Method and system for verifying behavior planner of at least partially automated vehicle

Abstract

A computer-implemented method for verifying a behavioral planner of an automated vehicle is proposed. The behavior planner has a database with predefined local contexts and at least one evaluation model for each local context in order to decompose a given context into local contexts of the database and to determine boundary conditions for allowed behavior options of the vehicle in the given context on the basis of the associated evaluation model. An evaluation model of the local context is provided in a declarative program representation, which enables the determination of boundary conditions that are explorable by the vehicle in the form of allowed behavioral options in the respective local context. At least one test context is specified as a composition of the selected local context. To this end, declarative program representations of the evaluation model of the selected local context are combined into a combined program representation of the evaluation model. Then, formally explorable boundary conditions for allowed behavioral options of the vehicle in the test context are determined based on the combined program representation of the evaluation model.

Description

Technical Field

[0001] The invention relates to a computer-implemented method and system for verifying a behavior planner of an at least partially automated vehicle, which is also referred to below as the ego vehicle. A database with previously defined local situations and at least one evaluation model for each local situation is available to the behavior planner in question in order to decompose a given situation into local situations of the database and to determine boundary conditions for permissible behavior options of the vehicle in the given situation based on the associated evaluation models, and also as a combination of boundary conditions of the individual local situations. Background Art

[0002] Such a behavior planner is described in DE 10 2022214276.

[0003] The so-called SOCA method is introduced in the publication "SOCA: Domain Analysis for Highly AutomatedDriving Systems," 2020IEEE 23rd International Conference on IntelligentTransportation Systems (ITSC), 2020, pp. 1-6, doi: 10.1109 / ITSC45102.2020.9294438 by M.Butz et al. With the help of the SOCA method, traffic situations are analyzed with the goal of determining the boundary conditions or requirements for the behavior of the automated ego vehicle in the corresponding traffic situation. To this end, an abstract description of the traffic situation to be analyzed is first generated. This description uses a so-called zone graph. The zone graph abstracts the traffic situation to be analyzed by representing the real road situation through corresponding abstract traffic infrastructure elements (static road geometry) with different areas, which are related to the driving intention of the ego vehicle, but first of all, neither their size nor their position is specified. Different areas can represent different map areas, possible traffic flows, objects, etc. Based on this abstract description of the traffic situation, the possible development or behavior of the participating traffic participants is then determined and morphologically analyzed in order to thereby determine the boundary conditions for the behavior of the ego vehicle in the analyzed traffic situation. It should be noted that the results or boundary conditions obtained in this way are firstly applicable to all traffic situations with the same area diagram. The specification is only carried out by data provision of the results with situation-specific parameters of the analyzed traffic situation.

[0004] The SOCA approach enables the analysis and formalization of individual traffic scenarios. Although individual scenarios can be partially generalized by parameterization, the requirements on the behavior of the ego vehicle in a complex operational design domain (ODD) cannot be formalized with this approach. This is crucially because the constraints and requirements on the behavior of the ego vehicle are imposed by various elements of the ODD and these may appear repeatedly in different contexts. SOCA approaches that focus on individual traffic scenarios are not sufficiently scalable for this purpose.

[0005] A database with predefined local scenarios and the associated evaluation models is important for the performance of the behavior planner discussed here. The definition of local scenarios plays a special role here. Therefore, as far as possible all operating conditions and usage scenarios of the ego vehicle set according to the ODD should be able to be decomposed into local scenarios of the database, that is, the database must include corresponding various local scenarios. In addition, each local scenario should be "customized" so that the associated evaluation model considers all influencing variables on the behavior of the ego vehicle as much as possible in a differentiated manner, and predetermines the corresponding boundary conditions for the allowed behavior of the ego vehicle in this local scenario. Summary of the invention

[0006] The present invention proposes measures for systematically testing a behavior planner of the type discussed here. In addition to verifying a behavior planner for a given ODD, these measures also allow the evaluation of the behavior planner's database. This makes it possible to test, in particular, the extent to which previously defined local situations and the associated evaluation models are adequate for specific limit situations of the ODD.

[0007] According to the invention, this is achieved in that an evaluation model of a local situation is provided in a declarative program representation, which makes it possible to determine formally explorable boundary conditions of the permissible behavior options of the vehicle in the corresponding local situation. Verification is performed based on a test situation that is pre-given as a synthesis of the selected local situation. The result of the behavior planner for the test situation pre-given in this way is determined in that the declarative program representation of the evaluation model of the selected local situation is first combined into a combined program representation of the evaluation model. Then, based on the combined program representation of the evaluation model, the formally explorable boundary conditions of the permissible behavior options of the vehicle in the pre-given test situation are determined.

[0008] According to the invention, it has been recognized that methods from the field of declarative problem-solving, which were developed in the context of knowledge representation, logic programming, satisfiability solving and database theory, can also be advantageously used when verifying an action planner of the type discussed here. In the case of methods for declarative problem solving, complex tasks are described in the form of a declarative program representation, which makes it possible to use efficient software tools to find a solution for the described task, so-called solver tools. Furthermore, the declarative program representations of subtasks can be easily combined so that the resulting combined program representation can then be used as a basis for solving the overall task.

[0009] For the use of these methods according to the invention, it has proven to be advantageous that the evaluation model of the local situation is usually already available in a declarative form, which can either be used directly as a declarative program representation or can be converted into it very simply. Furthermore, according to the invention, it is utilized that the solution generated in this way is formally explorable. This allows the boundary conditions of the solution, in this case the permissible behavior of the vehicle, to be analyzed automatically, which is essential for the comprehensive verification of the behavior planner.

[0010] According to the invention, the concept of local scenarios is used to construct test scenarios for validation purposes. This allows "interesting" scenarios for the autonomous vehicle to be examined and also to be discovered incrementally and in a tool-assisted manner. What is considered an "interesting" scenario depends on the goal of the analysis. Typically, these are scenarios that are particularly challenging for the system. This includes, for example, scenarios in which no behavior options are available to the autonomous vehicle according to the behavior planner that satisfy all the scenario-dependent boundary conditions required by the evaluation model. Such scenarios are called dilemma scenarios.

[0011] The verification method according to the invention thus enables a systematic formalization and exploration of a given ODD, for example as a release argument for a behavior planner of the type discussed here. In addition, the verification method can be used to automatically identify critical situations in a given behavior framework of the ego vehicle and to derive corresponding test situations. In addition, the verification method according to the invention can be used advantageously within the scope of a development process, namely when defining local situations of a database of a behavior planner. In query cycles with incremental configuration of local situations, the set of local situations and the associated evaluation models can be systematically expanded and improved in order to configure a behavior planner for a pre-given ODD.

[0012] In principle, there are various possibilities for defining local contexts for an action planner of the type discussed here and for implementing and representing the associated evaluation model.

[0013] In a preferred embodiment of the invention, each local situation is defined as a situation class, which is at least partially determined by the ego vehicle with a behavior model, at least one traffic infrastructure element and a general situation context. Optionally, the definition of the local situation can also still include at least one other traffic participant with a behavior model. Each local situation and the associated evaluation model can be parameterized in a situation-specific manner and / or can be instantiated by data supply using situation-specific information. In this embodiment of the invention, the pre-determination of the test situation not only includes the selection of a suitable local situation of the database, but also includes parameterizing and / or instantiating the selected local situation or evaluation model in a defined manner.

[0014] The local scenarios defined in this way can be combined very flexibly in order to construct complex scenarios. For this purpose, for example, multiple instances of the same local scenario with different parameterizations and / or data supplies can also be used to construct complex scenarios. As an example of such a complex scenario, a pedestrian crossing should be mentioned here, in the environment of which multiple pedestrians move at individual speeds and orientations, while the ego vehicle approaches the pedestrian crossing. Such a complex scenario can be constructed simply from multiple instances of local scenarios, each of which includes the ego vehicle and the pedestrian crossing as an element of the traffic infrastructure and exactly one pedestrian.

[0015] As already mentioned, the database of previously defined local situations should be arranged as far as possible in such a way that many different traffic situations and in particular the most common traffic situations of the ODD of the ego vehicle can be completely resolved into local situations of the database. On the one hand, the local situations should be general, so that they occur in as many different traffic situations as possible, but on the other hand, they should also be specific, so that the associated evaluation model has a certain persuasiveness.

[0016] A very effective method for analyzing traffic situations with the goal of determining the boundary conditions of the behavior of an automated ego vehicle in a corresponding traffic situation is the SOCA method described at the beginning. The SOCA method is also suitable for defining local situations and generating evaluation models of local situations as used by behavior planners of the type discussed here. In this case, the evaluation model is based on the decomposition of the corresponding local situation into a regional graph and the morphological behavior analysis of the participating traffic participants. The evaluation model is generated here in the form of a Zwicky box. The Zwicky box is a completely formalized description of the boundary conditions or constraints of the allowed behavior of the ego vehicle in the corresponding local situation, and is all meaningful instantiations for this local situation. The entirety of the allowed behavior defined in this way for the local situation is also called the "partial behavior constraint space".

[0017] The Zwicky boxes generated with the aid of the SOCA method can be combined very easily and flexibly—like the associated local situations—in order to determine the boundary conditions for the permissible behavior of the ego vehicle in the complex situation constructed in this way.

[0018] The combination of evaluation models of multiple local situations of a test situation must take into account the fact that some local situations or instances of local situations can interact and, if necessary, even exclude each other. If the evaluation models of the local situations of the behavior planner to be verified do not already exist in the declarative program representation required according to the invention, then in one embodiment of the verification method according to the invention, the evaluation models are transformed into such a declarative program representation, and the semantics of the combination of the evaluation models is maintained. That is, each arbitrary combination of the transformed evaluation models provides the same boundary conditions for the permissible behavior of the ego vehicle as the corresponding combination of the evaluation models of the database of the behavior planner.

[0019] Answer set programming, as described, for example, in the publication G. Brewka, T. Eiter, M. Truszczynski, "Answer Set Programming at a Glance" in CACM, Dec 2011, Vol. 54, No. 12, pp 93–103, is particularly suitable as a declarative program representation for the verification method described here. Answer set programming (ASP) is a declarative problem solving paradigm for which a collection of efficient ASP solvers has been developed and is also available. This makes it possible to model complex tasks, such as behavior planning, and also to find solutions for these tasks.

[0020] As already mentioned, the test scenarios are usually selected such that they are within a predefined operational design domain (ODD). Advantageously, the test scenarios are predefined automatically, in particular by means of a test configuration database, in which at least the following data are stored for each test scenario:

[0021] Data identifying each local context of the test context,

[0022] Data used to parameterize each local context, and / or

[0023] Data used to instantiate each local context.

[0024] In a preferred improvement of the method according to the invention, a result database is generated in which the formally explorable boundary conditions of the permitted behavior options of the vehicle, which are determined for each pre-given test scenario, are stored. Then, for example, a search query defined in advance by a suitable analysis tool can be automatically searched in this result database to identify specific test scenarios and / or specific behavior options of the vehicle, such as fallback behavior options. In this way, it can be checked whether the behavior planner uses the database available to the behavior planner to provide acceptable behavior options in all possible scenarios of the ODD. For example, the evaluation of the behavior options can be carried out in a data-based manner or by comparison with simulation results, by expert assessment or by using behavioral studies of test personnel. Then, based on such an evaluation, if necessary, the database can be supplemented by further local scenarios and / or the existing local scenarios of the database can be modified.

[0025] In addition to the verification method explained above, a computer-implemented system for verifying a behavior planner of the type discussed here is also claimed. According to the invention, such a system comprises a transformation tool for generating a declarative program representation of an evaluation model of a database of the behavior planner, wherein the transformation tool is designed so that the semantics of the combination of the evaluation models is representation-independent. Furthermore, the system according to the invention comprises a synthesis tool for generating a combined program representation as a combination of declarative program representations of the evaluation models, in particular a combination of declarative program representations of the evaluation models of selected local scenarios, the synthesis of which represents a pre-given test scenario. Based on the combined program representation, formally explorable boundary conditions of the allowed behavior options of the vehicle in the test scenario can then be determined.

[0026] In a preferred embodiment of the invention, the transformation tool is designed to transform an evaluation model into an answer set program representation, wherein the evaluation model is based on a decomposition of the corresponding local situation into an area graph and a morphological behavior analysis of the participating traffic participants (SOCA method) and exists in the form of a Zwicky box.

[0027] The synthesis tool is preferably designed to select a corresponding partial scenario of the database for each test scenario and to parameterize and / or instantiate the selected partial scenario in a test scenario-specific manner. Advantageously, for this purpose, the synthesis tool is provided with a configuration database in which at least the following data are stored for each test scenario:

[0028] Data identifying each local context of the test context,

[0029] Data used to parameterize each local context, and / or

[0030] Data used to instantiate each local context.

[0031] In a preferred development of the invention, the system further comprises a result database for storing test results in the form of formally explorable boundary conditions of permissible behavior options of the vehicle that have been determined for a predetermined test scenario, wherein a search in the result database can be automatically performed with the aid of a predefined search query in order to identify specific test scenarios and / or specific behavior options for the vehicle. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Embodiments and advantageous improvements of the present invention are explained in more detail below with reference to the drawings.

[0033] Figure 1 The concept of a local context used for behavior planning of an ego vehicle and its role in the verification method according to the present invention are explained.

[0034] Figure 2 The authentication method according to the invention and a corresponding system are explained according to one exemplary embodiment.

[0035] Figure 3 The authentication concept according to the invention is explained with the aid of a block diagram. DETAILED DESCRIPTION

[0036] The appropriate definition of local situations that can be formalized independently of one another and analyzed with the aid of the associated evaluation models is important for the behavior planner discussed here. Each evaluation model defines the boundary conditions of the permissible behavior options of the ego vehicle in the corresponding local situation, i.e. the "partial behavior constraint space". The appropriately defined local situations together with the associated evaluation models form the database of the behavior planner. This database is also a prerequisite or subject of the verification according to the invention. With such a database, a large number of more or less complex traffic situations can be combined or constructed.

[0037] Figure 1The concept of local context and its use within the scope of the present invention are explained. The current local context is a context class that is abstractly described by specific characteristics or elements. The description of the local context 10 shown here basically includes three elements: the self-vehicle 11, the abstract traffic infrastructure element 12 and the other traffic participants 13. Each of these three elements 11, 12 and 13 is characterized by a model, a rule, a state parameter and / or a state variable. Thus, in the embodiment shown here, the self-vehicle 11 is characterized by its driving intention, dynamic state variables (such as speed, acceleration and orientation), system parameters (such as technical vehicle characteristic variables) and a behavior model (such as defensive driving or sporty driving). The abstract traffic infrastructure element 12 can be, for example, an intersection, a street intersection or a road section. This is characterized here by an area map according to the SOCA method and by the traffic rules applicable to the traffic infrastructure element, that is, for example, "right-hand vehicle first (rechts vor links)". Here, the other traffic participants 13 are also characterized by their "movement" intention and dynamic state variables and by a behavior model, with which assumptions can be made about the behavior of the other traffic participants. Elements 11, 12 and 13 are embedded in a general situational context 14, which contains not only general context parameters 15 but also general behavior models 16 of traffic participants. As general context parameters 15, road condition parameters, weather parameters and light parameters should be mentioned here as examples. The general behavior model 16 can include motion models for categories of traffic participants such as pedestrians, cyclists, motorcyclists, and drivers of passenger vehicles, and can model the interactions between traffic participants if necessary. The behavior model 16 can be modeled, for example, by a continuous motion model in the form of differential equations, by a Markov decision process or by a discrete behavior space. The local situation 10 is defined by all these elements 11 to 16. Each of these elements 11 to 16 can limit the allowed behavior of the ego vehicle. In order to be taken into account in behavior planning, all these influence sources must be explicitly described and / or mapped as formal parameters or decision alternatives in a "constrained behavior space".

[0038] The local situations 10 defined in this way and the associated evaluation models 17 can be parameterized and instantiated by data provision. In the case of behavior planning, the local situations identified in a given situation are provided with data using situation-specific information and are thus configured according to the given situation. Within the scope of the verification method according to the invention, test situations are combined or constructed by combining and appropriately providing data to selected local situations or associated evaluation models.

[0039] In the case of the exemplary embodiment described here, the local situation 10 is analyzed by means of the SOCA method. This generates an evaluation model 17, which can be used as a basis for analyzing all instances of the local situation 10. The evaluation model 17 is in the form of a Zwicky box or a set of Zwicky boxes. The evaluation model 17, which is accordingly supplied with data, then provides the boundary conditions of the permissible behavior options of the ego vehicle in the respective instance of the local situation 10.

[0040] According to the present invention, the evaluation model of the local context should be available in a declarative program representation, which enables the formally explorable boundary conditions of the allowed behavior options of the vehicle in the corresponding local context to be determined. Although the Zwicky box is a declarative representation form, the declarative representation form cannot be automatically supplied with data, and the boundary conditions of the allowed behavior options of the ego vehicle in the corresponding instance of the local context 10 determined by means of the Zwicky box do not exist in a formally explorable form at first. Therefore, the Zwicky box 17 of the local context 10 is transformed into a suitable declarative program representation 18, using which the boundary conditions of the allowed behavior options of the vehicle can be determined in a formally explorable form. It is important to maintain the combined semantics of the evaluation model when transforming the evaluation model, that is, the semantics of the combined evaluation model is independent of the representation. In the embodiment described here, the Zwicky box 17 is transformed into an answer set program representation 18. A transformation tool 21 is provided for this purpose.

[0041] Figure 2 The concept of verification according to the invention of a behavior planner of the type discussed here is explained. The behavior planner comprises a database with a large number of different local situations 20, which are described here as combined Figure 1 Each of these local situations 20 represents a set of influence sources (local behavior constraint sources) that restrict the permissible behavior of the ego vehicle in the respective local situation. The database of the behavior planner further comprises at least one evaluation model 27 for each local situation 20. These evaluation models 27 define the boundary conditions of the permissible behavior options of the ego vehicle in the respective local situation 20, i.e., respectively define a "local behavior constraint space". As shown in Figure 1 As in the case of , the evaluation model 27 first exists in the form of a Zwicky box. With the help of a transformation tool 21, the Zwicky box 27 is transformed into an answer set program 28, which provides a formally explorable representation of the boundary conditions of the allowed behavior options of the ego vehicle in the corresponding local situation 20.

[0042] According to the verification method of the present invention, a test scenario is constructed, and it is a synthesis of the selected local scenarios constructed as a database. Based on the evaluation models of the selected local scenarios, and according to the present invention, these test scenarios are analyzed based on the transformed declarative program representations of these evaluation models. With the help of a synthesis tool 22, a combined program representation 24 is generated for each test scenario as a combination of the declarative program representations of the evaluation models of the selected local scenarios. The synthesis tool 22 can access a configuration database 23, in which data for identifying the various local scenarios of the test scenario and data specific to the test scenario for parameterizing and instantiating the corresponding local scenarios are stored. Thus, the combined program representation 24 supplied with data in this way provides the formally explorable boundary conditions of the allowed behavior options of the self-vehicle in the corresponding test scenario as a result. In the embodiment shown here, the results of the query / exploration are compiled in a result database 25 and provided to a user 26. Since the results are formally explorable, a search query expressed in a corresponding manner can be used to automatically search for specific test scenarios in the result database 25. For this purpose, in the case of an ASP representation of the results, a series of known tools are available, such as for example “clingo” which is described in more detail under https: / / potassco.org / .

[0043] It is important to compose very different and more or less complex test scenarios from the local scenarios of the database. The boundary conditions of the permissible behavior options of the ego vehicle in such a test scenario can be determined by logically linking the boundary conditions of all local scenarios of the test scenario. Redundant information for the ego vehicle is eliminated here and the remaining boundary conditions can simply be linked to each other. This applies to the Zwicky box representation of the evaluation model 27 and also to the transformed evaluation model 28 in the ASP representation. The semantics of the combination of the evaluation models is therefore maintained when transforming to a declarative program representation.

[0044] exist Figure 3 In the block diagram of FIG. 3 , the verification concept according to the present invention is divided into three phases: a basic phase 31 , a configuration phase 32 and an exploration phase 33 .

[0045] In a basic phase 31 , an evaluation model 27 of the database of the behavior planner to be verified is transformed into a declarative program representation 28 , in the present exemplary embodiment from a Zwicky box 27 into an ASP representation 28 , by means of a transformation tool 21 .

[0046] In the configuration phase 32, the results, i.e. the boundary conditions of the permissible behavior options of the ego vehicle, are determined for the test scenarios of the combination of the selected partial scenarios constructed as a database. To this end, for each test scenario, the ASP representation of the corresponding partial scenario or the associated evaluation model is first selected - box 321. These are then parameterized and instantiated specifically for the test scenario - box 322. The ASP representations thus supplied with data are ultimately combined into a combined program representation 323 of the evaluation model.

[0047] In the exploration phase 33, the resulting combined ASP representation 323 is analyzed with the aid of an ASP solver tool 331. Depending on the analysis goals, special search queries 332 can also be placed here, for example to identify dilemma situations. In any situation, the ASP solver tool 331 provides analysis results 333 in the form of boundary conditions of the allowed behavior options of the ego vehicle in the corresponding test situation.

[0048] Finally, it should be mentioned again in detail that the verification method according to the invention can be used both for authorization demonstration and within the scope of developing a behavior planner of the type discussed here, i.e. when generating a database for a behavior planner and in particular when defining local situations, because the analysis of the results of the verification method allows conclusions to be drawn about the quality of the definition of the individual local situations.

Claims

1. A computer-implemented method for validating a behavior planner of an at least partially automated vehicle, A database with previously defined local situations (10; 20) and at least one evaluation model (17; 27) for each local situation (10; 20) is provided to the behavior planner in order to decompose a given situation into local situations (10; 20) of the database and to determine the boundary conditions of the permissible behavior options of the vehicle in the given situation based on the associated evaluation model (17; 27), and as a combination of the boundary conditions of the individual local situations, characterized in that the evaluation model (17; 27) of the local context (10; 20) is provided in a declarative program representation (18; 28) which enables the determination of formally explorable boundary conditions of permissible behavior options of the vehicle in the respective local context (10; 20), at least one test scenario is predefined as a synthesis of the selected partial scenario, · composing the declarative program representation (28) of the evaluation model of the selected local context into a combinatorial program representation (24) of the evaluation model, and Determining formally explorable boundary conditions of permissible behavior options of the vehicle in the test scenario based on the combined program representation (24) of the evaluation model.

2. The method according to claim 1, characterized in that Each local context (10) is defined as a context class, the context class being determined at least in part by at least one of the following elements: · Ego vehicle (11) with behavior model, at least one transport infrastructure element (12), General situational context (14), and at least one further road user (13) having a behavior model, Each local scenario (10) together with the associated evaluation model (17) can be parameterized in a scenario-specific manner and / or can be instantiated by supplying data with scenario-specific information, and the predefined test scenario includes a parameterization and / or instantiation that defines a selected local scenario (10) or an associated evaluation model (17).

3. The method according to any one of claims 1 or 2, characterized in that At least part of the evaluation model (27) is based on a decomposition of the respective local situation (20) into an area map and a morphological behavior analysis of the participating traffic participants (SOCA method) and is generated in the form of a Zwicky box (27).

4. The method according to any one of claims 1 to 3, characterized in that The evaluation models (27) of the local contexts (20) are respectively transformed into declarative program representations (28), which enable the determination of formally explorable boundary conditions of the permissible behavior options of the vehicle in the corresponding local contexts (20), in particular into answer set program representations, so that the semantics of the combination of the evaluation models (27, 28) is independent of the representation.

5. The method according to any one of claims 1 to 4, characterized in that The test scenarios are selected such that they lie within a predefined operational design domain (ODD).

6. The method according to any one of claims 1 to 5, characterized in that The test scenarios are automatically predefined, in particular by means of a configuration database (23), in which at least the following data are stored for each test scenario: a. Data for identifying each local context of the test context, b. Data used to parameterize each local context, and / or c. Data used to instantiate each local context.

7. The method according to any one of claims 1 to 6, characterized in that A result database (25) is generated in which formally explorable boundary conditions of permissible behavior options of the vehicle, which are determined for each predefined test scenario, are stored.

8. The method according to claim 7, characterized in that A search is automatically performed in the result database (25) by means of a previously defined search query in order to identify specific test scenarios and / or specific behavior options for the vehicle.

9. A computer-implemented system for validating a behavior planner of an at least partially automated vehicle, A database with previously defined local situations (20) and at least one evaluation model (27) for each local situation (20) is provided to the behavior planner, so as to decompose a given situation into the local situations (20) of the database and determine the boundary conditions of the permissible behavior options of the vehicle in the given situation based on the associated evaluation model (27), and as a combination of the boundary conditions of the individual local situations (20), the system at least comprising: a transformation tool (21) for generating a declarative program representation (28) for an evaluation model (27) of a database of the behavior planner, wherein the transformation tool (21) is designed such that the semantics of the combination of the evaluation models (27; 28) is representation-independent, and - A synthesis tool (22) for generating a combined program representation (24) as a combination of declarative program representations (28) of evaluation models, in particular a combination of declarative program representations (28) of evaluation models of selected local scenarios, the synthesis of which represents a pre-given test scenario.

10. The system according to claim 9, characterized in that The transformation tool (21) is designed to transform an evaluation model (27) into an answer set program (ASP) representation (28), the evaluation model being based on a decomposition of the corresponding local situation into an area graph and a morphological behavior analysis of the participating traffic participants (SOCA method) and being in the form of a Zwicky box (27).

11. The system according to any one of claims 9 or 10, characterized in that The synthesis tool (22) is designed to construct test scenarios. - selecting a local context of said database, and - Parameterizing and / or instantiating the selected local context or the associated evaluation model.

12. The system according to claim 11, characterized in that A configuration database (23) is provided to the synthesis tool (22), in which at least the following data is stored for each test scenario: a. Data for identifying each local context of the test context, b. Data used to parameterize each local context, and / or c. Data used to instantiate each local context.

13. The system according to any one of claims 9 to 12 further includes a result database (25) for storing test results in the form of formally explorable boundary conditions of allowable behavior options of the vehicle that have been determined for a predetermined test scenario, wherein a search can be automatically performed in the result database (25) with the aid of a predefined search query in order to identify specific test scenarios and / or specific behavior options for the vehicle.

Images