Kinetic verification of intact descriptibility of technical system on basis of predefined operating conditions

Abstract

The invention relates to a method (100) for checking how much complete description of the dynamics of a technical system (1) by detecting a state of the technical system (1) using a plurality of sensors (2a-2c) in combination with at least one differential equation (5) on the basis of a predefined operating situation (1a), comprising the following steps: constructing (110) a dynamics function (4) describing the predefined operating state (1a) and the dynamics of the technical system (1), the dynamics function (4) being dependent on measured values (3a-3c) of the sensors (2a-2c) and / or on variables derived from the measured values (3a-3c); forming (120) at least one differential equation (5) from the kinetic function (4); determining (130) initial conditions, boundary conditions and / or region conditions (6) for the solution of the at least one differential equation (5) as a function of the predefined operating situation (1a); checking (140) whether the differential equation (5) can be analytically solved under the determined initial condition, boundary condition and / or area condition (6); and in response to the at least one differential equation (5) being able to resolve, determining (150a) the dynamics of the system (1) entirely described by the detection using the sensors (2a-2c) and the at least one differential equation (5).

Description

Technical Field

[0001] The invention relates to the monitoring of technical systems, the states of which are detected by one or more sensors and the dynamics of which are modeled by differential equations of one or more variables. Background Art

[0002] For the control of many technical systems, it is essential to determine predictions of the dynamics of the system in the future based on sensor observations of the system over a past period of time. These predictions are determined based on models based on the measurement data detected by the sensors and serve as the basis for further control of the corresponding system. Thus, for example, a vehicle can predict its future driving dynamics in advance based on the sensor data, at least within a number of time units or time steps, and the control system can intervene if necessary in order to modify these driving dynamics in the desired manner. An example of such a control system is the Electronic Stability Program (ESP) according to EP 0 339 056 B1.

[0003] In order for such control systems to function in an orderly manner, the corresponding technical system must also actually behave as predicted by the model used on the basis of the sensor data. For more complex systems, it is difficult to prove that the measurement data delivered by a given sensor configuration in combination with a given model fully describe the dynamics of the system at every time and in all situations, and that the system does not show, for example, a behavior that deviates completely from the prediction (e.g., chaotic). Summary of the invention

[0004] The invention provides a method for checking to what extent the dynamics of a technical system can be completely described by detecting the state of the technical system based on a predetermined operating condition using a plurality of sensors in combination with at least one differential equation. "At least one differential equation" includes in particular the case where there is a system of multiple differential equations that must be satisfied simultaneously. Thus, for example, what is described in the literature in the singular form of "Euler-Lagrange equations" in many places is in fact a system of partial differential equations. The method presented here functions in exactly the same way whether one or more differential equations are present.

[0005] The predetermined operating state can be, for example, in particular a real-time operating state of the technical system, for which, within the scope of online monitoring of the operation, it is determined whether the behavior of the technical system is sufficiently predictable or whether the system is likely to show an unexpected behavior that deviates from the prediction made by at least one differential equation. However, the predetermined operating state can also be, for example, a constructed test state. Before a safety-critical technical system is allowed to be put into operation, acceptance or approval is often required, and in order to obtain this acceptance or approval, it is necessary to prove the mastery of a large number of test states from a predetermined series.

[0006] Within the scope of the method, a dynamics function is constructed which describes a predetermined operating situation and the dynamics of the technical system. The dynamics function depends on the measured values ​​of the sensors and / or on variables derived from these measured values. In particular, the dynamics function can, for example, contain individual contributions of entities that actively contribute to the dynamics of the technical system, so that the complexity of the dynamics function depends on the number of these entities. For example, in the case of a traffic situation as a technical system, each vehicle involved can actively contribute to the dynamics and can therefore be represented in the dynamics function using an individual contribution. In addition, the complexity of the dynamics function depends on the number and detail of the measured values ​​acquired and the processing of these measured values ​​into the variables that are ultimately acquired in the dynamics function.

[0007] Therefore, the dynamic function may be very dependent on the corresponding driving situation. For example, a road intersection or roundabout can be described by a substantially simpler dynamic function during off-peak traffic times, where only two vehicles are traveling, than during peak traffic times, where there are a large number of vehicles and different intentions for the corresponding continued driving.

[0008] In addition, initial conditions, boundary conditions and / or area conditions are determined for the solution of at least one differential equation according to a predetermined operating condition. The initial conditions can be given, for example, by the initial position and / or speed of traffic participants or other entities that contribute to the dynamics of the technical system. Boundary conditions and area conditions can be given, for example, by the direction of the lane or other constraints of the technical system. Any other prior knowledge about the technical system can also be introduced into the initial conditions, boundary conditions, area conditions, or also into the coupling of the dynamics of various entities. Thus, for example, it is stipulated in the German road traffic regulations that the vehicle that is just being overtaken is not allowed to increase its speed, or that trucks must drive outside at least keeping a distance from each other, which enables the overtaking party to merge.

[0009] At least one differential equation is formed from the dynamic function. For this purpose, for example, a predefined schema based on the first or multiple derivatives of the dynamic function can be used.

[0010] It is now checked whether at least one differential equation can be solved analytically under the previously determined initial conditions, boundary conditions and / or regional conditions. If this is the case, it is determined that the detection using the sensor and the at least one differential equation completely describe the dynamics of the system. If, on the other hand, the at least one differential equation cannot be solved analytically, it is determined that the detection using the sensor and the at least one differential equation do not completely describe the dynamics of the system. Analytical solvability means a basic order (Grundordnung) that captures the dynamics of the technical system, which can be compared to the long-range order (Fernordnung) that captures the spatial arrangement of atoms in a single crystal. Therefore, the arrangement of all atoms in a single crystal is completely described by the constantly repeated arrangement in some unit cells. In this analogy, the missing analytical solvability corresponds to the missing points in the single crystal that deviate from the long-range order. Therefore, there may be "holes (Loch)" in the phase space that cannot be captured, in which the technical system suddenly behaves completely differently than predicted by the at least one differential equation.

[0011] No mathematical proof is required for this check. Rather, an analytical solution can be searched for, for example, according to a predetermined solution pattern that can be carried out automatically. If this search leads to success, it means that an analytical solution exists and therefore that the detection using the sensor and at least one differential equation completely describe the dynamics of the system. The failure of this search is not yet a mathematical proof that "an analytical solution does not exist at all". However, from the perspective of safety technology, it is obviously less disadvantageous for the operation of a technical system to classify it as "incompletely described" "in a false negative manner" than to classify it as "completely described" "in a false positive manner". Therefore, within the scope of the method proposed here, the failure of the automated search for an analytical solution, which is carried out in any way, is sufficient to determine that at least one differential equation cannot be solved analytically.

[0012] The method proposed here makes it possible in particular to quickly and efficiently check the dependence of the behavior of a technical system on the operating situation. In this way, for example, physical tests can be saved in the approval process of the technical system and the corresponding control. Thus, for example, for systems for at least partially automated driving, it is often necessary to prove the masterability for approximately 100,000 predefined test situations. If the method proposed here indicates, for example, that it is not masterable for a test situation, then it can be directly concluded without further physical testing that there is something to be improved in the system.

[0013] In a particularly advantageous embodiment, the Lagrangian function L=TV is selected as the dynamic function, which contains the kinetic energy T and the potential energy V of each entity that actively contributes to the dynamics of the technical system. The dynamic function can then be adjusted particularly easily to a changing number of entities, such as vehicles in a traffic situation.

[0014] The kinetic energy of an entity depends on the velocity of the entity in a quadratic manner, and the potential energy of an entity depends on the height of the entity in the gravitational field of the earth. For example, the speed is continuously measured inside a vehicle. The height can be determined based on the positioning of the vehicle, for example using a navigation system that uses satellites. The navigation system can, for example, directly deliver the height. However, it is also possible to determine the height from a digital height model of the earth, for example from the Global Digital Elevation Model (GDEM) obtained by NASA based on satellite observations of the earth, based on the position of the vehicle. Both the kinetic energy and the potential energy also contain the mass of the entity. For the decision made within the scope of the method proposed here as to whether at least one differential equation is solvable, it is sufficient to make a rough assessment of the mass, for example based on the type of traffic participant (e.g., car, truck or pedestrian).

[0015] It is particularly advantageous that the Euler-Lagrange equations can be formed as a system of partial differential equations in the coordinates of the state space based on the derivatives of the Lagrangian functions. The solutions of the Euler-Lagrange equations are stationary points of the action functions.

[0016] For example, if the technical system has n degrees of freedom, then the generalized coordinates q1,...,q n are assigned to these degrees of freedom. Then, the kinetic energy T can be written as n ) coefficient a i,j The quadratic form

[0017]

[0018] If, for example, there are N possible driving directions for the vehicle These driving directions can be expressed by the generalized coordinates q1,...,q n Depend on

[0019]

[0020] Then the kinetic energy T can be written as:

[0021]

[0022] Here we can swap the order of the summation. Therefore, the kinetic energy T becomes:

[0023]

[0024] This yields the components of the Euler-Lagrange equation for each degree of freedom m:

[0025]

[0026] A particularly advantageous embodiment includes a test to determine whether at least one differential equation can be solved analytically.

[0027] Call one or more parameterized solution solutions from a predefined library for at least one differential equation

[0028] solving one or more equations for parameters of the solutions by substituting the solutions into at least one differential equation, and

[0029] • Checking whether the one or more equations can be solved.

[0030] Currently, only a limited number of solutions for differential equations are known that can be quickly and automatically tested. Thus, many of these solutions lead to systems of (e.g. linear) equations for parameters, for which it can be quickly determined whether they are solvable.

[0031] In another particularly advantageous embodiment, in response to determining that the detection by the sensor and at least one differential equation do not completely describe the dynamics of the system, the method is re-executed based on:

[0032] an expanded and / or qualitatively improved configuration of sensors, and / or

[0033] Extended and / or more detailed processing of the sensor measurements to obtain the quantities on which the dynamics function depends.

[0034] In this way it can be checked whether the defects of the incomplete description can be eliminated by changing the configuration of the sensor or by changing the processing.

[0035] The background is that every description of a technical system using one or more differential equations and measured values ​​detected by sensors is based on the modeling of the technical system. Within the scope of this modeling, the transition to the numerical domain does not necessarily take place, and the modeling can still be purely analytical. Then, the mere process of modeling does not yet mean digitization and discretization. The level of detail of these modelings is selected in such a way that phenomena relevant to the operation of the technical system can be detected, but at the same time the model can be calculated within a predetermined time with predetermined hardware resources. Thus, for example, for a rough description of the motion of the planets, it is sufficient to model the earth as a mass point. For the planning of a flight to the moon, the earth already had to be modeled as a solid sphere. This is no longer sufficient for an exact description of the dynamics of the satellite, because here the topography of the earth's surface and the uneven mass distribution have an impact.

[0036] Thus, for example, during the driving of the vehicle, traffic situations of extremely different complexity may be encountered. In good weather and without directly oncoming traffic, two cameras as sensors may be sufficient for monitoring and controlling highway driving. If, on the other hand, there is bad weather at the destination and the vehicle has to cross a roundabout at a large intersection during rush hour, this situation may only be detected by adding further cameras or also radar and / or lidar sensors. Alternatively or in combination, it may be necessary to process the sensor data using machine learning models, for example, in order to classify other traffic participants and their intentions.

[0037] Checking which configurations of the sensors and / or which processing of the measured values ​​are at least necessary in order to understand the situation is advantageous in two ways. On the one hand, this makes it possible to determine in advance during the manufacture of the vehicle or vehicle system, for example, what minimum hardware configuration is required in order to successfully complete a predetermined series of test situations. On the other hand, during continuous operation, only as much hardware as is actually required can be kept active at all times. Thus, for example, radar or lidar sensors consume additional energy, which is only available to a limited extent in the vehicle interior. For example, the laser source of a lidar system or a mechanical laser scanner may also have a limited life span measured in operating hours.

[0038] Thus, in response to determining that the dynamics of the system are now completely described when the method is re-executed, an extended and / or qualitatively improved sensor configuration or an extended and / or more detailed processing of the measured values ​​is advantageously activated or remains activated.

[0039] In another advantageous embodiment, an extended and / or more detailed processing of the sensor measured values ​​is performed using additional computing tools and / or on additional computing instances in the cloud. It is particularly important here that the extended and / or more detailed processing does not have to be permanently active, but is only active when, for example, specific traffic conditions require it. The use of the cloud is usually charged according to a pay-per-use model, and the activated additional computing units increase energy consumption.

[0040] For example, in response to the determination that "the detection using sensors and at least one differential equation do not fully describe the dynamics of the system", the technical system can also be limited in functionality, put into a safe state or deactivated. For example, the driving speed of the at least partially automated vehicle can be reduced or an overtaking maneuver can be prohibited. The vehicle can also be brought to a standstill, for example, on a pre-planned emergency stop trajectory. It is also possible, for example, to request an operator, such as a driver, to take over control of the system.

[0041] If, on the other hand, it has been determined that "the detection by the sensor and at least one differential equation completely describe the dynamics of the system", then the method can be re-executed based on the following:

[0042] A reduced and / or qualitatively limited configuration of sensors, and / or

[0043] • Reduced and / or less detailed processing of the sensor measurements to obtain the quantities on which the dynamic function depends.

[0044] In this way, it can be determined whether a complete description of the system is also possible with less overhead.

[0045] In particular, in response to the determination that the dynamics of the system are as completely described as before when the method is repeated, the configuration of the operation of the sensor can be reduced and / or limited in quality, or the further processing of the measured values ​​of the sensor can be reduced and / or performed in less detail. As explained above, this can save energy and operating hours of the components. Optionally, between the determination and the reduction or limitation of the sensor configuration and / or the processing, a holding time can be waited in order to avoid an excessively rapid rhythm of the configuration changes.

[0046] As explained above, it is particularly advantageous to select vehicles and / or traffic situations with a plurality of traffic participants as technical systems. In these applications in particular, it is particularly helpful to be able to determine the describability and / or the masterability in advance in a large number of operating situations within the scope of the approval process and / or in the continuously running online control. Thus, for example, in the Euler-Lagrangian formalism, each traffic participant can be assigned a contribution to the kinetic energy T and a contribution to the potential energy V. In addition, all traffic participants are coupled to the system as a whole via initial conditions, boundary conditions, area conditions or other constraints. For example, a platoon of vehicles that stops at a red light and starts again after the light turns green does not behave like a collection of individual vehicles, but rather like a collective. This situation can be expressed by constraints alone; perception is not necessary.

[0047] It happens that during continuous operation, traffic situations can quickly develop from normal situations to critical situations, in which the simple modeling used previously may no longer be applicable. It happens that also in applications in vehicles, hardware resources for checking complete descriptions are scarce. The method proposed here can be dealt with using computing operations that can also be quickly implemented on embedded systems with small computing capacity and memory. Therefore, the method is advantageously implemented in real time on an embedded system that is included in or carried by the technical system.

[0048] The method can in particular be fully or partially computer-implemented. Therefore, the invention also relates to a computer program with machine-readable instructions, which, when executed on one or more computers, cause the one or more computers to implement the described method. In this sense, control devices for vehicles, virtual machines, computing instances in the cloud and other implementation environments, as well as embedded systems for technical devices, which are also capable of implementing machine-readable instructions, can be regarded as computers.

[0049] Likewise, the invention also relates to a machine-readable data carrier and / or a download product with the computer program. The download product can be transmitted via a data network, i.e. a digital product that can be downloaded by a user of the data network, which digital product can be sold for immediate downloading in an online store, for example.

[0050] Furthermore, one or more computers can be equipped with the computer program, the machine-readable data carrier or the download product.

[0051] Next, other measures for improving the present invention will be further presented in conjunction with the description of the preferred embodiments of the present invention according to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings show:

[0053] Figure 1 Embodiments of method 100;

[0054] Figure 2 Illustration of the functioning of the method 100 in two exemplary traffic situations 20 a and 20 b . DETAILED DESCRIPTION

[0055] Figure 1 The present invention is a schematic flow chart of an exemplary embodiment of a method 100 for checking to what extent the dynamics of the technical system 1 are completely described based on a predetermined operating situation 1a by detecting the state of the technical system 1 using a plurality of sensors 2a - 2c in combination with at least one differential equation 5 .

[0056] According to block 105 , in particular, for example, a vehicle 21 - 24 and / or a traffic situation 20 , 20 a , 20 b with a plurality of road users 21 - 24 can be selected as a technical system 1 .

[0057] In a step 110 , a dynamics function 4 is constructed which describes the predefined operating situation 1 a and the dynamics of the technical system 1 .

[0058] In step 120 , at least one differential equation 5 is formed from the dynamic function 4 .

[0059] According to block 111, in particular, for example, a Lagrangian function can be selected as a dynamic function, which contains the kinetic energy and potential energy of each entity that actively contributes to the dynamics of the technical system. Then, according to block 121, the Euler-Lagrangian equations can be formed as a system of partial differential equations 5 in the coordinates of the state space of the technical system 1 based on the derivatives of the Lagrangian function.

[0060] In step 130 , initial conditions, boundary conditions and / or area conditions 6 are ascertained for solving at least one differential equation 5 as a function of the predefined operating situation 1 a .

[0061] In step 140, it is checked whether the at least one differential equation 5 can be solved analytically. If this is the case (true value 1), then in step 150a it is determined that the detection using the sensors 2a-2c and the at least one differential equation 5 completely describe the dynamics of the system 1. Otherwise (true value 0), it is determined in step 150b that the detection using the sensors 2a-2c and the at least one differential equation do not completely describe the dynamics of the system 1.

[0062] This test may include, for example, in particular,

[0063] According to block 141 , for at least one differential equation 5 , one or more parameterized solution solutions are called from a predefined library,

[0064] According to block 142, solving one or more equations in the parameters of the solutions by substituting these solutions into at least one differential equation 5, and

[0065] According to block 143, it is checked whether the one or more equations can be solved.

[0066] In step 160 , in response to the determination 150 b that “the detections using the sensors 2 a - 2 c and at least one differential equation 5 do not fully describe the dynamics of the system 1 ,” the method 100 may be re-executed based on:

[0067] an expanded and / or qualitatively improved configuration of the sensors 2a-2c, and / or

[0068] Extended and / or more detailed processing of the measured values ​​3a-3c of the sensors 2a-2c to obtain the variables on which the dynamic function 4 depends.

[0069] If it is then determined that the dynamics of the system 1 are completely described, then in step 170 an expanded and / or qualitatively improved configuration of the sensors 2a-2c or an expanded and / or more detailed processing of the measured values ​​3a-3c is activated or remains activated.

[0070] Alternatively or also in combination, it is also possible for this purpose

[0071] In step 180 , the functionality of the technical system 1 is limited, the technical system 1 is put into a safe state or the technical system 1 is deactivated, and / or

[0072] In step 190 , the operator is asked to take over control of the system 1 .

[0073] In step 200, in response to the determination 150a that "the detections made using the sensors 2a-2c and at least one differential equation 5 completely describe the dynamics of the system 1", the method 100 may be re-executed based on:

[0074] a reduced and / or qualitatively limited configuration of the sensors 2a-2c, and / or

[0075] A reduced and / or less detailed processing of the measured values ​​3a-3c of the sensors 2a-2c to obtain the variables on which the dynamic function 4 depends.

[0076] If it is pointed out here that the dynamics of the system 1 are still not completely described, then in step 210, the configuration of the operation of the sensors 2a-2c can be reduced and / or limited in quality, or the further processing of the measured values ​​3a-3c of the sensors 2a-2c can be reduced and / or performed in less detail. As explained above, this can save energy and operating hours of components.

[0077] Figure 2 The effect of the method 100 is illustrated by taking two traffic situations 20a and 20b as examples. In step 110 of the method 100, a dynamic function 4 is constructed for each of the two traffic situations 20a and 20b, where a Lagrangian function L is used that is obtained based on kinetic energy T and potential energy V according to L=TV. In step 120, at least one differential equation 5 is obtained from the dynamic function 4, where the Euler-Lagrangian equation of the partial differential equation system is used.

[0078] Subsequently, in step 140 , it is checked whether at least one differential equation 5 can be solved analytically. This is respectively illustrated by a three-dimensional section from the phase space, which is expanded by the three generalized variables q1 , q2 and q3 .

[0079] The first traffic situation 20a is a simple traffic situation. Two vehicles 21 and 22 driving in opposite directions 21a and 22a are driving in opposite directions on a two-lane road 25, respectively, on the right-hand driving lane along their driving directions 21a, 22a. Figure 2 In the perspective of , there is a traffic sign 26 at the right road edge and a tree 27 at the left road edge. In order to describe the dynamics of this traffic situation 20a, a relatively simple configuration of sensors 2a-2c and a less laborious processing of the corresponding measured values ​​3a-3c are sufficient. The cross section from the phase space obtained on the basis of these still shows a stable dependence of the generalized variable q3 on the other two generalized variables q1 and q2, as expected from the analytical solution of at least one differential equation 5.

[0080] The second traffic situation 20b is significantly more complex. It involves a roundabout 28 with three entrances 29a-29c. In the roundabout 28, two vehicles 22 and 23 are already driving in the directions 22a and 23a. The third vehicle 24 just enters the roundabout 28 from the entrance 29b in the direction 24a. The fourth vehicle 21 intends to enter the roundabout 28 from the entrance 29a in the direction 21a, but must first let the vehicles 23 and 22 with the right of way pass. If the same sensor configuration and processing that are sufficient for the simple first traffic situation 20a are used to analyze this complex traffic situation 20b, then a singular point S in the form of a hole is obtained in the section from the phase space. This singular point S cannot be part of the analytical solution of the at least one differential equation 5. Then the at least one differential equation 5 has no analytical solution because the information contained in the dynamic function 4 from which the at least one differential equation is derived is insufficient.

[0081] The example of the roundabout 28 shows that the analytical solvability of at least one differential equation 5 also depends decisively on the initial conditions and the area conditions. Therefore, there, when there is less occupancy with vehicles 21-24 (which are also all sufficiently spaced from one another), there is a decidedly simpler traffic situation which can be fully analyzed using a simpler sensor configuration and processing.

Claims

1. A method (100) for checking to what extent the dynamics of a technical system (1) are completely described based on a predetermined operating condition (1a) by detecting the state of the technical system (1) using a plurality of sensors (2a-2c) in combination with at least one differential equation (5), comprising the steps of: Creating (110) a dynamics function (4) that describes the predetermined operating situation (1a) and the dynamics of the technical system (1), wherein: The dynamic function (4) depends on the measured values ​​(3a-3c) of the sensors (2a-2c) and / or on variables derived from these measured values ​​(3a-3c); Forming (120) at least one differential equation (5) from said dynamic function (4); Ascertaining (130) initial conditions, boundary conditions and / or area conditions (6) for solving the at least one differential equation (5) as a function of the predefined operating situation (1a). Checking (140) whether the differential equation (5) can be solved analytically under the obtained initial conditions, boundary conditions and / or regional conditions (6); as well as In response to "the at least one differential equation (5) can be solved analytically", it is determined (150a) that the detection performed using the sensors (2a-2c) and the at least one differential equation (5) fully describe the dynamics of the system (1).

2. The method (100) according to claim 1, wherein: As the dynamic function (4) a Lagrangian function is selected (111) which contains the kinetic energy and the potential energy of each entity that actively contributes to the dynamics of the technical system.

3. The method (100) according to claim 2, wherein: From the derivatives of the Lagrangian function, the Euler-Lagrange equations (121) can be formed as a system of partial differential equations (5) in the coordinates of the state space of the technical system (1).

4. The method (100) according to any one of claims 1 to 3, wherein: Checking (140) whether the at least one differential equation (5) can be solved analytically comprises, for the at least one differential equation (5), calling (141) one or more parameterized solution solutions from a predefined library, solving (142) one or more equations in the parameters of the solution by substituting the solution into the at least one differential equation (5), and • Checking whether the one or more equations can be solved (143).

5. The method (100) according to any one of claims 1 to 4, wherein: In response to determining (150b) that the detection using the sensors (2a-2c) and the at least one differential equation (5) do not fully describe the dynamics of the system (1), the method (100) is re-executed (160) based on: an expanded and / or qualitatively improved configuration of the sensors (2a-2c), and / or Extended and / or more detailed processing of the measured values ​​(3a-3c) of the sensors (2a-2c) in order to obtain the variables on which the dynamic function (4) depends.

6. The method (100) according to claim 5, wherein: In response to "determining (150a) that the dynamics of the system (1) are now fully described when the method is re-executed", an expanded and / or qualitatively improved configuration of the sensors (2a-2c) or an expanded and / or more detailed processing of the measured values ​​(3a-3c) is activated or remains activated (170).

7. The method (100) according to any one of claims 5 to 6, wherein: The extended and / or more detailed processing of the measured values ​​(3a-3c) of the sensors (2a-2c) is performed using additional computing tools and / or on additional computing instances in the cloud.

8. The method (100) according to any one of claims 1 to 7, wherein: In response to "determining (150b) that the detection performed using the sensors (2a-2c) and the at least one differential equation (5) do not fully describe the dynamics of the system (1)", limiting the functionality of the technical system (1), placing the technical system into a safe state or deactivating (180) the technical system, and / or • Requesting an operator to take over control (190) of the system (1).

9. The method (100) according to any one of claims 1 to 8, wherein: In response to "determining (150a) that the detections performed using the sensors (2a-2c) and the at least one differential equation (5) fully describe the dynamics of the system (1)", the method (100) is re-executed (200) based on: a reduced and / or mass-restricted configuration of the sensors (2a-2c), and / or A reduced and / or less detailed processing of the measured values ​​(3a-3c) of the sensors (2a-2c) in order to obtain the variables on which the dynamic function (4) depends.

10. The method (100) according to claim 9, wherein: In response to "it is determined (150a) that the dynamics of the system (1) are described completely as before when the method (100) is re-executed", the configuration of the operation of the sensors (2a-2c) is reduced and / or restricted in quality, or further processing of the measurement values ​​(3a-3c) of the sensors (2a-2c) is reduced and / or performed in less detail (210).

11. The method (100) according to any one of claims 1 to 10, wherein: A vehicle (21-24) and / or a traffic situation (20, 20a, 20b) with a plurality of road users (21-24) is selected (105) as the technical system (1).

12. The method (100) according to any one of claims 1 to 11, wherein: The method (100) is carried out in real time on an embedded system contained in the technical system (1) or carried by the technical system (1).

13. A computer program comprising machine-readable instructions which, when executed on one or more computers, cause the one or more computers to carry out the method (100) according to any one of claims 1 to 12.

14. A machine-readable data carrier and / or a download product with a computer program according to claim 13.

15. One or more computers with a computer program according to claim 13 and / or with a machine-readable data carrier and / or a download product according to claim 14.

Images