Method and apparatus for controlling a system with request for functional safety

Abstract

The invention relates to a method and an apparatus for controlling a system requiring functional security. The method comprises the steps that adjustment of the system according to a first adjustment method is determined, and the first adjustment method meets a first requirement for functional safety of the system; determining an adjustment of the system according to a second adjustment method; determining a difference between an adjustment of the system according to the first adjustment method and an adjustment of the system according to the second adjustment method; and outputting a signal for controlling the system on the basis of the determined difference in accordance with a first requirement for functional safety of the system.

Description

Technical Field

[0001] The present invention relates to a method and a device for controlling a system with requirements for functional safety, in particular for systems in the vehicle industry, aviation and / or aerospace industry. Background Art

[0002] When manufacturing, changing and / or improving the components of a system, it is necessary to develop the system and its components to meet the requirements for the functional safety of the components and the system, and to impose requirements on the system in terms of the safety of the system.

[0003] In an exemplary case of using an indirect electromechanical braking device, for example, instead of a direct mechanical braking device in a vehicle as shown Figure 2 It may be necessary to meet the requirements for the controllability of the vehicle, for example, during a turning maneuver. The yaw of the vehicle can be prevented, for example, so that no one is injured due to the vehicle.

[0004] In an exemplary case of using an indirect automatic steering of an aircraft, it may be necessary to meet the requirements for the possibility for a pilot to correct the automatic steering, so that the aircraft can be directly controlled when the indirect automatic steering malfunctions and is corrected to prevent damage.

[0005] Electromechanical devices are generally characterized in that an actuator, such as an electric motor, is indirectly manipulated by electronic control in order to control the system to meet the requirements for the functional safety of the system. Sensor data and / or complex algorithms, for example, for the purpose of controlling the actuator, may make it difficult to meet the requirements for the functional safety of the system, both from a technical perspective due to more costly implementation and from an economic perspective due to the higher costs of development from the component level to the system level.

[0006] Conventional devices for controlling a system and / or devices for controlling a system and units for monitoring an active regulation method and / or active devices for controlling a system use redundant regulation methods. In response to determining that one or more monitoring criteria are met or not met, the unit for monitoring is configured to switch the active regulation method and / or the active device for the redundant regulation method and / or the redundant device. Therefore, the active regulation method and / or the active device and the redundant regulation method and / or the redundant device must meet the requirements for the functional safety of the system.

[0007] DE 10 2021 121 828 A1 discloses an electromechanical braking device for a vehicle, which has at least one friction braking device and an electromechanical actuator for actuating the friction braking device, wherein the electromechanical braking device has a pneumatically releasable spring storage actuator. The spring storage actuator can be arranged and / or designed to immediately apply a force to at least one friction braking element. Summary of the Invention

[0008] The present invention provides a method and an apparatus for controlling a system having requirements for functional safety.

[0009] The disclosed method and apparatus for controlling a system can achieve a simplified implementation of complex control of the system while always meeting the requirements for the functional safety of the system.

[0010] According to a first aspect, the present invention relates to a method for controlling a system having requirements for functional safety. The method includes determining an adjustment of the system according to a first adjustment method, the first adjustment method meeting a first requirement for the functional safety of the system; determining an adjustment of the system according to a second adjustment method; determining a difference between the adjustment of the system according to the first adjustment method and the adjustment of the system according to the second adjustment method; and outputting a signal for controlling the system according to the first requirement for the functional safety of the system and based on the determined difference.

[0011] According to an extended embodiment, the method further includes determining whether the difference is within a first tolerance range around the adjustment of the system according to the first adjustment method; and in response to determining that the difference is within the first tolerance range, outputting a signal for controlling the system, wherein the signal follows the adjustment of the system according to the second adjustment method.

[0012] According to an extended embodiment, the method further includes: in response to determining that the difference is outside the first tolerance range, outputting a signal for controlling the system, wherein the signal follows the adjustment of the system according to the first adjustment method.

[0013] According to an extended embodiment, the method further includes: in response to determining that the difference is outside the first tolerance range, determining whether the difference is within a second tolerance range around the adjustment of the system according to the first adjustment method; and outputting a signal for controlling the system, wherein the signal follows the adjustment of the system according to a third adjustment method, the third adjustment method meeting a second requirement for the functional safety of the system.

[0014] According to an extended embodiment, the determination of the adjustment of the system according to the first adjustment method and the determination of the adjustment of the system according to the second adjustment method are performed simultaneously and / or continuously and / or in parallel and / or alternately in sequence.

[0015] According to an extended embodiment, the first adjustment method is selected according to the operating mode of the system and / or according to the selection of the user of the system.

[0016] According to an extended embodiment, the first adjustment method is selected from a plurality of first adjustment methods, wherein each of the plurality of first adjustment methods meets the first requirement for functional safety.

[0017] According to a second aspect, the present invention relates to a device for controlling a system having requirements for functional safety. The device includes one or more processors; and a non-volatile computer-readable storage medium including instructions stored thereon which, when executed by the one or more processors, cause the device to control the system according to the above method.

[0018] According to an extended embodiment, the device further includes at least one electromechanical control device, wherein the electromechanical control device does not allow direct mechanical control.

[0019] According to a third aspect, the present invention relates to a system, wherein the system includes at least one of the above devices. Description of the Drawings

[0020] Figure 1 A schematic diagram showing an exemplary embodiment of a device for controlling a system having high requirements for functional safety;

[0021] Figure 2 A schematic diagram showing an exemplary embodiment of an electromechanical braking device which is controlled by an exemplary embodiment of a device for controlling a system according to Figure 1 ;

[0022] Figure 3 A schematic diagram showing Figure 2 an exemplary embodiment of a vehicle having an electromechanical braking device according to Figure 1 which is controlled by an exemplary embodiment of a device for controlling a system according to

[0023] Figure 4 A schematic diagram showing control signals for controlling a system according to a conventional method (above) and according to an exemplary method according to the present invention (below); and

[0024] Figure 5 A schematic diagram showing a method for controlling a system having high requirements for functional safety.

[0025] In all the drawings, the same or functionally identical elements and devices are provided with the same reference numerals. The numbers of the method steps are for clarity and generally should not imply a specific time sequence. In particular, multiple method steps can also be executed simultaneously. Detailed Description of the Invention

[0026] Figure 1FIG. shows a schematic view of an exemplary embodiment of an apparatus 1200 for controlling a system 1000 with high requirements for functional safety. The system 1000, such as a vehicle or an aircraft, includes components 1300 that are important for the functional safety of the system 1000. The system 1000 includes the apparatus 1200 and may also include a sensor system 1100.

[0027] The sensor system 1100 may include one sensor or multiple sensors 1100. The sensors may be, for example, force sensors, position sensors, current sensors, sensors providing data related to the rotational speed of one or more wheels of the system 1000, acceleration sensors, airspeed sensors, angle-of-attack sensors, azimuth sensors, gyroscopes, sensors for receiving data from a radio network and / or a satellite, and / or any other sensors capable of providing data important for the functional safety of the system 1000. The sensor system 1100 may include any combination of two or more of the above-mentioned sensors.

[0028] The apparatus 1200 for controlling the system 1000 is configured to control the component 1300 according to a first adjustment method 1210. The first adjustment method 1210, the so-called "direct law", meets the requirements for the functional safety of the system 1000. The first adjustment method 1210 may, for example, meet the requirements according to ASIL D. Thus, the requirements of "Automotive Safety Integrity Level D" (ASIL D) relate to the highest classification of the initial hazard (risk of injury) defined in the ISO 26262 standard and to the strictest level of safety measures that can be used according to this standard to avoid residual risks. Alternatively, if the system 1000 is classified as safety-critical according to the hazard level "catastrophic", then the "direct law" can be developed in aviation according to DAL A, i.e., according to the requirements of "Design Assurance Level A (DAL A)".

[0029] The first adjustment method 1210 may receive data from a minimum required number of sensors that are needed to control the system 1000 so as to meet the requirements for its functional safety, such as ASIL D. The apparatus 1200 may also be configured to control the system 1000 such that the system 1000 is subject to lower requirements for its functional safety, i.e., ASIL C, ASIL B, ASIL A, or quality management (QM) requirements. This can be achieved, for example, in such a way that the first adjustment method 1210 a priori prevents the operating state of the system 1000 that causes the system 1000 to be subject to higher requirements for its functional safety, such as the yaw of a vehicle during a high-speed turn.

[0030] The first adjustment method 1210 can be based, for example, on data from a single sensor, at most two sensors, or at most three sensors. Thus, compared to more complex adjustment methods, the costs for implementing and / or demonstrating compliance with the requirements for functional safety can be reduced.

[0031] The device 1200 for controlling the control system 1000 is also configured to control the component 1300 according to a second adjustment method 1220. The second adjustment method 1220, the so-called "normal law", does not necessarily have to meet the requirements for the functional safety of the system 1000. The second adjustment method 1220 can meet no requirements or only some requirements. For example, the second adjustment method 1220 can meet the requirements according to QM, ASIL A, ASIL B, or ASIL C.

[0032] The second adjustment method 1220 can receive data from any number of sensors and / or models in order to control the control system 1000. The second adjustment method 1220 can be based, for example, on data from at least one sensor, at least two sensors, or at least three sensors. In particular, the number of sensors for controlling the control system 1000 according to the second adjustment method 1220 can be greater than the number of sensors for controlling the control system 1000 according to the first adjustment method 1210.

[0033] The second adjustment method 1220 can in particular be more complex than the first adjustment method 1210. For example, when controlling the control system 1000, the second adjustment method 1220 can take into account, for example by means of sensor data or based on one or more models, the wear of components such as electric motors, spindles, etc., see Figure 2 . In particular, the second adjustment method 1220 can take into account external disturbing factors such as wind force. In particular, the second adjustment method 1220 can use artificial intelligence to improve the adjustment method 1220 during operation, for example continuously adapting to the user of the control system 1000 or to the control system 1000 itself.

[0034] Figure 2 A schematic view shows an exemplary embodiment of a component of the system, namely an electromechanical braking device 2300, which can be controlled, for example, by a device for controlling a system. In the electromechanical braking device 2300, a brake disc with brake linings 2340, a spindle 2330, a transmission 2320, and an electric motor 2310 are shown. The electromechanical braking device 2300 is designed for indirect actuation of the braking device and is not capable of implementing a purely mechanical actuation of the brake, such as a hydraulic actuation.

[0035] Figure 3 A schematic view shows a vehicle 3000 having an exemplary embodiment of an electromechanical braking device 3300, which is controlled by an exemplary embodiment of a device 3200 for controlling the control system 3000.

[0036] Vehicle 3000 includes, for example, four electromechanical braking devices 3300. Each electromechanical braking device 3300 can be coupled to one or more devices 3200 for controlling system 3000 in order to control system 3000. System 3000 can be steered by a steering device 3400. The steering device 3400 can be directly or indirectly coupled to one or more devices 3200 for controlling system 3000.

[0037] Figure 4 A schematic diagram is shown of a control signal s(t) for controlling a system according to a conventional method 4100 (above) and according to an exemplary method 4200 according to the present invention (below).

[0038] According to the conventional method 4100, a control signal s(t) for controlling a system or a component is controlled according to an active regulation method 4110, wherein the active regulation method 4110 and / or the system and / or its components are monitored. The active regulation method 4110 meets the requirements for the functional safety of the system, such as ASIL D. In the conventional method 4100, in response to determining that one or more monitoring criteria are met or not met, at Figure 4 point 4115 therein, a switch is made from the active regulation method 4110 to a redundant regulation method 4120, and a control signal s(t) is output based on the redundant regulation method 4120. Herein, the redundant regulation method 4120 can represent a degradation, i.e., a deterioration, of the system behavior.

[0039] Determining that one or more monitoring criteria are met or not met can be based, for example, on sensor data and can be carried out, for example, in the case of using a switch to switch between devices in which the active regulation method 4110 or the redundant regulation method 4120 is implemented.

[0040] According to the exemplary method 4200 according to the present invention, a control signal s(t) for controlling a system or a component is always output as a result of at least two possible regulation methods, which can be used in parallel in time for controlling the system. Herein, all of the regulation methods among the at least two possible regulation methods do not or do not have to meet the requirements for the functional safety of the system and / or its components. However, at least one of the at least two possible regulation methods meets the requirements for the functional safety of the system and / or its components.

[0041] As is the case without loss of generality (oBdA) in Figure 4As shown, as long as the control signal s(t) is within the tolerance range around the control signal according to the first adjustment method 4210, the control signal s(t) according to the method of the present invention can be output, and this control signal follows the adjustment according to the second adjustment method 4220. The first adjustment method 4210 meets the requirements for the functional safety of the system and / or its components within the tolerance range. Thus, if the control signal s(t) output to the system is within the tolerance range around the control signal according to the first adjustment method 4210, the second adjustment method 4220 does not necessarily have to meet the requirements for functional safety. In other words, the requirements for the functional safety of the system are met while relaxing the requirements for implementing the second adjustment method 4220.

[0042] If the control signal s(t) leaves the tolerance range, for example, at reference numeral 4215 in the drawing, then the control signal s(t) basically follows the adjustment according to the first adjustment method 4210, if necessary, with smoothing of the signal in the transition region. In the case of restarting the adjustment according to the second adjustment method 4220, the output control signal s(t) can again follow the adjustment according to the second adjustment method 4220.

[0043] The adjustment can also be implemented differently, for example, based on the driving situation, such as based on the adjustment method during straight driving or turning.

[0044] If switching from one adjustment method to another, for example, from the first adjustment method 4210 to the second adjustment method 4220 and / or vice versa, then this switch can be recorded. The recording can be implemented, for example, in order to read the event in the workshop, for example, and / or in order to wirelessly and / or wire directly transmit the associated data to the manufacturer of the device and / or component.

[0045] For example, depending on the driving situation and / or depending on the available adjustment methods that meet the same or different requirements for the functional safety of the system, multiple tolerance ranges can also be used to output the signal s(t).

[0046] The output of the signal s(t) can be carried out, for example, for 1, 2, 5, or 10 seconds, such that a brief exceedance of the tolerance range is allowed. Alternatively, a brief exceedance of the first tolerance range can be allowed, while no exceedance of the second tolerance range is allowed, in order to meet the requirements for the functional safety of the system. The output of the signal s(t) can in particular be carried out such that the output signal is always within the tolerance range of the adjustment method that meets the highest requirements for the functional safety of the system. If multiple adjustment methods meet the highest requirements, then the output of the signal s(t) can follow the adjustment according to the adjustment method selected by the user, for example.

[0047] Figure 5A schematic diagram showing a method 5000 for controlling a system with high requirements for functional safety is shown. The method includes determining 5100 an adjustment of the system according to a first adjustment method, the first adjustment method meeting a first requirement for the functional safety of the system; determining 5200 an adjustment of the system according to a second adjustment method; determining 5300 a difference between the adjustment of the system according to the first adjustment method and the adjustment of the system according to the second adjustment method; and outputting 5400 a signal for controlling the system based on the determined difference according to the requirement for the functional safety of the system.

[0048] It should be noted that in different industries, countries, and regions, different standards may be relevant, but each relevant standard is not clearly identified, and these different standards are generally referred to herein. The principles of the currently disclosed devices and methods can be used in combination with each of these standards.

Claims

1. A method (5000) for controlling a system (1000; 3000) having requirements for functional safety, wherein, The method (5000) includes: Determining (5100) an adjustment of the system (1000; 3000) according to a first adjustment method (1210; 4210), the first adjustment method meeting a first requirement for the functional safety of the system (1000; 3000); Determining (5200) an adjustment of the system (1000; 3000) according to a second adjustment method (1220; 4220); Determining (5300) a difference between the adjustment of the system according to the first adjustment method (1210; 4210) and the adjustment of the system according to the second adjustment method (1220; 4220); and Outputting (5500) a signal for controlling the system (1000; 3000) based on the first requirement for the functional safety of the system (1000; 3000) and based on the determined difference.

2. The method (5000) according to claim 1, wherein, The method (5000) further includes: Determining (5400) whether the difference is within a first tolerance range around the adjustment of the system (1000; 3000) according to the first adjustment method (1210; 4210); and In response to determining that the difference is within the first tolerance range, outputting (5500) a signal for controlling the system (1000; 3000), wherein the signal follows the adjustment of the system (1000; 3000) according to the second adjustment method (1220; 4220).

3. The method (5000) according to claim 2, wherein, The method (5000) further includes: In response to determining that the difference is outside the first tolerance range, outputting (5500) a signal for controlling the system (1000; 3000), wherein the signal follows the adjustment of the system (1000; 3000) according to the first adjustment method (1210; 4210).

4. The method (5000) according to claim 2, wherein, The method further includes: In response to determining that the difference is outside the first tolerance range, determining whether the difference is within a second tolerance range around the adjustment of the system (1000; 3000) according to the first adjustment method (1210; 4210); and Outputting (5500) a signal for controlling the system (1000; 3000), wherein the signal follows the adjustment of the system (1000; 3000) according to a third adjustment method that meets a second requirement for the functional safety of the system (1000; 3000).

5. The method (5000) according to any one of claims 1 to 4, wherein, The determination (5100) of the adjustment of the system (1000; 3000) according to the first adjustment method (1210; 4210) and the determination (5200) of the adjustment of the system (1000; 3000) according to the second adjustment method (1220; 4220) are performed simultaneously and / or continuously and / or in parallel and / or sequentially.

6. The method (5000) according to any one of claims 1 to 5, wherein The first adjustment method (1210; 4210) is selected according to the operating mode of the system (1000; 3000) and / or according to the selection of a user of the system (1000; 3000).

7. The method (5000) according to any one of claims 1 to 6, wherein, The first adjustment method (1210; 4210) is selected from a plurality of first adjustment methods, wherein each of the plurality of first adjustment methods satisfies a first requirement for the functional safety.

8. An apparatus (1200; 3200) for controlling a system (1000; 3000) having requirements for functional safety, wherein, The device (1200; 3200) includes: one or more processors; and a non-volatile computer-readable storage medium including instructions stored thereon, which, when executed by the one or more processors, cause the device (1200; 3200) to control the system (1000; 3000) according to the method according to any one of claims 1 to 7.

9. The apparatus (1200; 3200) according to claim 8, wherein, The device further includes: at least one electromechanical control device, wherein the electromechanical control device does not allow direct mechanical control.

10. A system (1000; 3000), wherein, The system (1000; 3000) includes at least one device according to claim 8 or 9.

Images