Method for monitoring a technical system, in particular a motor vehicle

Abstract

The invention relates to a method for monitoring a technical system comprising a plurality of computing units on which software components can be installed during operation of the technical system, wherein the computing units are monitored in accordance with monitoring requirements associated with the software components. The invention also relates to an apparatus, a computer program product, a storage medium and a vehicle.

Description

Technical Field

[0001] Safety-related software is only permitted to execute on hardware with at least the safety integrity required to utilize the functions implemented by the software. Therefore, if safety-related software or new safety-related functions are subsequently loaded, for example, into control devices such as those used in vehicles, the use of such software or functions must ensure that it is also only monitored via hardware (according to the third level of the EGAS monitoring concept – see "Standardized E-"). "Hardware that is required to provide security and integrity protection."

[0002] Especially for vehicles with reloadable software, such as so-called software-defined vehicles (SDVs), this may mean pre-determining a quota—that is, which and how many hardware components must be protected to support the maximum amount of software functionality, such as dedicated storage areas, dedicated peripheral components, and dedicated hardware accelerators. However, monitoring these hardware components during operation is resource-intensive, for example, when memory must be checked by writing and reading or when diagnostic test modes must be performed in components such as GPUs. This incurs unnecessary overhead if these hardware components are not currently used for security-related functions at all. On the other hand, reloading security-related functions will also be limited to a pre-defined quota, thus restricting scalability.

[0003] The concept of adding and installing software components in technical systems (such as vehicles) (such as the so-called over-the-air (OTA) technology) is known.

[0004] Therefore, a flexible approach is needed for monitoring technology systems, especially motor vehicles. Summary of the Invention

[0005] The method for monitoring a technical system according to the invention has advantages over other systems, wherein the technical system comprises multiple computing units on which software components can be installed during system operation; and the computing units are monitored according to monitoring requirements associated with the software components. Here, monitoring should be understood in particular as monitoring in the third level of the EGAS concept. Advantageously, this monitoring is the monitoring of the functionality of the computing unit's hardware.

[0006] Advantageously, monitoring of the computing unit includes monitoring of the functional computers of the computing unit by a monitoring computer. The monitoring computer can monitor the functional computers of the computing unit, particularly through query-response communication. The monitoring computer can be located outside the computing unit or integrated within it. The monitoring computer can, in particular, be a watchdog.

[0007] Advantageously, monitoring of computing units can be adjusted, particularly activated or deactivated, based on monitoring needs. This avoids unnecessary monitoring, saving computing resources while maintaining a high level of security.

[0008] Advantageously, adjustments to the monitoring of the computing unit are made dynamically while the installed software components are running. In particular, adjustments to the monitoring can be made periodically at fixed preset time intervals.

[0009] Advantageously, adjustments to the monitoring of the computing units are made after the software components are installed on one of the computing units. This advantageously ensures that: monitoring adjustments are not performed too frequently, and that excessive resources are not required for these adjustments; simultaneously, a consistently high level of security is maintained.

[0010] Advantageously, adjustments to computing unit monitoring include: examining which components of the computing unit must be monitored based on monitoring requirements associated with installed software components. This is particularly beneficial in complex computing units with, for example, multi-functional computers, as it ensures system monitoring in a resource-optimized manner. The components to be monitored in the computing unit can be, for example, the computing core of a microcontroller, memory, or communication lines within the computing unit.

[0011] Advantageously, the monitoring requirements associated with the software component to be installed are transmitted to the technical system along with the software component, especially as metadata, and then the software component is installed on the computing unit of the technical system.

[0012] Advantageously, monitoring requirements associated with the software component to be installed can be read from a database outside the technical system. This database could be, in particular, a database available on the internet or a database provided by the software component manufacturer. However, the monitoring requirements associated with the software component to be installed can also be pre-defined by an organization (e.g., an approval authority).

[0013] The method according to the invention can be particularly advantageously applied to motor vehicles. Therefore, this technical system is advantageous for motor vehicles, especially so-called software-defined vehicles.

[0014] Alternative or additional locations may stipulate that, if the monitoring requirements cannot be met, additional resources such as hardware security modules shall be used to monitor the computing unit.

[0015] Alternative or additional sites may be specified to combine surveillance resources from other computing units (such as vehicles) if surveillance needs cannot be met.

[0016] Furthermore, there is an advantageous arrangement of means for performing each step of the method according to the invention, and a computer program product that, when executed on a computing unit, causes the computing unit to perform all the steps of the method according to the invention.

[0017] Furthermore, there is also an advantageous storage medium including the computer program product, and a vehicle including a computing unit configured to execute the method according to the invention. Attached Figure Description

[0018] An embodiment of the method according to the present invention will now be described in more detail. Here: Figure 1 A schematic flow diagram of one embodiment of the method according to the present invention is shown. Detailed Implementation

[0019] Figure 1 A schematic flow diagram of an embodiment of the method according to the invention is shown. In step 100, a software update is initiated on the vehicle's computing unit. For this purpose, the software components required for the update, along with monitoring requirements associated with those software components, are transmitted to the vehicle. The software components may, for example, be software for determining the required torque of the vehicle. Typically associated with such software components are monitoring requirements according to ASIL-D. These monitoring requirements may be transmitted in the form of a safety manifest, i.e., preferably in the form of metadata. Alternatively, however, the monitoring requirements may be downloaded from a database. The database may be located inside or outside the vehicle. Step 110 is then performed after step 100.

[0020] In step 110, it is determined which hardware is required for the software component transmitted in step 100, that is, which computing unit of the vehicle will execute the software component during vehicle operation after its installation. Then, step 120 is executed.

[0021] In step 120, the required security and integrity of the computing unit that will execute the software component is determined based on the monitoring requirements associated with the software component. Step 120 is then followed by step 130.

[0022] In step 130, monitoring of the computing unit identified in step 110 is configured based on the security integrity determined in step 120. In this case, hardware monitoring of the computing unit by a monitoring computer (e.g., a watchdog timer) can be enabled, for example. Hardware monitoring of the computing unit can also be disabled if the monitoring requirements of the computing unit decrease, for example, because a newly installed software component is assigned a lower monitoring requirement, while an older software component with a high monitoring requirement is uninstalled. Step 140 is then executed.

[0023] In step 140, the vehicle is operated. The computing unit is monitored during this process.

[0024] The embodiments of the method according to the invention described herein enable flexible and resource-efficient monitoring of vehicles with reloadable software, which is particularly advantageous in the context of the complex E / E architecture of modern vehicles.

Claims

1. A method for monitoring a technical system, the technical system comprising a plurality of computing units, wherein software components can be installed on the computing units during operation of the technical system, characterized in that, The computing unit is monitored according to the monitoring requirements associated with the software component.

2. The method according to claim 1, characterized in that, Monitoring of the computing unit includes monitoring of the computing unit's functional computers by a monitoring computer.

3. The method according to claim 1 or 2, characterized in that, Adjustments are made according to the monitoring requirements, in particular, activating or deactivating monitoring of the computing unit.

4. The method according to claim 3, characterized in that, The adjustments monitored for the computing unit are made dynamically during the runtime of the installed software components.

5. The method according to claim 3, characterized in that, The adjustments to the monitoring of the computing unit are made after the software components are installed on one of the computing units.

6. The method according to claim 5, characterized in that, Adjustments to the monitoring of the computing unit include checking which components of the computing unit must be monitored based on monitoring requirements associated with the installed software components.

7. The method according to any one of the preceding claims, characterized in that, Monitoring requirements associated with the software component to be installed are transmitted to the technical system, specifically as metadata, along with the software component, and then the software component is installed on the computing unit of the technical system.

8. The method according to any one of claims 1 to 6, characterized in that, Read monitoring requirements associated with the software components to be installed from a database, particularly a database outside the technical system.

9. The method according to any one of the preceding claims, characterized in that, The technical system in question is a vehicle, especially a motor vehicle.

10. An apparatus configured to perform each step of the method according to any one of claims 1 to 9.

11. A computer program product, when executed on a computing unit, causes the computing unit to perform all the steps of the method according to any one of claims 1 to 9.

12. A storage medium comprising a computer program product according to claim 11.

13. A vehicle comprising a computing unit, said computing unit being monitored by the method according to any one of claims 1 to 9.

Images