Method and control device for determining safety integrity level of safety-related vehicle function of motor vehicle

Abstract

The invention relates to a computer-implemented method for determining a safety integrity level (14) of a safety-related vehicle function (12) of a motor vehicle, comprising the following steps: providing (S1) at least one infrastructure and / or vehicle sensor data signal (10), the infrastructure and / or vehicle sensor data signal represents infrastructure and / or vehicle sensor data determined for a safety-related vehicle function (12) provided by means of the motor vehicle; determining (S2) a safety integrity level (14) of the safety-related vehicle function (12) on the basis of the provided infrastructure and / or vehicle sensor data signal (10); and assigning (S3) the calculation of the safety-related vehicle function (12) to the vehicle-interior and / or vehicle-exterior system taking into account the specified safety integrity of the vehicle-interior and / or vehicle-exterior system. The invention also relates to a control device (20) for determining a safety integrity level (14) of a safety-related vehicle function (12) of a motor vehicle.

Description

Technical Field

[0001] The invention relates to a method for determining a safety integrity level of a safety-related vehicle function of a motor vehicle.

[0002] The invention further relates to a control device for determining a safety integrity level of a safety-related vehicle function of a motor vehicle. Background Art

[0003] Safety standards such as ISO 26262 describe a recommended process for developing safety-related functions. Here, the first step is to determine the safety integrity of the function based on a risk analysis, such as Hazard Analysis and Risk Assessment (HARA) in ISO 26262. The determination is made during development based on assumptions about the use of the function or the system containing the relevant function.

[0004] For example, in ISO 26262, this is done, for example, via parameters of the probability of occurrence of a situation in which a fault would be harmful, the possible controllability of the fault and the severity of the impact if the fault could not be controlled in the situation. The evaluation then yields the required safety integrity level (e.g. ASIL) of the function, based on which the required development process and safety mechanisms are derived from the safety standard.

[0005] From this, it follows that the design and testing methods to be used for hardware and software, as well as the necessary ASIL compliance of the hardware components on which the safety-related software is subsequently run, can be achieved, for example, by extensive diagnostics and the provision of hardware redundancy.

[0006] DE 102015200422 A1 discloses a vehicle control and computing system, comprising a mission control device in a vehicle, a vehicle-specific computing manager in a cloud network, and a wireless data channel coupling the mission control device and the cloud network, wherein the mission control device performs operating tasks in the vehicle with the aid of data-related resources in the cloud network, wherein when one of the operating tasks is started, the mission control device sends an exchange signal to the computing manager as a resource request, wherein the computing manager calls at least one cloud-based agent from a database of preset agents in response to the exchange signal, and wherein the mission control device completes the operating task by communicating with the called agent.

[0007] DE 102019214453 A1 discloses a method for safely executing a function provided by means of a motor vehicle, comprising the following steps: receiving an infrastructure data signal representing infrastructure data, wherein the infrastructure data is determined for the function provided by means of the motor vehicle; receiving a safety condition signal representing at least one safety condition, wherein the safety condition must be met in order to allow the function to be executed based on the infrastructure data; checking whether at least one safety condition is met; determining whether the function is allowed to be executed based on the infrastructure data based on the check result; generating a result signal representing the determined result; and outputting the generated result signal.

[0008] Typically, the ASIL of a function is determined and fixedly assigned during development based on assumptions about a "worst-case" scenario. Of course, by considering a large number of possible situations, it is easy to understand that in many of these cases, the failure of a safety-related function is not dangerous at all. This applies both to primary functions such as actuator control, for example an undesired engine shutdown at standstill, and to secondary functions such as environmental perception, for example object detection in a distant area when driving slowly. Summary of the invention

[0009] The present invention is therefore based on the object of providing an improved method and a control device for determining a safety integrity level of a safety-related vehicle function of a motor vehicle, which enable a situation-dependent determination of the safety integrity level of a safety-related vehicle function.

[0010] This object is achieved by means of a computer-implemented method for determining a safety integrity level of a safety-related vehicle function of a motor vehicle having the features of patent claim 1 .

[0011] Furthermore, the object is achieved by means of a control device for determining a safety integrity level of a safety-relevant vehicle function of a motor vehicle having the features of patent claim 13 .

[0012] Furthermore, the object is achieved by means of a computer program having the features of patent claim 14 and a computer-readable data carrier having the features of patent claim 15 .

[0013] Invention Disclosure

[0014] The invention provides a computer-implemented method for determining a safety integrity level of a safety-related vehicle function of a motor vehicle.

[0015] The method comprises providing at least one infrastructure and / or vehicle sensor data signal which represents infrastructure and / or vehicle sensor data determined for a safety-related vehicle function provided by means of the motor vehicle.

[0016] Furthermore, the method comprises determining a safety integrity level of a safety-related vehicle function based on the provided at least one infrastructure and / or vehicle sensor data signal. The method also comprises distributing the calculation of the safety-related vehicle function to the vehicle-internal and / or vehicle-external systems taking into account a predefined safety integrity of the vehicle-internal and / or vehicle-external systems.

[0017] The safety integrity level of a vehicle function represents or describes a level or class or classification of the safety integrity of a vehicle function. The safety integrity of a vehicle function refers in particular to the reliability of the vehicle function, which can be determined or can be determined by means of a risk assessment, for example.

[0018] In this case, the safety integrity of the vehicle-internal and / or vehicle-external systems may be represented, for example, by an ASIL score or an ASIL value.

[0019] The invention also provides a control device for determining a safety integrity level of a safety-related vehicle function of a motor vehicle.

[0020] The control device comprises means for receiving at least one infrastructure and / or vehicle sensor data signal, which represents infrastructure and / or vehicle sensor data determined for a safety-related vehicle function provided by means of the motor vehicle.

[0021] The control device further comprises means for determining a safety integrity level of a safety-related vehicle function based on at least one provided infrastructure and / or vehicle sensor data signal. The control device further comprises means for distributing the calculation of the safety-related vehicle function to the vehicle-internal and / or vehicle-external systems taking into account a predefined safety integrity of the vehicle-internal and / or vehicle-external systems.

[0022] The invention also provides a computer program having a program code for executing the method according to the invention when the computer program is executed on a computer, and a computer-readable data carrier having a program code of the computer program for executing the method according to the invention when the computer program is executed on a computer.

[0023] Typically, safety-related functions are implemented by software that was developed specifically for this purpose with the corresponding ASIL and on hardware that was developed specifically for this purpose with the corresponding ASIL. In conventional vehicle E / E architectures, this does not bring any advantages to dynamically implementing functions in hardware and with software with different ASILs, because the corresponding hardware and software already exist.

[0024] However, future vehicle E / E architectures will be closely networked with external systems, such as the cloud, the edge, other vehicles and / or smart devices. This provides the possibility of externalizing functions. Of course, the ASIL of a function is a limitation for such externalization, because such external systems are usually not developed according to safety standards such as ISO 26262 and thus do not provide the necessary "ASIL compliance".

[0025] The idea of ​​the present invention is therefore to enable a dynamic, in particular real-time, determination of the ASIL of a safety-related function or sub-function based on a currently given context (eg, driving situation and / or vehicle state).

[0026] Thus, the outsourcing of the functions or sub-functions to the external system can advantageously be carried out in a controlled manner taking into account the given safety integrity of the external system.

[0027] According to a preferred development, it is provided that the calculation of the safety-relevant vehicle function is assigned to the vehicle-internal and / or vehicle-external systems if the predefined safety integrity of the vehicle-internal and / or vehicle-external systems meets a specific safety integrity level of the safety-relevant vehicle function.

[0028] Safety-related functions can thus also be dynamically offloaded from the vehicle in order to free up internal resources or to use them for more complex safety-related calculations. This is particularly advantageous for automated driving functions (e.g., environmental perception, adaptive behavior planning, and / or trajectory planning), whose computational complexity can vary greatly and dynamically depending on the given driving situation (e.g., the complexity of the driving situation and the environment).

[0029] According to another preferred development, the data signal of the at least one infrastructure and / or vehicle sensor provided comprises driving situation parameters of the own vehicle, in particular a motor vehicle, in particular a vehicle speed, a moving direction and / or a geographical position. Thus, the current driving situation is accurately reflected in the infrastructure and / or vehicle sensor data signal.

[0030] According to another preferred development, it is proposed that at least one provided infrastructure and / or vehicle sensor data signal comprises or is a key parameter of the current driving situation, in particular the distance and / or relative movement of the motor vehicle relative to static and / or dynamic objects in a specific area of ​​the vehicle environment.

[0031] As a result, the criticality of the current driving situation can also be included in the determination of the safety integrity level of the safety-related vehicle functions.

[0032] According to another preferred development, it is provided that the data signal of at least one infrastructure and / or vehicle sensor provided includes or is stored in the map an area in which a predetermined object type, in particular a person and / or a vehicle, is not present with a predetermined minimum probability, and includes or is defined relative to the motor vehicle. As a result, the infrastructure data can also be included in the determination of the safety integrity level of safety-related vehicle functions.

[0033] According to another preferred development, it is provided that the determination of the safety integrity level of the safety-related vehicle function comprises a dynamic classification of the vehicle environment using a classification algorithm, wherein the classification algorithm is applied to at least one provided infrastructure and / or vehicle sensor data signal and outputs a plurality of categories representing the safety integrity level of the safety-related vehicle function. The safety integrity level determined in this way, in particular the ASIL, is then used as a basis for allocating the calculation of the safety-related vehicle function to vehicle-internal and / or vehicle-external systems.

[0034] According to a further preferred development, it is provided that the safety-related vehicle functions are steering, braking and / or accelerating functions of the vehicle.

[0035] This enables determining, for example, whether an undesired braking is hazardous because the vehicle is behind the motor vehicle or not. Likewise, it is possible to assess whether an undesired steering or braking is hazardous depending on the vehicle speed and the vehicle environment.

[0036] According to a further preferred development, it is provided that the safety-related vehicle function is an environment detection function which detects which areas of the environment model to be calculated are relevant for determining a safe behavior of the motor vehicle and which areas are not relevant.

[0037] For example, the recognition of traffic lights is relevant or irrelevant depending on the situation in an area, e.g., less relevant for traffic lights farther ahead at low vehicle speeds and in the case of known non-existent / deactivated traffic lights on the route: what data is available via static or dynamic map information.

[0038] Furthermore, traffic light recognition is less relevant, for example in the case of a known absence of traffic lights in a certain visibility range, when driving on a motorway, in right curves and in the left or straight line of sight when starting off.

[0039] Furthermore, for remote or blocked areas where a person cannot actually reach the area in front of the vehicle, and for areas where no person will actually be present, such as in tunnels or on highways, identifying a person is less relevant or less safety-critical.

[0040] According to a further preferred development, it is provided that the safety integrity level of the safety-related vehicle function is determined on the basis of real-time criticality, in particular using real-time infrastructure and / or vehicle sensor data signals.

[0041] The real-time criticality of the data therefore enables the outsourcing or distribution of the calculation of safety-related vehicle functions to vehicle-internal and / or vehicle-external systems in real time.

[0042] According to a further preferred advanced driving, it is proposed that resources available in the vehicle and in the vehicle environment for calculating the safety integrity level of safety-related vehicle functions, in particular required control devices and / or computer-implemented methods running on the control devices, are determined, and a maximum waiting time required for calculating the safety-related vehicle functions via these resources is determined.

[0043] Thus, the data can also be stored locally in the vehicle in a database (e.g. a completeness / performance map of the resources available from the regional location)

[0044] According to a further preferred development, it is provided that the calculation of safety-related vehicle functions whose safety integrity level lies below a predefined threshold value is distributed to the vehicle control unit.

[0045] Thus, for example, it is possible to execute the software on an internal control device, on a "safe" core of the control device corresponding to a high ASIL (e.g. a Lockstep-CPU), on a core with lower safety, such as a core with only a "QM rating", on redundant GPUs and compare the results corresponding to a high ASIL, and / or to execute it on a single GPU with a lower ASIL or "QM rating".

[0046] According to another preferred development, it is proposed that the execution of a function via V2X is requested at an external system, in particular an edge server, a fog server and / or a cloud server, a control device of another road user and / or a smart device, in particular a smartphone.

[0047] Thus, it is possible to implement execution on external systems developed according to a high safety integrity level, execution on redundant external systems with low safety integrity or pure “QM classification”, local comparison with results of higher safety integrity (“SW Lockstep”), and implementation on a single external system with lower safety integrity or pure “QM classification”.

[0048] The described embodiments and developments can be combined with one another as desired.

[0049] Further possible embodiments, refinements and implementations of the invention also include combinations of features of the invention described above or below with reference to the exemplary embodiments, which are not explicitly mentioned. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings are intended to facilitate a further understanding of the embodiments of the present invention. The accompanying drawings illustrate the embodiments and, together with the description, are used to explain the principles and concepts of the present invention.

[0051] Further embodiments and many of the advantages mentioned are apparent from the drawings. The elements shown in the drawings are not necessarily shown to scale with respect to one another.

[0052] in:

[0053] Figure 1 a flow chart showing a computer-implemented method for determining a safety integrity level of a safety-related vehicle function of a motor vehicle according to a preferred embodiment of the invention; and

[0054] Figure 2 A schematic diagram of a control device for determining a safety integrity level of a safety-related vehicle function of a motor vehicle is shown according to a preferred specific embodiment of the present invention. DETAILED DESCRIPTION

[0055] Figure 1 The computer-implemented method shown for determining a safety integrity level 14 of a safety-related vehicle function 12 of a motor vehicle comprises providing S1 at least one infrastructure and / or vehicle sensor data signal 10, which represents infrastructure and / or vehicle sensor data, which is determined for a safety-related vehicle function 12 provided by means of the motor vehicle.

[0056] Safety-related vehicle functions are understood here to be safety-related aspects of the vehicle, for example functions relating to acceleration, braking and / or steering interventions.

[0057] The method also includes determining S2 a safety integrity level 14 of a safety-related vehicle function 12 based on at least one provided infrastructure and / or vehicle sensor data signal 10, and allocating S3 the calculation of the safety-related vehicle function 12 to the systems 16, 18 inside and / or outside the vehicle taking into account a preset safety integrity of the systems 16, 18 inside and / or outside the vehicle.

[0058] If the predefined safety integrity of vehicle-internal and / or vehicle-external systems 16 , 18 meets a specific safety integrity level 14 of safety-related vehicle function 12 , the calculation of safety-related vehicle function 12 is distributed to vehicle-internal and / or vehicle-external systems 16 , 18 .

[0059] The at least one provided infrastructure and / or vehicle sensor data signal 10 comprises driving situation parameters of the own vehicle, in particular a motor vehicle, in particular a vehicle speed, a direction of movement and / or a geographical location.

[0060] The provided infrastructure and / or vehicle sensor data signals 10 also include or are key parameters of the current driving situation, in particular the distance and / or relative movement of the motor vehicle relative to static and / or dynamic objects in a specific area of ​​the vehicle environment. In addition, at least one provided infrastructure and / or vehicle sensor data signal 10 is an area stored in the map in which a predetermined object type, in particular a person and / or a vehicle, is not present with a predetermined minimum probability and an area defined relative to the motor vehicle.

[0061] Determining the safety integrity level 14 of the safety-related vehicle function 12 includes dynamically classifying the vehicle environment using a classification algorithm.

[0062] The classification algorithm is applied to the at least one infrastructure and / or vehicle sensor data signal 10 provided and outputs a class representing a plurality of safety integrity levels 14 of the safety-related vehicle function 12. The output classes are different safety integrity levels 14, in particular different ASILs, of the safety-related vehicle function 12.

[0063] Safety-related vehicle functions 12 are steering, braking and / or acceleration functions of the vehicle. Safety-related vehicle functions 12 are also environment detection functions that detect which areas of the environment model to be calculated are relevant and which areas are not relevant for determining the safe behavior of the motor vehicle.

[0064] A safety integrity level 14 of a safety-related vehicle function 12 is determined based on real-time criticality, in particular using real-time infrastructure and / or vehicle sensor data signals 10 .

[0065] In the vehicle and in the vehicle environment, available resources are determined for calculating a safety integrity level 14 of a safety-related vehicle function 12, in particular a required control device and / or a computer-implemented method running on a control device 20. Furthermore, a maximum waiting time required for calculating the safety-related vehicle function 12 via the resources is determined. The calculation of the safety-related vehicle function 12, whose safety integrity level 14 is below a predefined threshold, is assigned to the control device 20.

[0066] The execution of a function via V2X is requested on an external system, in particular on an edge server, fog, cloud, control device 20 of another traffic participant, smart device. Vehicle-to-Everything V2X is the communication between a vehicle and any device that can affect the vehicle or be affected by the vehicle.

[0067] Figure 2 A schematic diagram of a control device for determining a safety integrity level 14 of a safety-related vehicle function 12 of a motor vehicle is shown according to a preferred specific embodiment of the present invention.

[0068] The control device 20 comprises means 22 for receiving at least one infrastructure and / or vehicle sensor data signal 10 which represents infrastructure and / or vehicle sensor data which are determined for a safety-related vehicle function 12 provided by means of the motor vehicle.

[0069] The control device further comprises means 24 for determining a safety integrity level 14 of a safety-related vehicle function 12 based on the at least one provided infrastructure and / or vehicle sensor data signal 10 .

[0070] The control device further comprises means 26 for distributing S3 the calculation of safety-related vehicle functions 12 to vehicle-internal and / or vehicle-external systems taking into account a predefined safety integrity of the vehicle-internal and / or vehicle-external systems.

Claims

1. A computer-implemented method for determining a safety integrity level (14) of a safety-related vehicle function (12) of a motor vehicle, comprising the following steps: Providing (S1) at least one infrastructure and / or vehicle sensor data signal (10), which represents infrastructure and / or vehicle sensor data determined for a safety-related vehicle function (12) provided by means of a motor vehicle; Determining (S2) a safety integrity level (14) of the safety-related vehicle function (12) based on at least one provided infrastructure and / or vehicle sensor data signal (10); and The calculation of the safety-related vehicle function (12) is distributed (S3) to the vehicle-internal and / or vehicle-external systems (16, 18) taking into account a predefined safety integrity of the vehicle-internal and / or vehicle-external systems (16, 18).

2. The computer-implemented method of claim 1 , wherein: If the predefined safety integrity of the vehicle-internal and / or vehicle-external systems (16, 18) satisfies a specific safety integrity level (14) of the safety-related vehicle function (12), a calculation of the safety-related vehicle function (12) is distributed to the vehicle-internal and / or vehicle-external systems (16, 18).

3. A computer-implemented method according to claim 1 or 2, wherein the data signal (10) provided by at least one infrastructure and / or vehicle sensor includes driving condition parameters of the own vehicle, in particular the motor vehicle, in particular the vehicle speed, movement direction and / or geographic location.

4. A computer-implemented method according to any of the preceding claims, wherein at least one provided infrastructure and / or vehicle sensor data signal (10) comprises key parameters of the current driving situation, in particular the distance and / or relative movement of the motor vehicle relative to static and / or dynamic objects in a specific area of ​​the vehicle environment.

5. A computer-implemented method according to any of the preceding claims, wherein the data signals (10) of the provided infrastructure and / or vehicle sensors include areas stored in a map in which preset object types, in particular people and / or vehicles, are not present with a preset minimum probability, and include areas defined relative to the motor vehicle.

6. A computer-implemented method according to any of the preceding claims, wherein determining the safety integrity level (14) of the safety-related vehicle function (12) comprises dynamically classifying the vehicle environment using a classification algorithm, wherein the classification algorithm is applied to at least one provided infrastructure and / or vehicle sensor data signal (10) and outputs a plurality of categories representing the safety integrity level (14) of the safety-related vehicle function (12).

7. Computer-implemented method according to any of the preceding claims, wherein the safety-related vehicle functions (12) are steering, braking and / or acceleration functions of the vehicle.

8. A computer-implemented method according to any of the preceding claims, wherein the safety-related vehicle function (12) is an environmental detection function, which detects which areas of the environmental model to be calculated are relevant for determining the safe behavior of the motor vehicle and which areas are not relevant.

9. A computer-implemented method according to any of the preceding claims, wherein the safety integrity level (14) of the safety-related vehicle function (12) is determined based on real-time criticality, in particular using real-time infrastructure and / or vehicle sensor data signals (10).

10. A computer-implemented method according to any of the preceding claims, wherein available resources in the vehicle and in the vehicle environment for calculating the safety-related vehicle function (12), in particular a required control device (20) and / or a safety integrity level of a computer-implemented method running on the control device (20) are determined, and a maximum waiting time required for calculating the safety-related vehicle function (12) via the resources is determined.

11. A computer-implemented method according to any one of the preceding claims, wherein: The calculation of a safety-related vehicle function (12) whose safety integrity level (14) is below a predefined threshold value is distributed among the control device (20).

12. A computer-implemented method according to any of the preceding claims, wherein the execution of a function via V2X is requested on an external system, in particular an edge server, fog, cloud, a control device (20) of another traffic participant, a smart device.

13. A control device (20) for determining a safety integrity level (14) of a safety-related vehicle function (12) of a motor vehicle, the control device comprising: means (22) for providing at least one infrastructure and / or vehicle sensor data signal (10), said infrastructure and / or vehicle sensor data signal representing infrastructure and / or vehicle sensor data determined for a safety-related vehicle function (12) provided by means of the motor vehicle; means (24) for determining a safety integrity level (14) of the safety-related vehicle function (12) based on at least one provided infrastructure and / or vehicle sensor data signal (10); and Means (26) are provided for distributing (S3) the calculation of the safety-related vehicle function (12) to vehicle-internal and / or vehicle-external systems taking into account a predefined safety integrity of the vehicle-internal and / or vehicle-external systems.

14. A computer program having a program code for executing the method according to any one of claims 1 to 12 when the computer program is executed on a computer. 15 . A computer-readable data carrier having a program code of a computer program for executing the method according to claim 1 , when the computer program is executed on a computer.

Images