059] After step 204 , in step 208 , a first result for the master data model is determined by the first calculation unit 102 .

[0060] After step 205 , in step 209 , a second result for the approximate data model is determined by the second calculation unit 104 .

[0061] Optionally, in step 210 , the second calculation unit 104 determines the deviation currently allowed based on the input data by means of calculation of the deviation data model.

[0062] Optionally, subsequently in step 211 , a maximum permissible deviation is determined from the currently permissible deviation and a predefined limit 212 for the permissible deviation.

[0063] After step 208 and step 209 and optionally after step 211, in step 213, a comparison of the first result for the master data model with the second result for the approximate data model is carried out. In step 213, information about the deviation of the first result and the second result from one another is determined if the deviation exceeds a maximum permissible deviation, and an error is detected based on the information about the deviation. For example, the maximum permissible deviation is predefined as a fixed value. Optionally, the comparison is carried out with the maximum permissible deviation determined in step 211.

[0064] Figure 3 The steps in a second method for applying the basic method by means of two computing units whose computing performance is similar or identical are schematically shown, wherein two master data models and respectively associated approximate data models are calculated.

[0065] In step 302, the first system state is transmitted in the form of first input data for a first master data model to the first computing unit 102 and also in the form of first input data for an associated first approximate data model to the second computing unit 104. Independently of this, for example, at the same time, the second system state is also transmitted in the form of second input data for a second master data model to the second computing unit 104 and the second system state is also transmitted in the form of second input data for an associated second approximate data model to the first computing unit 102.

[0066] Subsequently or in parallel therewith, the first main data model and then the second approximate data model are read by the first computing unit 102 in step 304. For example, it is also possible to first read the second approximate data model and then read the first main data model. For example, it is also possible that after each loading of a main data model or an approximate data model, the subsequent method step 308 must first be completed before the subsequent main data model or approximate data model can be read in step 304.

[0067] Subsequently or in parallel therewith, in step 305, the first approximate data model and then the second main data model are read by the second computing unit 104. For example, it is also possible to first read the second main data model and then read the first approximate data model. For example, it is also possible that after each loading of a main data model or an approximate data model, the subsequent method step 309 must first be completed before the subsequent main data model or approximate data model can be read in step 305.

[0068] After step 304, in step 308, the first result for the first main data model is determined by the first calculation unit 102, and then the second result for the second approximate data model is determined. For example, the second result for the second approximate data model may be determined first, and then the first result for the first main data model may be determined.

[0069] After step 305, in step 309, the first result for the first approximate data model is determined by the second calculation unit 104, and then the second result for the second main data model is determined. For example, the second result for the second main data model may also be determined first, and then the first result for the first approximate data model may be determined.

[0070] After step 308 and step 309, a comparison is performed in step 313. In step 313, information about the deviation of the first results of the respective calculations of the first master data model and the first approximate data model from one another is determined, and then information about the deviation of the second results of the respective calculations of the second master data model and the second approximate data model from one another is determined, and if the deviation exceeds a maximum permissible deviation, an error is detected based on the information about the deviation. For example, the maximum permissible deviation is predefined as a fixed value.

Claims

1. A device for calculating a data model, which has a possibility for detecting errors occurring during the calculation, the device having at least two calculation units (102, 104), wherein: At least one of the at least two calculation units (102, 104) is configured to calculate a master data model based on at least one state of the system, wherein at least another of the at least two calculation units (102, 104) is configured to calculate an approximate data model belonging to the master data model based on at least one state of the system, wherein the master data model includes at least one characteristic of the system as a first data model, wherein the approximate data model includes at least one same characteristic of the system approximately as a second data model, wherein a comparison unit (108) is configured to implement the following method: compare a first result of a first calculation of the master data model with a second result of a second calculation of the approximate data model belonging to the master data model, determine information about a deviation of the first result and the second result from each other, and if the deviation exceeds a maximum permissible deviation, identify an error based on the information about the deviation.

2. The device for calculating a data model according to claim 1, characterized in that: The device has a control unit (106) which is configured to calculate a first calculation of the master data model on a respective one of the at least two calculation units (102, 104) and to calculate a second calculation of an approximate data model belonging to the master data model on a respective other one of the at least two calculation units.

3. The device for calculating a data model according to claim 1 or 2, characterized in that: At least one of the at least two computing units (102, 104) is designed such that it calculates the master data model and at least one other of the at least two computing units (102, 104) calculates the approximate data model.

4. The device for calculating a data model according to claim 2, characterized in that: The control unit (106) is designed to distribute the main data model to the more powerful computing unit (102) and to distribute the associated approximate data model to the less powerful computing unit (104).

5. The device for calculating a data model according to any one of claims 1 to 2, characterized in that: At least two computing units (102, 104) are constructed such that their computing performance is similar or identical, so that they can respectively calculate a main data model and an approximate data model.

6. The device for calculating a data model according to claim 2, characterized in that: The microprocessor or microcontroller comprises the at least two calculation units (102, 104), the comparison unit (108), and the control unit (106).

7. The device for calculating a data model according to claim 1 or 2, characterized in that: Each of the at least two computing units (102, 104) is arranged on a different microprocessor or microcontroller.

8. The device for calculating a data model according to claim 7, characterized in that: The comparison unit (108) is designed to compare the first result with the second result and to determine information about the deviation, and the comparison unit is arranged on one of the different microprocessors or microcontrollers, inside or outside one of the calculation units, or the comparison unit (108) is alternatively arranged on a separate microprocessor or microcontroller, or on another external component.

9. The device for calculating a data model according to claim 1 or 2, characterized in that: The at least two computing units (102, 104) are designed to determine the maximum permissible deviation as a function of the state of the system by calculating a deviation data model which assigns a maximum permissible deviation between a main data model and an approximation data model to the state of the system.

10. A method for calculating a data model, which has a possibility for identifying errors occurring during the calculation, wherein a master data model (208, 308) is calculated on at least one of the at least two calculation units, depending on at least one state of the system, wherein an approximate data model (209, 309) belonging to the master data model is calculated on at least one other of the at least two calculation units, depending on at least one state of the system, wherein The master data model comprises at least one characteristic of the system as a first data model, wherein the approximate data model comprises at least one identical characteristic of the system approximately as a second data model, wherein a first result of a first calculation of the master data model is compared (213, 313) with a second result of a second calculation of the associated approximate data model to determine information about a deviation of the first result and the second result from one another, wherein an error is identified based on the information about the deviation if the deviation exceeds a maximum permissible deviation (213, 313).

11. The method for calculating a data model according to claim 10, characterized in that: The master data model and the respectively associated approximate data model are calculated on mutually different computing units (102, 104).

12. The method for calculating a data model according to claim 10 or 11, characterized in that: When computing units (102, 104) of different performance strengths are used, a first calculation of the main data model is performed on a computing unit with stronger performance among the at least two computing units (102, 104) and a second calculation of the approximate data model is performed on a computing unit with weaker performance among the at least two computing units (102, 104).

13. The method for calculating a data model according to claim 10 or 11, characterized in that: When computing units (102, 104) of equal performance strength are used, a first calculation of the main data model is distributed to the at least two computing units (102, 104) and a second calculation of the approximate data model is inserted between the first calculation of the main data model, wherein the respective main data model and the associated approximate data model are calculated on different computing units (102, 104).

14. The method for calculating a data model according to claim 10 or 11, characterized in that: Depending on the state of the system, the maximum permissible deviation is determined by calculating a deviation data model which assigns a maximum permissible deviation between a main data model and an associated approximation data model to the state of the system.

15. A computer program product, characterized in that The computer program product comprises instructions which, when executed on a computer, carry out the method according to any one of claims 10 to 14 .

Images