Method for checking system having plurality of individual components for jointly performing function by means of plurality of individual components

Abstract

The invention relates to a method for checking a system having a plurality of individual components (111, 112, 113, 120, 130, 140) for performing a function by means of the plurality of individual components (111, 112, 113, 120, 130, 140), comprising: initializing the individual components (111, 112, 113, 120, 130, 140) in a checking state, forming the system from the plurality of individual components (111, 112, 113, 120, 130, 140) as a network, checking the plurality of individual components (111, 112, 113, 120, 130, 140) in view of a potential fault, and obtaining a potential fault state for each of the plurality of individual components (111, 112, 113, 120, 130, 140), determining whether a current potential fault state is acceptable for the function to be performed, and if the current potential fault state is acceptable for the function to be performed, determining whether the current potential fault state is acceptable for the function to be performed. If so, a transition of the individual component (111, 112, 113, 120, 130, 140) from the test state to the operating state is released and the function to be executed is initiated.

Description

Technical Field

[0001] The invention relates to a method for testing a system having a plurality of individual components for jointly carrying out a function by means of the plurality of individual components, as well as a computing unit and a computer program for carrying out the method. Background Art

[0002] Safety-critical applications such as vehicles are now increasingly networked with external systems such as the cloud or edge systems. It is foreseeable that this networking will be so extensive that safety-critical functions and calculations will also be transferred from the vehicle to the cloud or edge. In order for this to also be possible for safety-related applications, effective safety mechanisms must be implemented therein. Current cloud computing technologies already offer corresponding diagnostic and robustness mechanisms (e.g. storage monitoring or distribution) at a technical level, but these have already been developed and are however usually not developed in accordance with safety standards, but are so-called "commercial off-the-shelf" (COTS) components.

[0003] These safety mechanisms may therefore also themselves contain faults, so-called latent faults, which, although they do not lead to a violation of the safety goal themselves, may be dangerous in combination with another single fault. Latent faults are not immediately visible and do not immediately impair the safety function of the system, but only become critical in combination with other faults. A typical example of this from embedded systems is a monitoring function that is "stuck", i.e. always emits a "no fault" signal even in the case of a fault in the monitored element (e.g. RAM) or in the case of a fault on the shutdown path, which prevents the system from being able to change to a safe state (e.g. shutting off the control signal of the electric motor) in the event of a single fault.

[0004] Therefore, starting from a certain safety integrity level (ASIL), ISO 26262:2018 explicitly requires monitoring with regard to latent faults and achieving target values ​​for HW metrics associated therewith (LFM: Latent Fault Metric). Summary of the invention

[0005] According to the invention, a method for testing a system having a plurality of individual components for jointly performing a function by means of a plurality of individual components, as well as a computing unit and a computer program for executing the method are proposed with the features of the independent patent claims. Advantageous embodiments are the subject matter of the dependent claims and the following description.

[0006] In distributed systems, such as reference Figure 1As described, it is difficult or even impossible to centrally monitor the functional capabilities of all safety mechanisms. Instead, components in such systems traditionally have to "blindly" trust the functional capabilities of other components. It is also impossible to centrally determine potential fault metrics along the signal chain in a distributed system.

[0007] Here, the invention now begins and describes—instead of a centralized diagnosis—a decentralized, distributed diagnosis and communication of potential faults along the corresponding signal chain or redundant signal paths.

[0008] In detail, a method is described, in particular for the distributed execution of safety-critical functions, in which individual components are initialized in a test state. The test state is in particular a safe state, i.e. a state in which a failure of an individual component has no effect on the functional capability of the system. The system is composed of a plurality of individual components as a network, and the plurality of individual components are tested with respect to potential faults, wherein a potential fault state is obtained for each of the plurality of individual components.

[0009] Determine whether the current potential fault state is acceptable for the function to be performed, and if the current potential fault state is acceptable for the function to be performed, release the transition of the single component from the test state to the running state and initiate the function to be performed. Otherwise, a fault response can be taken.

[0010] Advantageously, performing a potential fault check of at least one of the multiple single components for obtaining a potential fault state of at least one of the multiple single components includes at least one of the following: checking a shutdown path, performing a watchdog check, performing a memory check, performing a communication check, and performing program flow control.

[0011] When checking the shutdown paths, in particular a transition to a safe state (“safe state”) is initiated, i.e., for example, individual components are initialized in the test state and then tested for deactivation (transition to the “safe state”) within a predefined time period (“Fault Tolerant Time Interval”).

[0012] The execution of a watchdog check can include checking whether the watchdog present in a single component reacts, for example, by causing a fault counter to be incremented, a fault to be reported externally, or the system to be shut down, by deliberately deceiving the watchdog with a human error, for example, by giving an erroneous or delayed response. The term watchdog (Watchdog in English, also called watchdog timer) refers to a function for failure detection in digital systems, mainly in control applications. If a possible malfunction is detected here, this is either signaled to other components according to the system protocol (for example, switching to a redundant system), appropriate jump instructions or resets are introduced for automatic elimination of the failure (Ausfall), or a safe shutdown is caused.

[0013] Carrying out a memory check may include, in particular, checking the writability or the functionality of memory protection mechanisms (eg ECC, EDC).

[0014] Carrying out a communication check can include checking whether the communication fuses present in the individual components react, for example by causing a fault counter to be incremented, a fault to be reported externally, or the system to be shut down, by specifically generating faulty end-to-end fuse mechanisms (e.g. message counters, checksums, timeout monitoring).

[0015] The execution of the program flow control can include a check as to whether the program flow control existing in the individual components reacts by, for example, deliberately mis-sequencing the calculations, ie placing the calculations in an incorrect order.

[0016] It would also be conceivable to adapt the parameters of the potential fault diagnosis, such as the permissible waiting time in timeout monitoring, the permissible waiting time in system shutdown, the permissible number of faults in memory monitoring, the permissible deviation from a defined program sequence, etc., depending on the safety-critical function to be performed. For example, functions used in autonomous driving may be more safety-critical than functions of a navigation system or multimedia functions, for example, and therefore allow less waiting time, etc.

[0017] Preferably, checking a plurality of individual components with regard to potential faults comprises: querying the potential fault state of a first individual component of the plurality of individual components by a second individual component of the plurality of individual components. In particular, mutual monitoring can be performed thereby. The potential fault state can, for example, include "potential fault exists", "potential fault is suspected" or "no potential fault", wherein, for example, values ​​between "0" (none) and "1" (definite fault) can be output with any subdivision. Advantageously, it is also evaluated, for example, by a timestamp: whether the state is outdated, i.e. whether a new potential fault diagnosis should be started.

[0018] Alternatively or in addition to querying a potential fault state, a potential fault check of a first individual component of the plurality of individual components can also be performed by a second individual component of the plurality of individual components, i.e., the second individual component does not query the test result of the first individual component, but directly checks the first individual component. The first and second individual components can be selected arbitrarily, for example, from a computing unit (control device) in the vehicle, a sensor in the vehicle, a computing unit in the environment of the vehicle, for example, an infrastructure component (e.g., a so-called "edge" computing unit), a computing unit in a computing center (e.g., a so-called "cloud" computing unit).

[0019] Particularly preferred fault responses for the present invention can be performed at different levels. For example, a single component such as a computing unit can request an update of software (such as firmware, etc.) or change resources reserved for safety functions (such as RAM, ROM, CPU, etc.).

[0020] At the network level, instead of a planned but faulty individual component, another fault-free individual component can be used for function execution. Alternatively or additionally, the fault state can be communicated in the network so that it is also known for other planned function executions. In particular, an entry can also be made in a global fault memory taking into account rules for entering and overwriting fault states (e.g. based on the integrity / trustworthiness of the entry).

[0021] On a system level, functions can be shifted to other systems. Alternatively or additionally, mitigation measures can be taken, such as limiting behavior or driving to a safe location, for example also near the workshop. In order to guarantee the transition to a safe state, various shutdown paths (e.g. SW paths or physical systems) can be combined.

[0022] The present invention therefore allows, in particular:

[0023] 1) Mutual diagnosis between individual elements of the overall system, such as component-component, cloud / edge-cloud / edge, cloud / edge-vehicle, cloud / edge-sensor, vehicle-sensor, etc.

[0024] 2) The detected fault is communicated to all (or connected) systems or components of the overall system, for example via:

[0025] a) Decentralized fault management, such as broadcasting, pub / sub of current status, metadata exchange between connected components

[0026] b) Centralized fault management, e.g. storing the current state in a global memory that can be queried when needed

[0027] 3) A component is used to perform a safety-related function only after the safety mechanism connected to the component has been (negatively) checked with respect to a potential fault.

[0028] 4) Mitigating the potential faults found by using components available in the overall system, for example to relocate functionality so that an update / reinstallation can be performed.

[0029] The invention advantageously leads to a reduction in undetected latent faults in the distributed system and an increase in safety or robustness against multiple faults. Furthermore, the transition of safety-critical systems / actuators to a safe state is ensured in the distributed system. The invention also provides the possibility of selecting a configuration for distributed functions in the distributed system which does not exceed the required maximum value of the latent fault metric. As a side effect, it is also difficult for an attacker to replace a module integrated into the mutual diagnosis (increased “safety”) or to introduce false messages (spoofing) into the network in an unrecognized manner.

[0030] A computing unit according to the present invention, for example a control unit of a vehicle, or an apparatus according to the present invention composed of a plurality of computing units is designed, in particular in terms of programming, to carry out the method according to the present invention.

[0031] It is also advantageous to implement the method according to the invention in the form of a computer program or computer program product with a program code for executing all method steps, because this causes particularly low costs, especially when the execution control device is still used for other tasks and therefore originally exists. Finally, a machine-readable storage medium is provided, with a computer program as described above stored thereon. Suitable storage media or data carriers for providing computer programs are especially magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, etc. It is also possible to download programs via computer networks (Internet, intranets, etc.). Such downloading can be done wired or cabled or wirelessly (e.g., via WLAN networks, 3G, 4G, 5G or 6G connections, etc.).

[0032] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0033] The invention is schematically illustrated in the drawings with the aid of one embodiment / embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A system for carrying out a function by means of a plurality of individual components, on which the present invention may be based, is schematically shown.

[0035] Figure 2A preferred embodiment of the method according to the invention is schematically shown in a flow chart. DETAILED DESCRIPTION

[0036] exist Figure 1 , a device according to a preferred embodiment of the invention is shown by way of example, in which the invention can be advantageously used. In particular, a plurality of individual components are shown there, which can each have at least one computing unit or can provide computing power. In particular, these are computing units 111, 112, 113, etc. in a vehicle 110, which, without limiting the generality, is intended to represent the core or center of a system for executing functions via a plurality of individual components. The computing units can be, in particular, so-called vehicle computers, entertainment systems, intelligent sensor systems, control devices, etc.

[0037] For example, during normal driving, the vehicle 110 can be in contact with other vehicles 120 and computing units present therein, infrastructure components 130, such as traffic guidance systems, charging posts, traffic signals and computing units present therein (so-called "edge" computing units), computing units in a computing center 140 (so-called "cloud" computing units), etc. The own and external computing units each have a specific computing capacity, but the own and external computing units cannot permanently use the specific computing capacity themselves and can therefore also provide the specific computing capacity externally. By jointly using the computing capacity provided by many individual components, for example, it is also possible to execute expensive functions in a vehicle whose own computing capacity would not be sufficient for this.

[0038] However, depending on what the function to be executed involves, it is necessary that the individual components or computing units involved in the execution of the function work as far as possible (or certainly) without failure. This can be checked according to a preferred embodiment of the present invention, as shown below with reference to Figure 2 The embodiment is explained.

[0039] In particular, in this case, for example in the vehicle or also externally, a (random) computing unit is provided as a superordinate instance which monitors, starts or even executes the following steps.

[0040] In step 201 , the individual components are initialized in a test state, ie in a state in which a possible fault has no system-wide effects, since in particular planned (possibly safety-critical) functions have not yet been executed.

[0041] In step 202, the system is constructed as a network, that is, as components in data communication with one another, from the existing plurality of individual components. In particular, suitable individual components are selected from all theoretically available individual components, wherein this selection can be made, for example, based on the available computing power, the necessary data transmission duration between the individual components, etc.

[0042] In step 203, the single components are checked for potential faults, and a potential fault state is obtained for each of the single components. The potential fault state can be, for example, a value between 0 and 1, where 0 means that the single component is definitely free of potential faults, and 1 means that the single component definitely has a potential fault. The value between 0 and 1 can characterize the probability of a potential fault or the severity of a potential fault.

[0043] In step 204, it is determined whether the current potential fault state is acceptable for the function to be performed. For example, a safety-critical function may require a lower potential fault state than a function such as improving driving comfort or for recreation.

[0044] If the current potential fault state is acceptable for the function to be performed (branch “1”), then in step 205 , the transition of the single component from the test state to the operating state is released and the function to be performed is initiated.

[0045] If the current potential fault state is not acceptable for the function to be performed (branch “0”), a fault response is performed in step 206 .

[0046] For example, a single component such as a computing unit may request an update of software (eg, firmware, etc.) or a change in resources (eg, RAM, ROM, CPU, etc.) reserved for security functions.

[0047] At the network level, instead of a planned but faulty individual component, another fault-free individual component can be used for function execution. Alternatively or additionally, the fault state can be communicated in the network so that it is also known for other planned function executions. In particular, taking into account rules for entering and overwriting fault states (e.g. based on the integrity / trustworthiness of the entries), an entry can also be made in a global fault memory.

[0048] On a system level, functions can be shifted to other systems. Alternatively or additionally, mitigation measures can be taken, such as limiting behavior or driving to a safe location, for example also near the workshop. In order to guarantee the transition to a safe state, various shutdown paths (e.g. SW paths or physical systems) can be combined.

Claims

1. A method for testing a system having a plurality of individual components for performing a function by means of the plurality of individual components, comprising the following steps: Initializing (201) the individual components (111, 112, 113, 120, 130, 140) in a test state, The system is constituted (202) by the plurality of single components (111, 112, 113, 120, 130, 140) as a network, In view of the latent fault checking (203) of the plurality of single components (111, 112, 113, 120, 130, 140), and obtaining a latent fault state for each of the plurality of single components (111, 112, 113, 120, 130, 140), determining (204) whether the current potential fault state is acceptable for the function to be performed, If the current potential fault state is acceptable for the function to be performed, the transition of the single component (111, 112, 113, 120, 130, 140) from the test state to the operating state is released (205) and the function to be performed is initiated.

2. The method according to claim 1, wherein checking (203) the plurality of individual components (111, 112, 113, 120, 130, 140) with respect to potential faults comprises: A potential fault check is performed on at least one of the plurality of single components (111, 112, 113, 120, 130, 140) to obtain a potential fault state of at least one of the plurality of single components (111, 112, 113, 120, 130, 140).

3. The method according to claim 2, wherein performing a potential fault check on at least one of the plurality of single components (111, 112, 113, 120, 130, 140) to obtain a potential fault state of at least one of the plurality of single components (111, 112, 113, 120, 130, 140) comprises at least one of the following: Check shutdown paths, perform watchdog checks, perform memory checks, perform communication checks, and perform program flow control.

4. The method according to any one of the preceding claims, wherein checking (203) the plurality of individual components (111, 112, 113, 120, 130, 140) with respect to potential faults comprises: A potential fault state of a first single component among the plurality of single components (111, 112, 113, 120, 130, 140) is queried through a second single component among the plurality of single components (111, 112, 113, 120, 130, 140).

5. The method according to claim 4, wherein the potential failure state includes a creation time point, and further comprises: If the creation time point of the potential failure state of the first single component among the multiple single components (111, 112, 113, 120, 130, 140) is outdated, re-execution of the potential failure check of the first single component among the multiple single components (111, 112, 113, 120, 130, 140) is initiated.

6. The method according to any one of the preceding claims, further comprising: A potential failure metric is calculated from the potential failure states of the plurality of individual components (111, 112, 113, 120, 130, 140).

7. A computing unit (111, 112, 113) which is configured to carry out all method steps of the method according to any of the preceding claims. 8 . A computer program which, when executed on a computing unit, causes the computing unit to execute all method steps of the method according to claim 1 .

9. A machine-readable storage medium having stored thereon the computer program according to claim 8.

Images