Computer-implemented method and control device for determining required safety integrity level of safety-related vehicle function

Abstract

The invention relates to a computer-implemented method and a control device (20) for determining a required safety integrity level (14) of a safety-related vehicle function (12) of an environment of a vehicle having a plurality of environment models of the safety-related vehicle function (12), the method comprises the following steps: providing (S1) at least one infrastructure data signal (10a) representing infrastructure data and at least one vehicle sensor data signal (10b) representing vehicle sensor data, which are each determined for a plurality of safety-related vehicle functions (12), and determining (S2) a safety integrity level (14) of the plurality of safety-related vehicle functions (12) on the basis of the provided at least one infrastructure data signal (10a) and at least one vehicle sensor data signal (10b), wherein the vehicle sensor data signal (10b) contributes with a first weight (16a) and the infrastructure data signal (10a) with a second weight (16b) to determine a required safety integrity level (14) for the plurality of safety-related vehicle functions (12).

Description

Technical Field

[0001] The invention relates to a computer-implemented method for determining a required safety integrity level for a safety-related vehicle function having an environment model with a plurality of safety-related vehicle functions.

[0002] The invention further relates to a control device for determining a required safety integrity level for a safety-related vehicle function having an environment model having a plurality of safety-related vehicle functions. Background Art

[0003] Safety standards such as ISO 26262 describe a recommended process for developing safety-related functions. Here, the first step is to determine the safety integrity of the function based on a risk analysis, such as Hazard Analysis and Risk Assessment (HARA) in ISO 26262. The determination is made during development based on assumptions about the use of the function or the system containing the relevant function.

[0004] For example, in ISO 26262, this is done, for example, via parameters of the probability of occurrence of a situation in which a fault would be harmful, the possible controllability of the fault and the severity of the impact if the fault could not be controlled in the situation. The evaluation then yields the required safety integrity level (e.g. ASIL) of the function, based on which the required development process and safety mechanisms are derived from the safety standard.

[0005] From this, it follows that the design and testing methods to be used for hardware and software, as well as the necessary ASIL compliance of the hardware components on which the safety-related software is subsequently run, can be achieved, for example, by extensive diagnostics and the provision of hardware redundancy.

[0006] DE 102015200422 A1 discloses a vehicle control and computing system, comprising a mission control device in a vehicle, a vehicle-specific computing manager in a cloud network, and a wireless data channel coupling the mission control device and the cloud network, wherein the mission control device performs operating tasks in the vehicle with the aid of data-related resources in the cloud network, wherein when one of the operating tasks is started, the mission control device sends an exchange signal to the computing manager as a resource request, wherein the computing manager calls at least one cloud-based agent from a database of preset agents in response to the exchange signal, and wherein the mission control device completes the operating task by communicating with the called agent.

[0007] DE 102019214453 A1 discloses a method for safely executing a function provided by means of a motor vehicle, comprising the following steps: receiving an infrastructure data signal representing infrastructure data, wherein the infrastructure data is determined for the function provided by means of the motor vehicle; receiving a safety condition signal representing at least one safety condition, wherein the safety condition must be met in order to allow the function to be executed based on the infrastructure data; checking whether at least one safety condition is met; determining whether the function is allowed to be executed based on the infrastructure data based on the check result; generating a result signal representing the determined result; and outputting the generated result signal.

[0008] Typically, the ASIL of a function is determined and fixedly assigned during development based on assumptions about a "worst-case" scenario. Of course, by considering a large number of possible situations, it is easy to understand that in many of these cases, the failure of a safety-related function is not dangerous at all. This applies both to primary functions such as actuator control, for example an undesired engine shutdown at standstill, and to secondary functions such as environmental perception, for example object detection in a distant area when driving slowly.

[0009] On the other hand, in environment identification, incorrect or insufficient definition of safety requirements during design may also result in the following: in certain cases, functions used to generate an environment model, such as sensor coverage of a certain field of view, are classified as too low in safety criticality and are therefore not executed safely or reliably. Summary of the invention

[0010] The present invention is therefore based on the object of providing an improved method and a control device for determining a required safety integrity level for a safety-related vehicle function for an environment model having a plurality of safety-related vehicle functions, which method and the control device enable a situation-dependent determination of the safety integrity level for the safety-related vehicle function.

[0011] This object is achieved by means of a computer-implemented method for determining a required safety integrity level for a safety-related vehicle function of an environment model having a plurality of safety-related vehicle functions, having the features of patent claim 1 .

[0012] The object is also achieved by means of a control device for determining a required safety integrity level for a safety-related vehicle function having an environment model having a plurality of safety-related vehicle functions, having the features of patent claim 13 .

[0013] Furthermore, the object is achieved by means of a computer program having the features of patent claim 14 and a computer-readable data carrier having the features of patent claim 15 .

[0014] Invention Disclosure

[0015] The present invention provides a computer-implemented method for determining a required safety integrity level for safety-related vehicle functions of an environment model of an environment of a vehicle having a plurality of safety-related vehicle functions.

[0016] The method comprises providing at least one infrastructure data signal representing infrastructure data and at least one vehicle sensor data signal representing vehicle sensor data, the infrastructure data signal and the vehicle sensor data signal being respectively determined for a plurality of safety-related vehicle functions.

[0017] The method further comprises determining a safety integrity level of a plurality of safety-related vehicle functions based on the provided at least one infrastructure data signal and the at least one vehicle sensor data signal, wherein the at least one vehicle sensor data signal contributes with a first weighting and the at least one infrastructure data signal with a second weighting to determining a required safety integrity level of the plurality of safety-related vehicle functions.

[0018] The safety integrity level may be calculated, for example, by means of a weighted sum of at least one vehicle sensor data signal and at least one vehicle sensor data signal.

[0019] The safety integrity level of a vehicle function represents or describes a level or class or classification of the safety integrity of a vehicle function. The safety integrity of a vehicle function refers in particular to the reliability of the vehicle function, which can be determined or can be determined by means of a risk assessment, for example.

[0020] The present invention also provides a control device for determining a required safety integrity level for a safety-related vehicle function having an environment model having a plurality of safety-related vehicle functions.

[0021] The control device comprises a first device for providing at least one infrastructure data signal representing infrastructure data and at least one vehicle sensor data signal representing vehicle sensor data, the infrastructure data signal and the vehicle sensor data signal being determined for a plurality of safety-related vehicle functions.

[0022] The control device also includes a second mechanism for determining the safety integrity levels of multiple safety-related vehicle functions based on at least one provided infrastructure data signal and at least one vehicle sensor data signal, wherein the second mechanism is designed to: use at least one vehicle sensor data signal with a first weight and at least one infrastructure data signal with a second weight to determine the safety integrity levels of the multiple safety-related vehicle functions.

[0023] The invention also provides a computer program with a program code for performing the method according to the invention when the computer program is executed on a computer, and a computer-readable data carrier with a program code of a computer program for performing the method according to the invention when the computer program is executed on a computer.

[0024] Typically, safety-related functions are implemented by software that was developed specifically for this purpose with the corresponding ASIL and on hardware that was developed specifically for this purpose with the corresponding ASIL. In conventional vehicle E / E architectures, this does not bring any advantages to dynamically implementing functions in hardware and with software with different ASILs, because the corresponding hardware and software already exist.

[0025] However, future vehicle E / E architectures will be closely networked with external systems, such as the cloud, the edge, other vehicles and / or smart devices. This provides the possibility of externalizing functions. Of course, the ASIL of a function is a limitation for such externalization, because such external systems are usually not developed according to safety standards such as ISO 26262 and thus do not provide the necessary "ASIL compliance".

[0026] Therefore, one idea of ​​the present invention is to determine not only relevant or critical and irrelevant or non-critical areas of the environment model during operation from the vehicle - directly or indirectly via the recognition of the scene, but also these areas are locally available via local information, such as via a connection to the cloud, for example static and / or dynamic maps or spatial computing, to a local edge server or a dedicated local sending unit, for example a retrofit device at a traffic light.

[0027] Advantageously, the safety criticality of a perception function in a specific area around the ego vehicle at a geographical location can therefore be better determined locally based on the current local perception or by statistical evaluation of historical local measurement data.

[0028] The additional information provided can correct misjudgments within the vehicle by the vehicle sensor system, thereby increasing safety. Misjudgments can be caused by the vehicle's incorrect perception of the situation and by the developer's misjudgment of possible critical events.

[0029] This allows errors in the design to be partially compensated later, for example, neglecting certain edges and corner cases, and thus safety can be increased. Before the information is output externally, it can be verified comprehensively and over a long period of time - also during operation. This improves reliability and simplifies the safety demonstration of the entire system.

[0030] If the reliability of the information is high, for example, guaranteed by metadata transmission or in some other way, the vehicle can also better implement the calculation of the environment model, perception functions and / or subfunctions in areas determined locally as not relevant to safety based on external specifications in the following ways: for example, setting less redundancy, suspending measurement cycles, reducing resolution or completely omitting detection.

[0031] As a result, resources that can be used for other functions can be temporarily freed. Possible in-vehicle determination of real-time safety requirements can also be carried out more efficiently via the highly reliable second path, or temporarily and / or locally completely omitted, thereby also at least temporarily freeing up resources.

[0032] According to a preferred development, it is provided that at least one infrastructure data signal contains information about which subregions of the vehicle's environment have which safety integrity level. It is thus possible to determine to what extent subregions of the vehicle's environment are safety-critical.

[0033] According to a further preferred development, it is provided that at least one infrastructure data signal has information about static obstacles, traffic infrastructure and / or dynamic objects.

[0034] Static obstacles can include, for example, fallen rocks next to a slope, potholes that often appear in the spring, lost cargo, bicycles and / or scooters on the road next to a bicycle or scooter parking lot, and / or hanging tree branches. Dynamic objects can be, for example, vehicles cutting in quickly from a street with poor visibility and / or a bike lane merging from the right on a sloped street.

[0035] According to a further preferred development, it is provided that at least one infrastructure data signal has information about the type of objects which are present with a predetermined probability in the local area of ​​the vehicle's environment and about the type of objects which are not present with a predetermined probability in the local area of ​​the vehicle's environment.

[0036] Frequently occurring objects may be, for example, trucks driving into a company's premises from an entrance, motorcyclists on the weekend, children in front of school and / or people in costume near a carnival parade. Infrequently occurring objects may be, for example, pedestrians coming from areas that are inaccessible to people, in particular due to entry bans and / or physically difficult to access locations or walls or fences that can be crossed.

[0037] According to another preferred development, it is provided that at least one infrastructure data signal has information about traffic density, time, weather, lighting conditions and / or the position of the sun. These conditions can thus be used together to determine the safety integrity level.

[0038] According to another preferred development, it is proposed that, based on the determined safety integrity level of a plurality of safety-related vehicle functions, data, in particular control signals for actuating at least one vehicle sensor, are generated, which data represent which sensor modality, in particular video, radar, lidar, ultrasound and / or microphone, can be used to cover a partial area of ​​the vehicle's environment by means of the vehicle sensor. This advantageously makes it possible to improve the safety integrity level of a plurality of safety-related vehicle functions.

[0039] According to another preferred development, it is provided that first data, in particular a control signal for actuating at least one vehicle sensor, are generated based on the determined safety integrity level of a plurality of safety-related vehicle functions, the first data representing the local area of ​​the vehicle's environment that can be covered by means of sensor redundancy, sensor resolution and / or sensor measurement frequency. This ensures a more precise sensor detection of the scene by the safety-related vehicle functions.

[0040] According to another preferred development, it is proposed that second data, in particular control signals, are generated based on the determined safety integrity level of a plurality of safety-related vehicle functions for weighting the perception function, the object model and / or the motion model, which relate to their ability to detect the vehicle environment. This can be performed in particular if different variants are available for the perception function.

[0041] According to another preferred development, it is proposed that third data, in particular a control signal, is generated based on the determined safety integrity level of a plurality of safety-related vehicle functions for selecting an algorithm type, in particular a Kalman filter or an algorithm based on deep learning. Thus, an algorithm optimized for the respective case can be used in each case.

[0042] According to another preferred development, it is provided that fourth data, in particular control signals, are generated based on the determined safety integrity level of a plurality of safety-related vehicle functions for setting at least one limit value of the object detector. Incorrect object detections can thereby be reduced in an advantageous manner.

[0043] According to another preferred development, it is proposed that fifth data, in particular a control signal, is generated based on the determined safety integrity level of a plurality of safety-related vehicle functions for selecting a control device, in particular a control device for executing a safety-related vehicle function. This can be performed if a plurality of systems or control devices are available for the same perception function.

[0044] According to another preferred development, it is provided that at least one infrastructure data signal is provided before or when a route section detected by the vehicle sensors is travelled over. The at least one provided infrastructure data signal can thus support the determination of the safety integrity level of a plurality of safety-related vehicle functions.

[0045] The described embodiments and developments can be combined with one another as desired.

[0046] Further possible embodiments, refinements and implementations of the invention also include combinations of features of the invention described above or below with reference to the exemplary embodiments, which are not explicitly mentioned. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings are intended to facilitate a further understanding of the embodiments of the present invention. The accompanying drawings illustrate the embodiments and, together with the description, are used to explain the principles and concepts of the present invention.

[0048] Further embodiments and many of the advantages mentioned are apparent from the drawings. The elements shown in the drawings are not necessarily shown to scale with respect to one another.

[0049] in:

[0050] Figure 1 a flow chart showing a computer-implemented method for determining a required safety integrity level for a safety-related vehicle function of a motor vehicle according to a preferred embodiment of the invention; and

[0051] Figure 2 A schematic diagram of a control device for determining a required safety integrity level for a safety-related vehicle function of a motor vehicle is shown according to a preferred specific embodiment of the present invention. DETAILED DESCRIPTION

[0052] This is Figure 1 The illustrated computer-implemented method for determining a required safety integrity level 14 for a safety-related vehicle function 12 of an environment model of an environment of a vehicle having a plurality of safety-related vehicle functions 12 .

[0053] The method comprises providing S1 at least one infrastructure data signal 10 a representing infrastructure data and at least one vehicle sensor data signal 10 b representing vehicle sensor data, the infrastructure data signal and the vehicle sensor data signal being determined for a plurality of safety-related vehicle functions 12 .

[0054] The method also includes determining S2 a safety integrity level 14 of multiple safety-related vehicle functions 12 based on at least one provided infrastructure data signal 10a and at least one vehicle sensor data signal 10b, wherein at least one vehicle sensor data signal 10b determines the safety integrity level 14 of multiple safety-related vehicle functions 12 with a first weight 16a and at least one infrastructure data signal 10a determines the safety integrity level 14 of multiple safety-related vehicle functions 12 with a second weight 16b.

[0055] The at least one infrastructure data signal 10a also has information about which local areas have which safety integrity level 14. Furthermore, the at least one infrastructure data signal 10a has information about static obstacles, traffic infrastructure and / or dynamic objects. The at least one infrastructure data signal 10a also has information about the types of objects that are present in the local area with a predetermined probability and the types of objects that are not present in the local area with a predetermined probability. Additionally, the at least one infrastructure data signal 10a has information about traffic density, time, weather, lighting conditions and / or sun position.

[0056] Based on the determined safety integrity level 14 of multiple safety-related vehicle functions 12, first data D1 are generated, in particular control signals for actuating at least one vehicle sensor 18, which first data represent which sensor modality, in particular video, radar, lidar, ultrasound and / or microphone, can be used to cover a local area of ​​the vehicle's environment by the vehicle sensor 18.

[0057] Furthermore, based on the determined safety integrity level 14 of a plurality of safety-related vehicle functions 12 , second data D2 are generated, in particular control signals for actuating at least one vehicle sensor 18 , which represent which sensor redundancy, sensor resolution and / or sensor measurement frequency can be used to cover a local area of ​​the vehicle's environment.

[0058] In addition, based on the determined safety integrity level 14 of multiple safety-related vehicle functions 12, third data D3, in particular control signals, are generated for weighting perception functions, object models and / or motion models, which relate to their ability to detect the vehicle environment.

[0059] Furthermore, fourth data D4 , in particular control signals, are generated based on the determined safety integrity level 14 of the plurality of safety-related vehicle functions 12 for selecting the type of algorithm, in particular a Kalman filter or an algorithm based on deep learning.

[0060] Based on the determined safety integrity level 14 of the plurality of safety-related vehicle functions 12, fifth data D5, in particular a control signal, is generated for setting at least one limit value of the object detector. Furthermore, based on the determined safety integrity level 14 of the plurality of safety-related vehicle functions 12, sixth data D6, in particular a control signal, is generated for selecting a control device, in particular a control device for executing the safety-related vehicle function 12. Furthermore, at least one infrastructure data signal 10a is provided before or when the route segment detected by the vehicle sensor 18 is passed.

[0061] Figure 2 A schematic diagram of a control device for determining a required safety integrity level 14 for a safety-related vehicle function 12 of a motor vehicle is shown according to a preferred specific embodiment of the present invention.

[0062] The control device 20 comprises a first device 22 for providing at least one infrastructure data signal 10 a representing infrastructure data and at least one vehicle sensor data signal 10 b representing vehicle sensor data, which are each determined for a plurality of safety-related vehicle functions 12 .

[0063] In addition, the control device 20 includes a second means 24 for determining a required safety integrity level 14 for a plurality of safety-related vehicle functions 12 based on at least one provided infrastructure data signal 10a and at least one provided vehicle sensor data signal 10b, wherein the second means 24 is designed to determine the safety integrity level 14 for a plurality of safety-related vehicle functions 12 by: using at least one vehicle sensor data signal 10b with a first weight 16a and using at least one infrastructure data signal 10a with a second weight 16b.

Claims

1. A computer-implemented method for determining a required safety integrity level (14) of a safety-related vehicle function (12) of an environment model of an environment of a vehicle having a plurality of safety-related vehicle functions (12), the method comprising the following steps: providing (S1) at least one infrastructure data signal (10a) representing infrastructure data and at least one vehicle sensor data signal (10b) representing vehicle sensor data, the infrastructure data signal and the vehicle sensor data signal being determined for a plurality of safety-related vehicle functions (12), respectively, and Safety integrity levels (14) of a plurality of safety-related vehicle functions (12) are determined (S2) based on at least one provided infrastructure data signal (10a) and at least one provided vehicle sensor data signal (10b), wherein the vehicle sensor data signal (10b) contributes with a first weighting (16a) and the infrastructure data signal (10a) with a second weighting (16b) to determining a required safety integrity level (14) of the plurality of safety-related vehicle functions (12).

2. The computer-implemented method according to claim 1, wherein the at least one infrastructure data signal (10a) has information about which local areas of the vehicle's environment have which safety integrity level (14).

3. The computer-implemented method according to claim 1 or 2, wherein the at least one infrastructure data signal (10a) has information about static obstacles, traffic infrastructure and / or dynamic objects.

4. A computer-implemented method according to any of the preceding claims, wherein the at least one infrastructure data signal (10a) has information about types of objects that appear in a local area of ​​the vehicle's environment with a preset probability and types of objects that do not appear in a local area of ​​the vehicle's environment with a preset probability.

5. Computer-implemented method according to any of the preceding claims, wherein the at least one infrastructure data signal (10a) has information about traffic density, time, weather, lighting conditions and / or sun position.

6. A computer-implemented method according to any of the preceding claims, wherein first data (D1), in particular a control signal for operating at least one vehicle sensor (18), is generated based on the determined safety integrity level (14) of the multiple safety-related vehicle functions (12), the first data representing which sensor modality, in particular video, radar, lidar, ultrasound and / or microphone, can be used to cover a local area of ​​the vehicle's environment by the vehicle sensor (18).

7. A computer-implemented method according to any of the preceding claims, wherein second data (D2), in particular a control signal for operating at least one vehicle sensor (18), is generated based on the determined safety integrity level (14) of the multiple safety-related vehicle functions (12), the second data representing which local area of ​​the vehicle's environment can be covered by means of sensor redundancy, sensor resolution and / or sensor measurement frequency.

8. A computer-implemented method according to any of the preceding claims, wherein third data (D3), in particular a control signal, is generated based on the determined safety integrity level (14) of the multiple safety-related vehicle functions (12) for weighting perception functions, object models and / or motion models, which relate to their ability to detect the vehicle environment.

9. A computer-implemented method according to any of the preceding claims, wherein fourth data (D4), in particular a control signal, is generated based on the determined safety integrity level (14) of the multiple safety-related vehicle functions (12) for selecting an algorithm type, in particular a Kalman filter or an algorithm based on deep learning.

10. A computer-implemented method according to any of the preceding claims, wherein fifth data (D5), in particular a control signal, is generated based on the determined safety integrity level (14) of the plurality of safety-related vehicle functions (12) for setting at least one limit value of the object detector.

11. A computer-implemented method according to any of the preceding claims, wherein sixth data (D6), in particular a control signal, is generated based on the determined safety integrity level (14) of the multiple safety-related vehicle functions (12) for selecting a control device, in particular a control device for performing a safety-related vehicle function (12).

12. The computer-implemented method according to any of the preceding claims, wherein the at least one infrastructure data signal (10a) is provided before or when a route segment detected by a vehicle sensor (18) is passed.

13. A control device (20) for determining a required safety integrity level (14) of a safety-related vehicle function (12) of an environment model of an environment of a vehicle having a plurality of safety-related vehicle functions (12), the control device comprising: a first device (22) for providing at least one infrastructure data signal (10a) representing infrastructure data and at least one vehicle sensor data signal (10b) representing vehicle sensor data, the infrastructure data signal and the vehicle sensor data signal being determined for a plurality of safety-related vehicle functions (12); and a second mechanism (24) for determining (S2) a safety integrity level (14) of the plurality of safety-related vehicle functions (12) based on the provided at least one infrastructure data signal (10a) and the provided at least one vehicle sensor data signal (10b), The second device (24) is designed to determine a required safety integrity level (14) of the plurality of safety-related vehicle functions (12) using the at least one vehicle sensor data signal (10b) with a first weighting (16a) and the at least one infrastructure data signal (10a) with a second weighting (16b).

14. A computer program having a program code for executing the method according to any one of claims 1 to 12 when the computer program is executed on a computer. 15 . A computer-readable data carrier having a program code of a computer program for executing the method according to claim 1 , when the computer program is executed on a computer.

Images