Method for controlling a technical device

Abstract

The invention is in the field of computer technology. The invention describes an architecture of a safety automation system and a method for safely autonomously operating a technical device. The architecture solves the problem that every possible Byzantine error, whether caused by an accidental malfunction of hardware, a design error in software or an intrusion, must be identified and contained, so that no safety-relevant event occurs. The architecture consists of four largely independent subsystems, which are arranged hierarchically and each form an encapsulated fault containment unit. At the top of the hierarchy is the safety subsystem, i.e. the fault-tolerant decision subsystem, which executes simple software on fault-tolerant hardware. The other three subsystems are unsafe because they contain complex software. It is empirically difficult to find all design errors in a complex software system and to prevent intrusions. Due to redundancy and diversity, every error of the unsafe subsystems is masked so that no safety-critical malfunction occurs.

Description

TECHNICAL FIELD

[0001] The invention relates to a method for controlling technical devices, for example technical equipment, such as robots or vehicles, in particular motor vehicles, with a distributed real-time computer system, wherein the real-time computer system

[0002] comprises subsystems, in particular a large number of subsystems, wherein for example the subsystems are arranged hierarchically,

[0003] and wherein the subsystems are synchronized in a global time, for example in such a way that there is a time server, which is preferably outside the hierarchy of the subsystems, wherein the time server periodically sends synchronization messages to each subsystem, for example to the clock of each subsystem, for synchronizing the subsystems or the subsystem clocks to establish a global time, and wherein

[0004] using this global time, a timeline is divided into a series of synchronized time slices.

[0005] The invention furthermore relates to a real-time computer system, in particular a distributed real-time computer system, for controlling technical devices, for example technical equipment, such as robots or vehicles, in particular motor vehicles, wherein the real-time computer system

[0006] comprises subsystems, in particular a large number of subsystems, wherein for example the subsystems are arranged hierarchically,

[0007] and wherein the subsystems are synchronized in a global time, for example in such a way that there is a time server, which is preferably outside the hierarchy of the subsystems, wherein the time server is set up for periodically sending synchronization messages to each subsystem, for example to the clock of each subsystem, for synchronizing the subsystems or the subsystem clocks to establish a global time, and wherein

[0008] using this global time, a timeline is divided into a series of synchronized time slices. BACKGROUND

[0009] The invention is in the field of computer technology. The invention describes a method for safely and autonomously operating technical devices, such as robots or vehicles, in particular motor vehicles, and a safety automation system or an architecture of such a safety automation system. In the literature, a system consisting of a technical device and a real-time computer system for controlling the device is also referred to as a cyber-physical system (CPS).

[0010] Autonomous operation of technical devices, for example technical equipment, such as robots or vehicles, in particular motor vehicles, requires real-time computer systems which observe the environment of the technical device, for example the equipment, with sensors, evaluate the sensor data by means of process models running on the real-time computer system and hand over the calculated setpoint values to actuators which influence the course of the physical process. The environment can be observed, for example, with optical sensors (cameras), laser radars (LIDAR), radar sensors and various other sensors. The evaluation of the sensor data, the data fusion of the sensor data and the creation of the required environment model as well as the planning of trajectories require complex software components with millions of instructions.

[0011] In many cyber-physical systems, for example when autonomously controlling vehicles, an error occurring in the real-time computer system can have serious consequences. Such an error can be triggered by a transient or permanent failure of the hardware of a subsystem or by a defect (design error) in the software. In safety-critical applications the Mean-Time to Fail (MTTF) of catastrophic failures on the system level must be in the order of 10 8 to 10 9 hours.

[0012] However, the erroneous behavior (Fehlverhalten) of a system can also be triggered by an intrusion (Intrusion into the system). When an intrusion (break-in into the system), the intruder (break-in) circumvents the intrusion detection mechanisms and takes over complete control of the system. The intruder can then produce a Byzantine error of a compromised subsystem. "In information technology, an error is called a Byzantine error in which the system behaves arbitrarily" [WikiP] Thus, a Byzantine error is the most malicious error that can occur in a system.

[0013] The architecture of a secure real-time computer system must guarantee that every possible Byzantine error in one of the complex subsystems of the real-time computer system, regardless of whether it is caused by an accidental malfunction of the hardware, a design error in the software or an intrusion, is recognized and mastered (beherrschen) so that no safety-relevant events occur. SUMMARY

[0014] It is the task of the present invention to specify a solution to this problem.

[0015] This task is solved with the method mentioned at the outset by the fact that according to the invention

[0016] ​- each subsystem and, if present, the time server form a fault containment unit on their own, and wherein

[0017] - one of the subsystems is a decision subsystem, a so-called fault-tolerant decision subsystem FTDSS, which is preferably placed in the uppermost level of the hierarchy, wherein the FTDSS is set up to hand over a set of nominal values to actuators in each time slice by means of messages, wherein the fault-tolerant decision subsystem FTDSS is a safety subsystem, i.e. contains simple software, which is executed on fault-tolerant hardware, and wherein

[0018] - at least or exactly three data processing subsystems, a normal processing subsystem NPSS, a monitoring subsystem MSS and a critical event handling subsystem CEHSS, are provided, which are preferably placed on the next lower level of the hierarchy, wherein the at least or exactly three data processing subsystems are set up to detect sensor data of an observed environment with sensors, which observe the environment, and to evaluate the sensor data independently of one another, wherein

[0019] - the environment is observed by the data processing subsystems at the beginning of a time slice, respectively, and calculations are performed during the time slice with sensor data acquired by the observation of the environment at the beginning of the time slice,

[0020] - the normal processing subsystem NPSS is set up to send a set of nominal values for normal operation in messages to the fault-tolerant decision subsystem FTDSS and in messages to the monitoring subsystem MSS in each time slice, preferably at the end of the time slice, and wherein

[0021] - the critical event handling subsystem CEHSS is set up to send in each time slice, preferably at the end of the time slice, in a message a set of setpoints for an abnormal operation to the fault-tolerant decision subsystem FTDSS, and wherein - the fault-tolerant decision subsystem FTDSS is set up to send in each time slice in a message the received two sets of setpoints for the normal operation and the abnormal operation to the monitoring subsystem MSS, and wherein - the monitoring subsystem MSS is set up to perform in each time slice a check whether the set of setpoints for the normal operation the monitoring subsystem has obtained in the message from the normal processing subsystem NPSS is in agreement with an environmental model calculated by the MSS on the basis of sensor data of the MSS and guarantees a safe guidance of the technical device under normal conditions, and the monitoring subsystem MSS is furthermore set up to perform in each time slice a check whether the set of setpoints for the normal operation the monitoring subsystem has obtained in the message from the normal processing subsystem NPSS is identical to the respective set of setpoints sent by the normal processing subsystem NPSS to the monitoring subsystem MSS via the fault-tolerant decision subsystem FTDSS, and

[0022] - if both checks are positive, a correctness indicator, namely correctness indicator-1, is set to the value TRUE, and if one of the two checks is negative or both checks are negative, the correctness indicator-1 is set to the value FALSE and the correctness indicator-1 or the value of the correctness indicator-1 is sent in each time slice in a message to the fault-tolerant decision subsystem FTDSS, and wherein

[0023] - the fault-tolerant decision subsystem FTDSS decides in each time slice as follows: in the case that the correctness indicator-1 has the value TRUE, the set of setpoints for the normal operation is forwarded, for example in a message, to the actuators, in the case that the correctness indicator-1 has the value FALSE or a message with correctness indicator-1 is not expected by the FTDSS, the set of setpoints for the abnormal operation is forwarded, for example in a message, to the actuators, wherein in this case from this point in time onwards in subsequent time slices setpoints for the abnormal operation are forwarded to the actuators until the technical device reaches a safe state.

[0024] Furthermore, this task is solved with the real-time computer system mentioned at the outset, wherein according to the application - each subsystem and, if there is a time server, also the time server forms a respective fault containment unit of its own, and wherein

[0025] - one of the subsystems is a decision subsystem, a so-called fault-tolerant decision subsystem FTDSS, which is preferably placed in the uppermost level of the hierarchy, wherein the FTDSS is set up to hand over a set of target values to actuators in each time slice by means of messages, wherein the fault-tolerant decision subsystem FTDSS is a safety subsystem, i.e. contains simple software, which is executed on fault-tolerant hardware, and wherein

[0026] - at least or exactly three data processing subsystems, namely a normal processing subsystem NPSS, a monitoring subsystem MSS and a critical event handling subsystem CEHSS, are provided, which are preferably placed on the next lower hierarchy level, wherein the at least or exactly three data processing subsystems are set up to detect sensor data of an observed environment with sensors and to evaluate the sensor data independently of one another, wherein the environment is observed by the data processing subsystems at the beginning of a time slice, respectively, and calculations are performed during the time slice with sensor data acquired by the observation of the environment at the beginning of the time slice,

[0027] - the normal processing subsystem NPSS is set up to send a set of target values for normal operation in messages to the fault-tolerant decision subsystem FTDSS and in messages to the monitoring subsystem MSS in each time slice, preferably at the end of the time slice, and wherein

[0028] - the critical event handling subsystem CEHSS is set up to send a set of target values for abnormal operation in messages to the fault-tolerant decision subsystem FTDSS in each time slice, preferably at the end of the time slice, and wherein - the fault-tolerant decision subsystem FTDSS is set up to send the two sets of received target values for the normal operation and the abnormal operation in messages to the monitoring subsystem MSS in each time slice, and wherein - the monitoring subsystem MSS is set up to perform a check in each time slice whether the set of target values for the normal operation which the monitoring subsystem has obtained in the messages from the normal processing subsystem NPSS is in agreement with an environmental model calculated by the MSS on the basis of sensor data of the MSS and to ensure a safe guidance of the technical device under normal conditions, and the monitoring subsystem MSS is furthermore set up to perform a check in each time slice whether the set of target values for the normal operation which the monitoring subsystem has obtained in the messages from the normal processing subsystem NPSS is identical to the corresponding set of target values sent by the normal processing subsystem NPSS to the monitoring subsystem MSS via the fault-tolerant decision subsystem FTDSS, and

[0029] - if both checks are positive, a correctness indicator, namely correctness indicator-1, is set to the value TRUE, and if one of the two checks is negative or both checks are negative, the correctness indicator-1 is set to the value FALSE and the correctness indicator-1 or the value of the correctness indicator-1 is sent in each time slice in a message to the fault-tolerant decision subsystem FTDSS, and wherein

[0030] - the fault-tolerant decision subsystem FTDSS decides in each time slice as follows: in case the correctness indicator-1 has the value TRUE, the set of nominal values for the normal operation, for example in a message, is handed over to the actuators, in case the correctness indicator-1 has the value FALSE or a message with correctness indicator-1 is not expected by the FTDSS, the set of nominal values for the abnormal operation, for example in a message, is forwarded to the actuators, wherein in this case the nominal values for the abnormal operation are forwarded to the actuators in subsequent time slices from this point in time until the technical device reaches a safe state.

[0031] The ISO standard ISO 26262 on functional safety for the development, verification and certification of software in safety-related applications in the automotive industry introduces four ASIL (Automotive Safety Integrity Level) safety levels, namely ASIL A (lowest safety level), ASIL B, ASIL C and ASIL D (highest safety level). ASIL D describes a very expensive software development process which should result in error-free software. The experience of NASA has shown [Dvo09] that it is practically impossible to eliminate all design errors which exist in complex software systems, which are systems with more than 10 000 instructions.

[0032] Therefore, a software system or software which comprises less than 10 000 instructions and which is developed according to ASIL D to eliminate all design errors is called simple software system / simple software. It is assumed that a simple software system / simple software which is developed according to ASIL D is free of design errors.

[0033] If a software system or software is not a simple software system or not simple software, the software system or software is called complex software system or complex software. A complex software system or complex software can contain unrecognised design errors, for example also Byzantine errors as triggered by an intrusion.

[0034] According to the present invention, the real-time computer system disclosed here consists of at least four largely independent subsystems, which are preferably arranged hierarchically and the design of which is diverse This allows subsystems to fail largely independently of each other and to be able to check each other.

[0035] The term "largely independent" The term "fully independent" should be used to express that complete independence would require excluding all factors that could simultaneously affect the subsystem, such as temperature, cosmic radiation that might be triggered by a single-event upset (SEU), delays in accidents, power supply, etc. Since achieving a completely independent subsystem is technically impossible, the term "largely independent" is introduced.

[0036] If a given task requirement is solved by independent development teams using different development tools and different algorithms, then the two redundant software systems are diversified. Diversified software minimizes the probability of software errors occurring simultaneously in both redundant software systems [Avi85].

[0037] Two redundant subsystems are called diverse if the software used in at least one subsystem is diverse. A higher degree of diversity is achieved if the hardware used is also different.

[0038] Furthermore, a fifth subsystem, the time server, exists within the architecture. This fifth subsystem is preferably located outside the hierarchical structure and periodically sends time signals to other subsystems to synchronize their clocks and maintain a global time. When using this global time, the timeline is divided into a series of synchronized time slices. Typically, at the beginning of a time slice, a subsystem observes its surroundings using existing sensors. During the time slice, the scheduled calculations are performed. At the end of the time slice, the results of the calculations are provided to other subsystems via messages.

[0039] The subsystem preferably forms an independent Fault-Containment Unit (FCU) [Kop 12, pp. 136-138]. This is because the direct consequences of all internal fault causes are encapsulated and surface-mounted. If the defined error behavior is given in the output message, then the subsystem is an FCU. Through encapsulation, the two FCUs can be made to fail independently of each other to the greatest extent possible.

[0040] A decision subsystem, preferably located at the topmost level of the hierarchy, is provided, the Fault-Tolerant Decision Subsystem (FTDSS). The FTDSS contains simple software that is executed on fault-tolerant hardware. The fault-tolerant hardware shields against errors occurring in the hardware, as described in [Kop 12, pages 155-157].

[0041] It is preferably provided that, in order to prevent intrusion into the FTDSS via the Internet, the FTDSS has no access (Zugang) to Internet technology. Since in the FTDSS simple software is executed on fault-tolerant hardware, and if access to the Internet is not available, it can be assumed that the FTDSS is a secure subsystem that functions correctly and achieves a required reliability of below 10 -8 Proving such a high reliability requires a strict system development according to ASIL D with support by formal methods, and if the software system is complex, it will practically be almost unexecutable.

[0042] Furthermore, three subsystems are provided, which are preferably located on the next level of the hierarchy:

[0043] • a subsystem that controls the technical device, for example a vehicle, in normal operation - the Normal Processing Subsystem (NPSS). Normal operation exists when all assumptions made in the system design of the NPSS about the functioning of the real-time computer system and its surroundings, i.e. about the mechanical structure of the technical device and the environment in which the technical device is located, are fulfilled. A violation of one of these assumptions is called a critical event. A critical event that is not mastered by the NPSS leads to an abnormal operation.

[0044] • a subsystem that takes over the control of the process, for example a vehicle, in abnormal operation, i.e. after a critical event has occurred that was not mastered by the NPSS, and leads the process (vehicle) to a safe state - the so-called Critical Event Handling Subsystem (CEHSS); and

[0045] • a monitoring subsystem, i.e. a subsystem that monitors the functioning of the NPSS and the CEHSS.

[0046] Each of the three subsystems is encapsulated and autonomous and evaluates sensor data with diverse software. Since each of the three subsystems or the software executed on these subsystems contains far more than 10,000 instructions, the three subsystems are complex. It is assumed that the complex software systems are developed and verified according to ASIL B and that the mean time to failure (MTTF) in operation is at 10 -4 hours.

[0047] The worst case, i.e. a Byzantine error in one of the complex subsystems at any point in time, can be tamed by the described architecture. In particular, since the complex subsystems form a fault containment unit, such a Byzantine error, regardless of the error cause, hardware error, software error or intrusion, is recognized and tamed by the proposed architecture.

[0048] Advantageous refinements of the method according to the application and of the real-time computer system according to the application are specified in the dependent claims. In particular, the following features can be realized each on its own individually or in any combination in the case of the method according to the application and / or of the real-time computer system according to the application:

[0049] • the monitoring subsystem MSS checks in each time slice whether the set of setpoints for the abnormal operation which the monitoring subsystem obtains from the critical event handling subsystem CEHSS via the FTDSS, in particular by means of a message, can be reconciled with the environmental model calculated by the MSS on the basis of the sensor data of the MSS and guarantees a safe guidance of the technical device in the abnormal operation and sets another correctness indicator, correctness indicator-2, to the value TRUE if this is the case, and sets the correctness indicator-2 to the value FALSE if this is not the case, or if no set of setpoints for the abnormal operation is received from the CEHSS in a time slice, and wherein the monitoring subsystem MSS subsequently sends the correctness indicator-2 to the normal handling subsystem NPSS, and wherein the normal handling subsystem NPSS checks in each time slice whether the correctness indicator-2 obtained from the monitoring subsystem MSS takes the value FALSE and aborts the normal guidance of the technical device and guides the technical device into a safe state if this is the case.

[0050] • the normal handling subsystem NPSS communicates in each time slice in addition to the set of setpoints for the normal operation also a planned trajectory for the normal operation, for example in a message in which the normal handling subsystem sends the set of setpoints for the normal operation to the monitoring subsystem MSS.

[0051] • the time servers are fault-tolerant.

[0052] • the data processing subsystems are non-secure subsystems, i.e. they contain complex software which is executed on non-fault-tolerant hardware.

[0053] • the data processing subsystems contain diverse software, e.g. for calculating or checking setpoints for the actuators and / or for calculating an environment model or several environment models.

[0054] • each of the data processing subsystems has its own sensor group.

[0055] • each of the subsystems has its own energy supply. BRIEF DESCRIPTION OF DRAWINGS

[0056] In the following, the application is explained in more detail, exemplarily, with the aid of the drawings. Therein

[0057] Figure 1 an overview about the architecture of a distributed real-time computer system is shown,

[0058] Figure 2 the realization of clock synchronization by means of fault-tolerant time servers is shown, and

[0059] Figure 3 the realization of clock synchronization by means of subsystems of a real-time computer system is shown.

[0060] In the following, first the terms used are explained:

[0061] In the following, important terms used in this document are explained:

[0062]

[0063] DETAILED DESCRIPTION

[0064] Figure 1 The architecture of a distributed real-time computer system for controlling technical devices, e.g. technical equipment or machines, such as robots or vehicles, in particular motor vehicles, is shown.

[0065] As Figure 1 The real-time computer system comprises subsystems 100, 110, 120, 130, wherein each of the subsystems is a fault containment unit, and the subsystems are preferably arranged in a hierarchy. Furthermore, in this example, the real-time computer system comprises time servers 210, which are outside the hierarchy realized if necessary.

[0066] In real-time computer systems, a global time is realized in a known manner or by means of a time server 210, by means of which the subsystems 100, 110, 120, 130 are synchronized in time. The time axis is divided into time slices, which are time slices of identical duration, which preferably directly adjoin one another, wherein these time slices are synchronized with one another at the global time for all subsystems, such that the respectively observed time slice begins and ends at the same point in time for each of the subsystems.

[0067] One of the subsystems, the so-called decision subsystem, namely the fault-tolerant decision subsystem (FTDSS) 100, can forward the setpoint in each time slice to the actuators 150 by means of messages 101, which decision subsystem is preferably located at the tip of the hierarchy.

[0068] Furthermore, three of the subsystems are configured as so-called data processing subsystems, which are preferably located at the next lower hierarchy level relative to the FTDSS. Specifically, these data processing subsystems are the normal processing subsystem (NPSS) 110, the monitoring subsystem (MSS) 120 and the critical event handling subsystem (CEHSS) 130. These three data processing subsystems detect sensor data of the surroundings with sensors 160 and evaluate these sensor data independently of one another, preferably with diversified software.

[0069] The fault-tolerant decision subsystem (FTDSS) 100 is a safety subsystem, that is to say it contains simple software, which is executed on fault-tolerant hardware. It is assumed that the safety subsystem meets given reliability requirements, as described at the outset, depending on the specific application.

[0070] The data processing subsystems 110, 120, 130 can be non-safety subsystems, that is to say they can contain complex software, which is executed on non-fault-tolerant hardware. It is assumed that the complex software system is developed and verified in accordance with ASIL B and has a mean time to failure (MTTF) in operation of 10 -4 hours. It cannot be ruled out that Byzantine errors occur in the non-safety subsystems.

[0071] A normal processing subsystem (NPSS) 110 observes the surroundings at the beginning of each time slice with preferably its own sensors 160, builds an environmental model and calculates a set of setpoints for the actuators 150 in normal operation. The setpoints that the subsystem 110 has calculated are sent in a message 111 to the fault-tolerant decision subsystem (FTDSS) 100 and in a message 112 to the monitoring subsystem (MSS) 120. In the event that the subsystem 110 recognizes a violation of the assumptions about normal operation, it aborts the ongoing process and directs the technical device into a safe state. In addition, an operator, for example the driver of a motor vehicle, can be informed of this and can take over control (Kontrolle) if necessary.

[0072] A critical event handling subsystem (CEHSS) 130 observes the surroundings at the beginning of each time slice with preferably its own sensors 160, builds its own environmental model with diversification software and calculates a set of setpoints for the actuators 150 in abnormal operation. The critical event handling subsystem sends the setpoints in a message 131 to the fault-tolerant decision subsystem (FTDSS) 100.

[0073] The fault-tolerant decision subsystem (FTDSS) 100 receives the messages 111, 131 with the setpoints for normal and abnormal operation in each time slice and sends these setpoints in a message 102 to the monitoring subsystem (MSS) 120.

[0074] The monitoring subsystem (MSS) 120 checks in each time slice whether the set of setpoints for normal operation that the monitoring subsystem has obtained in a message 112 directly from the normal processing subsystem (NPSS) 110 can be reconciled with the environmental model that the MSS 120 calculates with diversification software on the basis of sensor data determined with the sensors 160 and ensures safe guidance (Führung) of the technical device in normal conditions.

[0075] The environmental model is, for example, a digital data structure that represents at a given point in time an image (Abbildung) of features of the environment of the technical device that are important for a pre-given task. An example of an environmental model is a description of a road and objects that are located on the road at a selected point in time.

[0076] The monitoring subsystem (MSS) 120 furthermore checks whether the set of setpoints that the monitoring subsystem has obtained in a message 112 directly from the normal processing subsystem (NPSS) 110 is identical to the corresponding set of setpoints that the monitoring subsystem (MSS) 120 receives in a message 102 from the normal processing subsystem (NPSS) 110 via the fault-tolerant decision subsystem (FTDSS).

[0077] This second check is necessary because the following malicious Byzantine error of the normal processing subsystem (NPSS) 110 has to be identified: the faulty normal processing subsystem (NPSS) 110 sends correct ratings to the monitoring subsystem (MSS) 120 and faulty ratings to the fault-tolerant decision subsystem (FTDSS) 100.

[0078] If both checks performed by the monitoring subsystem (MSS) 120 are positive, the correctness indicator -1 is set to the value TRUE. If one of the two checks is negative, the correctness indicator -1 is set to the value FALSE. After the checks, the monitoring subsystem (MSS) 120 sends the correctness indicator -1 in a message 121 to the fault-tolerant decision subsystem (FTDSS) 100.

[0079] The fault-tolerant decision subsystem (FTDSS) 100 decides in each time slice as follows: in the case that the correctness indicator -1 contains the value TRUE, the set of ratings for normal operation is sent in a message 101 to the actuator 150, in the case that the correctness indicator -1 contains the value FALSE or the expected message 121 with the correctness indicator -1 is not arrived, the set of ratings for abnormal operation is forwarded in a message 101 to the actuator 150 and from this point in time only the ratings for abnormal operation are still forwarded to the actuator 150 in subsequent time slices until the technical device has reached a safe state. The expected message 121 with the correctness indicator -1 not arrived is an indicator for a failure silent fault (Ausfall) of the monitoring subsystem (MSS) 120.

[0080] The fault-tolerant decision subsystem (FTDSS) 100 comprises especially very simple software which can be implemented without operating system support. This is advantageous because operating systems are complex by experience and not free of design errors [Cho01].

[0081] The monitoring subsystem (MSS) 120 also has to check in each time slice whether the set of ratings for abnormal operation which the monitoring subsystem obtains from the critical event handling subsystem (CEHSS) 130 by means of messages 131, 102 is consistent with the environment model which has been calculated by the MSS on the basis of sensor data of the MSS-based sensors 160 and guarantees a safe guidance of the process in abnormal operation. If this is the case, a further correctness indicator, namely correctness indicator -2, is set to the value TRUE by the monitoring subsystem (MSS) 120, whereas if this is not the case or if no message is received by the MSS 120 from the CEHSS 130 in a time slice, the correctness indicator -2 is set to the value FALSE.

[0082] The nominal values for the abnormal operation need to be transmitted via the FTDSS 100 through a detour (Umweg) with the messages 131, 102 in order to rule out a Byzantine error of the critical event handling subsystem (CEHSS) 130.

[0083] The monitoring subsystem (MSS) 120 sends the value of the correctness indicator-2 or the correctness indicator-2 with the message 122 to the normal processing subsystem (NPSS) 110, so that it can be informed to the normal processing subsystem (NPSS) 110 whether an error occurred in the critical event handling subsystem (CEHSS) 130 or whether the subsystem failed due to a failure silent error. The normal processing subsystem (NPSS) 110 checks in each time slice whether the correctness indicator-2 obtained from the monitoring subsystem (MSS) 120 takes the value FALSE and, if this is the case, the technical device 110 is guided by the normal processing subsystem (NPSS) into a safe state.

[0084] It is advantageous if each of the data processing subsystems 110, 120, 130 performs the analysis of the sensor data, the fusion of the sensor data of the sensors 160 and / or the specification of the trajectory by means of various different software. Thereby the probability of the occurrence of the same software error in multiple subsystems is reduced.

[0085] A trajectory is, for example, a path which a technical device can execute over time in order to fulfill a given task. The characteristics of the trajectory of a device depend on the construction of the device, the requirements of the given task and the current environmental conditions. For example, the possible ways (Weg) in which a vehicle can execute in order to reach its destination under given environmental conditions are called trajectories.

[0086] A trajectory can also be described as a time sequence of nominal values.

[0087] It is advantageous if each of the data processing subsystems 110, 120, 130 possesses its own set of sensors 160. Thereby it is prevented that an error in a sensor can lead to a related failure of multiple subsystems.

[0088] The normal processing subsystem (NPSS) 110 can send in addition to the set of nominal values in each time slice the planned trajectory for the normal operation in the message 112 to the monitoring subsystem (MSS) 120 in order to give the monitoring subsystem (MSS) 120 the possibility to check the planned trajectory.

[0089] Figure 2 is shown as in Figure 1A time server 210, which can be exemplarily arranged in the real-time computer system, periodically sends synchronization messages 211 to the subsystems 100, 110, 120, 130 for synchronizing the clocks of the subsystems. If the time server 210 is implemented fault-tolerant, it is advantageous.

[0090] Since the four subsystems 100, 110, 120, 130 are autonomous FCUs with independent oscillators / clocks, it is also possible to implement a fault-tolerant clock synchronization by means of the four subsystems themselves to form a global time. Figure 3 The message exchange is shown, which is required in order to perform a fault-tolerant clock synchronization with the four subsystems 100, 110, 120, 130, as described in [Kop12, pages 69-74]. For this purpose, the following synchronization messages must be exchanged in each synchronization cycle:

[0091] • synchronization message 301 from subsystem 100 to subsystem 110

[0092] • synchronization message 310 from subsystem 110 to subsystem 100

[0093] • synchronization message 302 from subsystem 100 to subsystem 120

[0094] • synchronization message 320 from subsystem 120 to subsystem 100

[0095] • synchronization message 303 from subsystem 100 to subsystem 130

[0096] • synchronization message 330 from subsystem 130 to subsystem 100

[0097] • synchronization message 312 from subsystem 110 to subsystem 120

[0098] • synchronization message 321 from subsystem 120 to subsystem 110

[0099] • synchronization message 323 from subsystem 120 to subsystem 130

[0100] • synchronization message 332 from subsystem 130 to subsystem 120

[0101] • synchronization message 313 from subsystem 110 to subsystem 130

[0102] • synchronization message 331 from subsystem 130 to subsystem 110

[0103] It is generally applicable that in order to be able to prevent a failure of the central power supply device from leading to a failure of all subsystems 100, 110, 120, 130, 210, it is advantageous if each of the subsystems 100, 110, 120, 130, 210 has an independent energy supply (for example by means of its own battery).

[0104] The following overview finally shows how errors or intrusions occurring in the subsystems are identified and dealt with:

[0105] Error analysis

[0106]

[0107] Cited literature:

[0108] [Avi85] Avizienis, A. The N-Version Approach to Fault-Tolerant Systems. IEEE Trans. on Software Engineering. Vol. 11, No 12, pp. 1491-1501. 1985

[0109] [Cho01] Chou, A. et al. An Empirical Study of Operating System Errors. Proc. of the ACM SOPS 2001 pp. 73-88. 2001

[0110] ISO Standard ISO 26262 über funktionale Sicherheit

[0111] [Dvo09] Dvorak, D. L. Editor. NASA Study on Flight Software Complexity. Final Report. Jet Propulsion Laboratory, Pasadena, Cal. USA. 2009

[0112] [Kop11] Kopetz, H. Real-Time Systems - Design Principles for Distributed Embedded Applications. Springer Verlag. 2011

[0113] [Wiklb] Wikipedia, Definition von einem byzantinischen Fehler URL: https: / / de.wikipedia.org / wiki / Byzantinischer_Fehler.

Claims

1. A method for controlling technical installations with a distributed real-time computer system, wherein the real-time computer system - comprises subsystems, - and wherein the subsystems are synchronized on a global time, and wherein - a timeline is divided into a series of synchronized time slices using the global time, characterized in that - each subsystem (100, 110, 120, 130) forms a fault containment unit of its own, and wherein - one of the subsystems is a decision subsystem, a so-called fault-tolerant decision subsystem FTDSS (100), wherein the FTDSS (100) is able to hand over setpoint values to actuators (150) in each time slice by means of messages (101), wherein the fault-tolerant decision subsystem FTDSS (100) is a safety subsystem, that is to say contains simple software, which is executed on fault-tolerant hardware, and wherein - at least or exactly three data processing subsystems are provided, a normal processing subsystem NPSS (110), a monitoring subsystem MSS (120) and a critical event handling subsystem CEHSS (130), wherein the at least or exactly three data processing subsystems detect sensor data of an observed environment with sensors (160) using the sensors (160) and evaluate the sensor data independently of one another, wherein - the environment is observed by the data processing subsystems (110, 120, 130) at the beginning of a time slice and calculations are performed during the time slice with sensor data acquired by the observation of the environment at the beginning of the time slice, - the normal processing subsystem NPSS (110) sends a set of setpoint values for normal operation in a message (111) to the fault-tolerant decision subsystem FTDSS (100) and in a message (112) to the monitoring subsystem MSS (120) in each time slice, and wherein - the critical event handling subsystem CEHSS (130) sends a set of setpoint values for abnormal operation in a message (131) to the fault-tolerant decision subsystem FTDSS (100) in each time slice, and wherein - the fault-tolerant decision subsystem FTDSS (100) sends the two sets of received setpoint values for the normal operation and the abnormal operation in a message (102) to the monitoring subsystem MSS (120) in each time slice, and wherein - the monitoring subsystem MSS (120) compares the two sets of setpoint values in each time slice and sends a message (121) to the fault-tolerant decision subsystem FTDSS (100) if the two sets of setpoint values differ from one another, and wherein - the fault-tolerant decision subsystem FTDSS (100) sends a message (103) to the critical event handling subsystem CEHSS (130) if the two sets of setpoint values differ from one another, and wherein - the critical event handling subsystem CEHSS (130) sends a message (132) to the normal processing subsystem NPSS (110) if the two sets of setpoint values differ from one another, and wherein - the normal processing subsystem NPSS (110) sends a message (113) to the fault-tolerant decision subsystem FTDSS (100) if the two sets of setpoint values differ from one another, and wherein - the fault-tolerant decision subsystem FTDSS (100) sends a message (104) to the monitoring subsystem MSS (120) if the two sets of setpoint values differ from one another. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ - the monitoring subsystem MSS (120) performs a check in each time slice whether the set of setpoints for the normal operation which the monitoring subsystem has obtained in the message (112) from the normal processing subsystem NPSS (110) is in agreement with an environmental model calculated by the MSS (120) on the basis of sensor data (160) of the MSS (120) and guarantees a safe guidance of the technical device in normal conditions, and the monitoring subsystem MSS (120) furthermore performs a check in each time slice whether the set of setpoints for the normal operation which the monitoring subsystem has obtained in the message (112) from the normal processing subsystem NPSS (110) is identical to the corresponding set of setpoints which the normal processing subsystem NPSS (110) has sent to the monitoring subsystem MSS (120) via the fault-tolerant decision subsystem FTDSS (100), and - if both checks are positive, a correctness indicator, namely correctness indicator-1, is set to the value TRUE, and if one of the two checks is negative or both checks are negative, the correctness indicator-1 is set to the value FALSE and the value of the correctness indicator-1 or the correctness indicator-1 is sent in each time slice in a message (121) to the fault-tolerant decision subsystem FTDSS (100), and wherein - the fault-tolerant decision subsystem FTDSS (100) decides in each time slice as follows: in the case that the correctness indicator-1 has the value TRUE, the set of setpoints for the normal operation is forwarded to the actuator (150), in the case that the correctness indicator-1 has the value FALSE or the message (121) with the correctness indicator-1 is not expected by the FTDSS (100), the set of setpoints for the abnormal operation is forwarded to the actuator (150), wherein in this case from this point in time onwards in subsequent time slices setpoints for the abnormal operation are forwarded to the actuator (150) until the technical device reaches a safe state.

2. The method according to claim 1, wherein the subsystems are synchronized on a global time in such a way that there is a time server (210).

3. The method according to claim 2, wherein the time server (210) periodically sends synchronization messages (211) to each subsystem in order to synchronize the subsystems or the clocks of the subsystems to build up the global time.

4. The method according to claim 2 or 3, wherein the time server (210) forms a fault containment unit of its own.

5. The method according to claim 2 or 3, wherein the time server (210) is outside the hierarchy of the subsystems.

6. The method according to claim 1, wherein the technical device comprises a technical equipment.

7. The method according to claim 6, wherein the technical equipment comprises a robot or a vehicle.

8. The method of claim 7, wherein the vehicle comprises a motor vehicle.

9. The method of claim 1, wherein the real-time computer system comprises a number of subsystems.

10. The method of claim 1, wherein the subsystems are arranged hierarchically.

11. The method of claim 10, wherein the decision subsystem is placed in the uppermost level of the hierarchy.

12. The method of claim 10, wherein the data processing subsystem is placed on the next lower level of the hierarchy.

13. The method of claim 1, wherein the normal processing subsystem NPSS (110) sends a set of ratings for normal operation in a message (111) to the fault-tolerant decision subsystem FTDSS (100) and in a message (112) to the monitoring subsystem MSS (120) at the end of the time slice.

14. The method of claim 1, wherein the critical event handling subsystem CEHSS (130) sends a set of ratings for abnormal operation in a message (131) to the fault-tolerant decision subsystem FTDSS (100) at the end of the time slice.

15. The method of claim 1, wherein the fault-tolerant decision subsystem FTDSS (100) sends the two sets of received ratings for the normal operation and the abnormal operation in a message (102) to the monitoring subsystem MSS (120) at the end of the time slice.

16. The method of claim 1, wherein the set of ratings for the normal operation is forwarded in a message (101) to the actuator (150).

17. The method of claim 1, wherein the set of ratings for the abnormal operation is forwarded in a message (101) to the actuator (150).

18. The method according to claim 1, wherein the monitoring subsystem MSS (120) checks in each time slice whether the set of ratings for the abnormal operation obtained by the monitoring subsystem from the critical event handling subsystem CEHSS (130) via FTDSS (100) can be reconciled with an environmental model calculated by the MSS based on sensor data of the MSS and guarantees a safe guidance of the technical device in the abnormal operation and sets a further correctness indicator, correctness indicator-2, to the value TRUE if this is the case, and sets the correctness indicator-2 to the value FALSE if this is not the case or if no set of ratings for the abnormal operation is received from CEHSS (130) in a time slice, and wherein the monitoring subsystem MSS (120) subsequently sends the correctness indicator-2 to the normal handling subsystem NPSS (110), and wherein the normal handling subsystem NPSS (110) checks in each time slice whether the correctness indicator-2 obtained from the monitoring subsystem MSS takes the value FALSE and aborts the normal guidance of the technical device and guides the technical device into a safe state if this is the case.

19. The method according to claim 18, wherein the monitoring subsystem MSS (120) obtains the set of ratings for the abnormal operation from the critical event handling subsystem CEHSS (130) via FTDSS (100) by means of a message (131, 102).

20. The method according to any one of claims 1 to 3, wherein the normal handling subsystem NPSS (110) communicates in each time slice the planned trajectory for the normal operation in addition to the set of ratings for the normal operation.

21. The method according to claim 20, wherein the normal handling subsystem NPSS (110) communicates in each time slice the planned trajectory for the normal operation in addition to the set of ratings for the normal operation in a message (112) in which the normal handling subsystem sends the set of ratings for the normal operation to the monitoring subsystem MSS (120).

22. The method according to any one of claims 1 to 3, wherein the time server is fault-tolerant.

23. The method according to any one of claims 1 to 3, wherein the data processing subsystems (110, 120, 130) are non-safety subsystems, i.e. the data processing subsystems contain complex software which is executed on non-fault-tolerant hardware.

24. The method according to any one of claims 1 to 3, wherein the data processing subsystems (110, 120, 130) contain diversified software.

25. The method according to claim 24, wherein the data processing subsystems (110, 120, 130) contain diversification software for calculating setpoints for the actuators (150) and / or an environment model.

26. The method according to any one of claims 1 to 3, wherein each of the data processing subsystems (110, 120, 130) has its own sensor group.

27. The method according to any one of claims 1 to 3, wherein each of the subsystems (100, 110, 120, 130, 210) has its own energy supply.

28. A real-time computer system for controlling technical installations, wherein the real-time computer system - comprises subsystems, - and wherein the subsystems are synchronized on a global time, and wherein - a timeline is divided into a series of synchronized time slices using the global time, characterized in that - each subsystem (100, 110, 120, 130) forms its own fault containment unit, and wherein - one of the subsystems is a decision subsystem, a so-called fault-tolerant decision subsystem FTDSS (100), wherein the FTDSS (100) is set up to hand over setpoints to actuators (150) in each time slice by means of messages (101), wherein the fault-tolerant decision subsystem FTDSS (100) is a safety subsystem, i.e. contains simple software, which is executed on fault-tolerant hardware, and wherein - at least or exactly three data processing subsystems are provided, a normal processing subsystem NPSS (110), a monitoring subsystem MSS (120) and a critical event handling subsystem CEHSS (130), wherein the at least or exactly three data processing subsystems are set up to detect sensor data of an environment observed with sensors (160) using the sensors (160) and to evaluate the sensor data independently of one another, wherein - the environment is observed by the data processing subsystems (110, 120, 130) at the beginning of a time slice and calculations are performed during the time slice using sensor data acquired by the observation of the environment performed at the beginning of the time slice, - the normal processing subsystem NPSS (110) is set up to send a set of setpoints for normal operation in each time slice in a message (111) to the fault-tolerant decision subsystem FTDSS (100) and in a message (112) to the monitoring subsystem MSS (120), and wherein - the critical event handling subsystem CEHSS (130) is set up to send a set of setpoints for abnormal operation in each time slice in a message (131) to the fault-tolerant decision subsystem FTDSS (100), and wherein ​ ​ ​ - the fault-tolerant decision subsystem FTDSS (100) is set up for sending in each time slice in a message (102) the received two sets of setpoints for the normal operation and the abnormal operation to the monitoring subsystem MSS (120), and wherein - the monitoring subsystem MSS (120) is set up for performing in each time slice a check whether the set of setpoints for the normal operation which the monitoring subsystem has obtained in the message (112) from the normal processing subsystem NPSS (110) is in agreement with an environmental model calculated by the MSS (120) on the basis of sensor data (160) of the MSS (120) and guarantees a safe guidance of the technical device in normal conditions, and the monitoring subsystem MSS (120) is furthermore set up for performing in each time slice a check whether the set of setpoints for the normal operation which the monitoring subsystem has obtained in the message (112) from the normal processing subsystem NPSS (110) is identical to the corresponding set of setpoints which the normal processing subsystem NPSS (110) has sent to the monitoring subsystem MSS (120) via the fault-tolerant decision subsystem FTDSS (100), and - if both checks are positive, a correctness indicator, namely correctness indicator-1, is set to the value TRUE, and if one of the two checks is negative or both checks are negative, the correctness indicator-1 is set to the value FALSE and the correctness indicator-1 or the value of the correctness indicator-1 is sent in each time slice in a message (121) to the fault-tolerant decision subsystem FTDSS (100), and wherein - the fault-tolerant decision subsystem FTDSS (100) decides in each time slice as follows: in the case that the correctness indicator-1 has the value TRUE, the set of setpoints for the normal operation is forwarded to the actuators (150), in the case that the correctness indicator-1 has the value FALSE or the message (121) with the correctness indicator-1 is not expected by the FTDSS (100), the set of setpoints for the abnormal operation is forwarded to the actuators (150), wherein in this case from this point in time onwards in subsequent time slices setpoints for the abnormal operation are forwarded to the actuators (150) until the technical device reaches a safe state.

29. Real-time computer system according to claim 28, wherein the subsystems are synchronized on a global time in that there is a time server (210).

30. Real-time computer system according to claim 29, wherein the time server (210) periodically sends synchronization messages (211) to each subsystem in order to synchronize the subsystems or the clocks of the subsystems to build up the global time.

31. The real-time computer system according to claim 29 or 30, wherein the time server (210) forms a fault containment unit of itself.

32. The real-time computer system according to claim 29 or 30, wherein the time server (210) is outside the hierarchy of the subsystems.

33. The real-time computer system according to claim 28, wherein the real-time computer system is a distributed real-time computer system.

34. The real-time computer system according to claim 28, wherein the technical device comprises a technical equipment.

35. The real-time computer system according to claim 34, wherein the technical equipment comprises a robot or a vehicle.

36. The real-time computer system according to claim 35, wherein the vehicle comprises a motor vehicle.

37. The real-time computer system according to claim 28, wherein the real-time computer system comprises a large number of subsystems.

38. The real-time computer system according to claim 28, wherein the subsystems are arranged hierarchically.

39. The real-time computer system according to claim 38, wherein the decision subsystem is placed in the uppermost level of the hierarchy.

40. The real-time computer system according to claim 38, wherein the data processing subsystem is placed on the next lower level of the hierarchy.

41. The real-time computer system according to claim 28, wherein the normal processing subsystem NPSS (110) is set up for sending a set of ratings for normal operation in a message (111) to the fault-tolerant decision subsystem FTDSS (100) and in a message (112) to the monitoring subsystem MSS (120) at the end of the time slice.

42. The real-time computer system according to claim 28, wherein the critical event handling subsystem CEHSS (130) is set up for sending a set of ratings for abnormal operation in a message (131) to the fault-tolerant decision subsystem FTDSS (100) at the end of the time slice.

43. The real-time computer system according to claim 28, wherein the set of ratings for normal operation is forwarded in a message (101) to the actuator (150).

44. The real-time computer system according to claim 28, wherein the set of ratings for abnormal operation is forwarded in a message (101) to the actuator (150).

45. Real-time computer system according to claim 28, wherein the monitoring subsystem MSS (120) is set up to check in each time slice whether the set of setpoints for the abnormal operation obtained by the monitoring subsystem from the critical event handling subsystem CEHSS (130) via the FTDSS (100) can be reconciled with the environmental model calculated by the MSS on the basis of sensor data of the MSS in the abnormal operation and to ensure a safe guidance of the process in the abnormal operation and is set up to set a further correctness indicator, correctness indicator-2, to the value TRUE if this is the case, and to set the correctness indicator-2 to the value FALSE if this is not the case or if no set of setpoints for the abnormal operation is received from the CEHSS (130) in a time slice, and wherein the monitoring subsystem MSS (120) is set up to subsequently send the correctness indicator-2 to the normal handling subsystem NPSS (110), and wherein the normal handling subsystem NPSS (110) is set up to check in each time slice whether the correctness indicator-2 obtained from the monitoring subsystem MSS takes the value FALSE and to abort the normal guidance of the technical device and to guide the technical device into a safe state if this is the case.

46. Real-time computer system according to claim 45, wherein the monitoring subsystem MSS (120) obtains the set of setpoints for the abnormal operation from the critical event handling subsystem CEHSS (130) via the FTDSS (100) by means of a message (131, 102).

47. Real-time computer system according to any one of claims 28 to 30, wherein the normal handling subsystem NPSS (110) transmits in each time slice, in addition to the set of setpoints for the normal operation, also the planned trajectory for the normal operation.

48. Real-time computer system according to claim 47, wherein the normal handling subsystem NPSS (110) transmits in each time slice, in addition to the set of setpoints for the normal operation, also the planned trajectory for the normal operation in a message (112) in which the normal handling subsystem sends the set of setpoints for the normal operation to the monitoring subsystem MSS (120).

49. Real-time computer system according to any one of claims 28 to 30, wherein the time server is fault-tolerant.

50. Real-time computer system according to any one of claims 28 to 30, wherein the data processing subsystems (110, 120, 130) are non-safety subsystems, i.e. the data processing subsystems comprise complex software which is executed on non-fault-tolerant hardware.

51. Real-time computer system according to any one of claims 28 to 30, wherein the data processing subsystems (110, 120, 130) comprise diversified software.

52. The real-time computer system of claim 51, wherein the data processing subsystems (110, 120, 130) include diversification software for computing setpoints for the actuators (150) and / or an environment model.

53. The real-time computer system of any one of claims 28 to 30, wherein each of the data processing subsystems (110, 120, 130) has its own set of sensors.

54. The real-time computer system of any one of claims 28 to 30, wherein each of the subsystems (100, 110, 120, 130, 210) has its own energy supply.

Images