Method and apparatus for performing vehicle safety functions

Abstract

The invention relates to a method, a device, a system and a data structure for performing a vehicle safety function. To this end, a sender in a communication network performs the steps of obtaining data for a V2X message, obtaining an associated functional safety indicator and transmitting the obtained data together with the functional safety indicator. On the receiver side, the data and the functional safety indicator are received in the communication network and based on the received functional safety indicator it is inferred whether the data can be used in a safety function. The data structure used to this end comprises V2X data and an associated functional safety indicator, wherein the V2X data is comprised in a first container and the associated functional safety indicator is comprised in a second container.

Description

Technical Field

[0001] The present invention relates to a method for performing vehicle safety functions according to the preamble of the independent claim, and an apparatus for performing the method according to the preamble of the parallel independent claims. Background Technology

[0002] Modern vehicles are increasingly equipped with active and passive safety devices. Safety devices are typically functional units of a vehicle, configured to partially or fully automate specific safety functions. Generally, safety functions are used to restore or maintain the vehicle in a safer state or operation as possible after identifying and determining a hazardous event or situation, thereby avoiding or at least minimizing danger to people and property, as well as personal injury or property damage. Such safety functions include, for example, triggering airbags or braking one or more wheels of the vehicle using an ESC system, but also include safety functions that completely or partially take over control of the vehicle's motion and, for example, automatically change the vehicle's speed or direction of travel (e.g., to avoid rear-end collisions or obstacle avoidance). Safety functions must meet specific requirements regarding their functional safety so that no danger arises even in the event of a defect, such as a short circuit in an electronic component. Danger often arises from the unintended triggering of a safety function; for example, it is necessary to prevent the unintended triggering of an emergency avoidance maneuver due to a defect, which would cause the vehicle to veer off the road.

[0003] In the following text, the terms used are understood in the context of functional safety according to the definitions in ISO 26262 or IEC 61508 standards.

[0004] To perform safety functions, data containing information necessary for their execution, such as information about the vehicle's operating or motion status, is required. This data can be derived, for example, from sensor data from the vehicle's sensor units, such as those used to detect wheel speeds or vehicle collisions. Furthermore, this data can also come from other vehicles located around the vehicle and involved in the aforementioned hazardous events or situations. To account for data from these other vehicles, this data can be transmitted to the vehicle via a data connection. For this data, similar safety requirements to those applied to the safety functions themselves apply, ensuring that compromised data does not create a hazard.

[0005] This data transmission can be performed using different transmission technologies. For example, one conceivable technology is called V2X, for which there are different implementation standards (SAE, IEEE, ETSI, 3GPP, CSAE, etc.), and different communication technologies (DSRC, ITS-G5, LTE-V2X, 5G NR V2X, LTE, 5G, Wi-Fi, Bluetooth, etc.) are used for data transmission. Vehicle-to-X communication is particularly understood as direct communication between vehicles and / or between vehicles and infrastructure. That is, it can be, for example, vehicle-to-vehicle communication or vehicle-to-infrastructure communication. If such communication is involved within the scope of this application, it can be conducted without the intermediary of a mobile communication network or similar external infrastructure, or it can be based on a mobile network. As mentioned above, vehicle-to-X communication can be performed using the IEEE 802.11p, LTE-V2X, or 5G NR standards. Vehicle-to-X communication can also be referred to as C2X communication or V2X communication. The subdomains can be called C2C (Car-to-Car), V2V (Vehicle-to-Vehicle), C2I (Car-to-Infrastructure), V2I (Vehicle-to-Infrastructure), C2X (Car-to-Everything), or V2X (Vehicle-to-Everything).

[0006] However, there is often uncertainty as to whether the data currently available for performing the corresponding safety functions (and the information contained within that data) is sufficiently safe and reliable for performing those functions. The related area of ​​functional safety is described in the ISO 26262 standard.

[0007] Generally speaking, ensuring that the quality and reliability of data are not compromised is crucial for ensuring the execution of security functions. Such compromise could, for example, lead to the execution of security functions at the wrong time or using incorrectly calculated parameters.

[0008] The basic conception of this topic can be found in the published text DE 10 2012 215 343.

[0009] However, currently available V2X systems do not allow for the implementation of functionally critical safety functions in a manner that meets higher-level requirements, such as the Automotive Safety Integrity Level (ASIL) above the Quality Management (QM) level. Summary of the Invention

[0010] Therefore, the object of the present invention is to provide a method and an apparatus that, under the premise that ASIL > QM, allow the vehicle's safety functions to be performed as reliably and safely as possible.

[0011] According to the invention, this objective is achieved by the method and apparatus according to the independent claim, and the overall system according to the co-independent claims. Further improvements and specific embodiments of the method and the overall system are derived from the dependent claims.

[0012] According to one embodiment of the present invention, a method for a sender in a communication network includes: acquiring data for a V2X message / message, acquiring associated / corresponding functional safety indicators, and sending the acquired data together with the functional safety indicators.

[0013] Acquiring data for V2X messaging means acquiring the information and data needed in a connected transportation system, such as vehicle position, direction and speed, steering angle, and information about potential ABS responses, as well as sensor information from radar or ultrasonic sensors. Similarly, information received from other vehicles, such as via V2X or other radio channels, can also be acquired.

[0014] The associated functional safety metrics provide information related to functional safety, such as descriptions of the quality and / or error limits of previously acquired V2X data. Examples of such safety metrics include: failure rate (λ), diagnostic coverage (DC), probability of failure on demand (PFD), and failure detection time (t). Det The definition can be found in standard ISO 26262. Information regarding quality and error limits can be provided internally to the transmitter. Since the signal quality achievable by the sensor used is known, such values ​​can be stored in the transmitter's storage device. If the quality and / or error limits are to be correlated with speed, temperature, etc., this correlation can also be considered.

[0015] In an advantageous implementation, the acquired data, together with the associated functional safety indicators, can be sent in the form of a V2X message, wherein the message includes at least two containers.

[0016] The term "container" as used here refers to a segment or field of a data structure. Data typically exists as a data structure and is stored, sent, and received in this form. The structure of data, such as data packets, is usually predetermined and includes, for example, a header indicating the type of data packet, a region containing the valid data, and an end portion that may contain, for example, a CRC checksum. If the region containing the valid data is divided into two or more sub-regions containing data of different sources, meanings, or purposes, it is advantageous to logically divide these sub-regions; these divisions are called containers. If necessary or convenient, the container itself may also include containers that enable finer subdivision or structuring of the valid data region. Such containers typically have names that are easy to operate and understand; for example, a positioning container may contain data for determining location, and a management container may, in particular, include spatial and temporal reference values ​​and can be used to establish a clear basis for orientation using a navigation system.

[0017] For example, one of the containers may be a management container. The other container may include one or more functional safety indicators, and suitably, the other container may be referred to as a safety container.

[0018] In one implementation, the V2X messages mentioned above are those defined in ETSI TS 102984-2. Therefore, messages already used in the context of V2X communication are used to achieve maximum compatibility with known systems. Examples of such messages are CAM, MAP, SPAT, CPM, MCM, DENM, or IVI messages.

[0019] Even though ETSI TS 102984-2 is repeatedly referenced within the scope of these embodiments, implementations according to the invention can of course be carried out within the scope of other standards, for example, implementations can be carried out with respect to the message according to SAE J 2735 commonly used in the United States or with respect to the message according to TCSAE 53-2017-CH commonly used in China.

[0020] In one design, the additional container (hereinafter also referred to as the second container to distinguish it from the first container previously referred to as the management container) includes one or more of the following:

[0021] Timestamp, time confidence, safety message counter, safety ID, DevProcess, fault rate of data generation unit, and / or facility layer CRC checksum.

[0022] Timestamps can be included to assign specific points in time to the data, such as the time when data was generated or received, or the time when the contents of the second container were last changed. Time confidence indicates the accuracy of the time. The count value, "Security Message Counter," is a count that increments continuously with each generated message. The security ID is used to further protect the second container to prevent confusion between different senders at the receiver. The "Development Process" parameter describes the requirements that must be met during software development. The "Fault Rate" indicates the failure rate or error rate of the data generation unit. The checksum, "Facility Layer CRC," can be used to check the integrity of at least a portion of the message content.

[0023] In particular, the failure rate parameter can be advantageously used in this invention because it also has the characteristics of a key performance indicator (KPI), which describes the reliability associated with the unit that generates a portion of the data contained in the V2X message.

[0024] In another advantageous embodiment, the second container includes at least one of the following indicators, which may be included in the sub-containers included in the second container:

[0025] - Failure rate not detected, or

[0026] - Failure detection time, or

[0027] - Protection level, or

[0028] - A list of signals or a list of V2X message data to which the indicator applies.

[0029] The second container can be called a "safety signal container," a name that describes the purpose of the information contained within it. The second container can contain other information or metrics, and is not limited to the four KPIs mentioned. For example, it could contain information illustrating the degree of independence between the data in the message, often referred to as the "β" parameter.

[0030] Each of the one or more sub-containers contains information related to a specific type of information. For example, one sub-container might involve a time information signal and provide associated safety indicators, while another sub-container might involve a position signal or a velocity signal and provide other corresponding safety indicators.

[0031] Most of the information contained in the sub-container, like the failure rate mentioned above, are Key Performance Indicators (KPIs), also simply referred to as "indicators," and can be used within the scope of this invention to determine whether data transmitted within the scope of this invention can be used for security functions. One KPI is the undetected critical failure rate, which relates to the maximum number of undetected critical errors that can be included in the transmitted data per unit time. If a threshold is exceeded, it can be determined that the data associated with this KPI is not used for security functions. Another KPI is the failure detection time, which can also be compared with a threshold to determine whether the corresponding data is not used for security functions. Another KPI is the protection level value, which describes the accuracy of the corresponding data, including both systematic and random errors. Here, if a threshold is exceeded, the data can also be discarded for use within the scope of security functions. Thus, the sub-container also contains a list of signals to which the KPIs apply.

[0032] Within the scope of this invention, the sub-container may include one or more of the aforementioned KPIs; of course, it may be particularly advantageous if all four KPIs in question are included in the sub-container.

[0033] Similarly, one embodiment includes a method for a receiver in a communication network, the method comprising: receiving data along with functional safety indicators, and inferring whether the data is used for a security function based on the received functional safety indicators. The method for the receiver is a counterpart to the method described above for the sender.

[0034] In one embodiment, the V2X message includes received V2X data and associated functional safety indicators, wherein the V2X message includes at least two containers, wherein the first container includes the V2X data and the second container includes the associated functional safety indicators.

[0035] In another implementation, the second container includes one or more of the following: a timestamp, a time confidence, a message counter, a safety ID, a DevProcess, a fault-rate of the data generation unit, and / or a checksum “facility-layer CRC”.

[0036] In another advantageous embodiment, the second container includes at least one of the following indicators, which may be included in the sub-containers included in the second container:

[0037] - Failure rate not detected, or

[0038] - Failure detection time, or

[0039] - Protection level, or

[0040] - A list of signals (V2X data) for which the indicator applies.

[0041] The allocation of information to a second container or sub-container is based on whether the information pertains to all V2X data or only to a subset of said data. In the first case, it is advantageous and reasonable to transmit the information in a second container (also known as a "security container"); in the second case, it is appropriate to transmit the information in one of the sub-containers (also known as a "security signal container").

[0042] Another embodiment relates to a transmitting device in a communication network, wherein the transmitting device includes: a first acquisition module that acquires data for V2X messages; a second acquisition module that acquires one or more associated functional safety indicators; and a transmitting module that transmits the acquired data together with the acquired one or more associated functional safety indicators.

[0043] Another embodiment relates to a receiving device, which includes: a receiving module that receives V2X data and functional safety indicators; a judging module that judges whether the V2X data is used for a safety function based on the functional safety indicators; and a control module that uses the V2X data to control the safety function.

[0044] Another implementation includes the aforementioned transmitting device and receiving device.

[0045] Another embodiment relates to a data structure for use in a V2X communication network, wherein the data structure includes V2X data and associated functional safety indicators, and the data structure includes at least a first container and a second container, the first container including V2X data and the second container including at least one associated functional safety indicator. Attached Figure Description

[0046] The method described herein, as well as the overall system described herein, are explained in detail below. (See the accompanying drawings.)

[0047] Figure 1 A system according to an embodiment of the present invention is shown, and

[0048] Figure 2 This illustrates a data concept according to an embodiment of the present invention. Detailed Implementation

[0049] Figure 1 System 100 is shown, comprising a transmitting device or transmitting unit / unit 110 for transmitting and a receiving device or receiving unit / unit 120 for receiving. System 100 can perform the transmitting function of transmitting unit 110, which, in the following illustrative example, is a first vehicle 110. Furthermore, system 100 is capable of performing the receiving function of receiving unit 120, which, in the following illustrative example, is a second vehicle 120. The terms transmitting device, transmitting unit, or first vehicle are used with the same meaning, and for the sake of understanding, the most appropriate terminology is used in the respective context. The same applies to the description of the receiver.

[0050] The transmitting unit 110 and / or receiving unit 120 can be any traffic participant, such as a vehicle or a pedestrian carrying a corresponding mobile terminal device, such as a smartphone, but can also involve other units in the V2X network that have transmitting and / or receiving functions. For example, traffic signal facilities equipped with corresponding sensing mechanisms and transmitting / receiving technologies can be considered as other units.

[0051] Transmissions in V2X networks can utilize various wireless communication technologies, such as DSRC, ITS-G5, 5G NR-V2X, and Bluetooth. This data transmission is typically referred to as vehicle-to-vehicle (V2V) communication, or more generally, V2X communication. It is not strictly limited to communication between two vehicles; one participant can also be a roadside unit, such as the aforementioned traffic light infrastructure, or even a pedestrian.

[0052] In the example used here, the first vehicle 110 includes V2X data and acquired functional safety metrics.

[0053] V2X data is acquired by the first acquisition module 111, and the V2X data is generated by sensors deployed in the vehicle 110. For this purpose, as a non-exhaustive enumeration, ultrasonic sensors, cameras, radar sensors, dynamic sensors (e.g., IMUs), and / or positioning systems using GNSS can be applied, which are capable of observing the surrounding environment of the vehicle 110 and the vehicle 110 itself. Internal status information, such as whether the ABS system has been triggered, can also be used. As a possible source of V2X data, V2X data that the vehicle 110 may have received from other vehicles can also be considered; for example, another vehicle may sense the presence of an object and notify the vehicle 110 of this via a V2X message. Information obtained in this way can, of course, be transmitted by the transmitting device 110 within the scope of this invention. The data acquired by the first acquisition module 111 is transmitted to the second acquisition module 112.

[0054] The second acquisition module 112 is configured to acquire or determine functional safety indicators associated with V2X data. For this purpose, the second acquisition module 112 may, for example, access information stored in a storage device that describes the values ​​of the functional safety indicators for data from a specific data source. For example, when the V2X data involves location information, the values ​​of the safety indicators for that location information may be stored in a GPS module (not shown here). Similarly, the safety indicators of modules such as radar systems, ultrasonic sensors, or other modules providing V2X data may be stored in the sensor itself, in an associated database, or in other locations.

[0055] If the implementation includes a checksum (CRC) generation, the information obtained by the second acquisition module 112 from the first acquisition module 111 is used to generate and provide the checksum. Alternatively, the first acquisition module 111 may generate the checksum and send it to the second acquisition module 112.

[0056] Then, this information is transmitted by module 112 to the second vehicle 120 using transmitting device 113.

[0057] The V2X data acquired by the transmitting unit 110 may be information about its own driving status, or other information obtained from sensors or functions. Information about the driving status may include, for example, information such as "emergency braking has been initiated," as well as information about vehicle speed or detected traffic objects, such as pedestrians or vehicles. In addition to V2X data, the transmitting unit 110 also has functional safety indicators. These functional safety indicators are designed so that the receiver can use them to infer whether the V2X data can be used for safety functions. These functional safety indicators, also known as functional KPIs, will be described in more detail below.

[0058] In the example used here, the second vehicle 120 includes a receiving module 121 that receives data transmitted by the transmitting unit 110. The structure of the received data allows it to be further broken down into the original V2X data and corresponding functional safety indicators. If the check of the safety indicators determines that the data meets the functional requirements, the obtained V2X data can be used to trigger a safety function. Thus, the present invention enables the triggering of safety functions that were previously impossible due to the inability to ensure compliance with functional safety requirements. In one embodiment, the received information is forwarded to a judgment module 122, the information including V2X data and corresponding functional safety indicators. In an alternative embodiment (not shown), the information may include only the corresponding functional safety indicators (in which case the received V2X data can be directly transmitted to the control module 123). The judgment module 122 determines, based on the received information, whether to use the data if it has the necessary reliability, wherein reliability is assessed based on the functional safety indicators. Then, the control module 123 controls the safety function based on the judgment of the judgment module 122, at least in part, based on the received information. The judgment module may also use other information, such as data from sensors (not shown) present in the second vehicle 120.

[0059] The safety functions mentioned herein could be, for example, the automatic activation of full or partial braking of the vehicle by means of the vehicle's electronic braking system. Similarly, safety functions could involve automatic obstacle avoidance by means of an obstacle avoidance assist system, or automatic vehicle stabilization by braking one or more wheels of the vehicle and / or by throttling the vehicle's engine power. With the participation of infrastructure units such as traffic signal facilities, another safety function can also be achieved, where, for example, driving privileges can be granted by means of the present invention.

[0060] In another illustrative example, it may be proposed that the safety function involves active or passive functions, wherein the safety function is an electronic braking system and triggers automatic braking enhancement, and / or the safety function is an emergency brake assist system and triggers automatic full or partial braking of the vehicle, and / or the safety function is an obstacle avoidance assist system and triggers automatic obstacle avoidance, and / or the safety function is an ESC unit and triggers automatic vehicle stability, particularly by braking one or more wheels of the vehicle and / or by throttling the vehicle's engine power, and / or the safety function is an airbag system and triggers the ignition of the airbag.

[0061] As mentioned above, functional safety indicators are the so-called functional KPIs, or key performance indicators.

[0062] These KPIs include one or more

[0063] - The failure rate of the processing unit(s) that generated the original message.

[0064] - Undetected critical failure rate of various data used in the message

[0065] - Failure detection time, and

[0066] - Protection level.

[0067] This KPI indicates which types of errors are associated with specific data and the magnitude of those errors. Errors can consist of different components, thus the processing unit that initially provides the data has a failure rate. In the case of sensors, this represents the sensor's measurement accuracy. Furthermore, it can indicate the rate at which the sensor experiences undetected failures, which can compound errors resulting from measurement inaccuracies. Additionally, it can specify the failure detection time, which is a time after which the signal is checked to ensure it meets the stated protection level or if other critical errors have occurred. Therefore, any non-compliance can be detected and reported no later than this time.

[0068] The protection level specifies at what level of deviation from the true value the transmitting unit considers a deviation a critical error. On the receiving side, there are requirements for the accuracy of the received data, specifying the maximum permissible level of error. By comparing the protection level with these requirements (provided the protection level is less than the requirements), the receiving side can determine whether to use the transmitted data.

[0069] Figure 2 The diagram illustrates the structural configuration of message 150 being transmitted from sending unit 110 to receiving unit 120. For ease of understanding, message 150 is described using the so-called DENM message, but the invention is not limited to DENM messages. Generally, the invention can be applied to various messages used in transportation telematics systems also known as ITS (Intelligent Transport Systems), and especially to cooperative systems also known as C-ITS. Such systems are used for road, rail, ship, and air transportation. Specifically, the invention can be used in messages of ETSI TS 102 894-2, such as the aforementioned CAM, MAP, SPAT, CPM, MCM, or IVI messages.

[0070] Message 150 includes a header 150a, which may contain a protocol version, a message identifier (message ID), and a site identifier (site ID). Furthermore, as previously mentioned, message 150 contains multiple containers, in this example a management container 151, which contains information such as timestamps and location information.

[0071] In addition, other optional containers may be included, such as situation container 152 and location container 153. Since these containers are not essential to the present invention, their description is omitted here.

[0072] In an embodiment of the invention, message 150 includes another container 154. This container may be referred to as a safety container 154. Needless to say, the name of the container is not important to the invention, but its task or its contents are important. Therefore, all containers that perform the same task or provide the same contents fall within the scope of the inventive concept presented herein.

[0073] The secure container 154 may have descriptions such as timestamps and numbers, but these descriptions are optional or not essential to the invention.

[0074] Container 154 may include one or more sub-containers 155. In the illustrated example, container 154, referred to herein as safety container 154, includes three sub-containers 155, referred herein as safety signal container 155. In the most general case, safety container 154 may not include safety signal container 155.

[0075] These safety signal containers 155 include the aforementioned functional KPIs:

[0076] For the failure rate of not detecting key elements in individual parts of a message,

[0077] Failure detection time,

[0078] Protection level,

[0079] A list of matching V2X data.

[0080] Since much data shares a common source and therefore common security KPIs, implementations can be configured to form signal groups with shared security KPIs within security containers. These groups can be identified by having each sub-container begin with a list of signal names or signal positions within a message.

[0081] The structure of a DENM message is shown below, which reflects the concept of the present invention.

[0082]

[0083]

[0084] This message structure visually illustrates a message structure with containers and sub-containers. The first container mentioned earlier can be identified here as the management container, containing valid V2X data in the form of longitude, latitude, and altitude descriptions. The second container is named the "Security Container" and includes several sub-containers called "Security Signal Containers." These sub-containers contain information about the associated valid data ("linked signals") and associated security metrics, such as protection level or failure rate (λ_DU). An additional field, "β," is added to the last "Security Signal Container," which may be useful under specific conditions. This describes the independence of the transmitted data, illustrating that the number and composition of data fields in the Security Signal Container are variable and can be adjusted according to the specific circumstances.

[0085] The provided security containers can be used for all ETSI C-ITS messages, not just for the DENM shown in the example. These security containers can be attached individually and can be categorized by signal name or the location of data within the message; the KPIs apply collectively to these groups.

[0086] As described above, the safety qualifier according to the present invention enables safety-critical V2X functionality according to ISO 26262. Information in each safety signal container can be used to calculate individual failure rates, which can then be summed, for example. The resulting failure rate can be compared to the desired maximum failure rate. If the sum exceeds the maximum failure rate, it can be determined that the corresponding information should not be used in the safety function triggering process.

[0087] As a purely illustrative example, one possible dangerous situation is described where a broken-down vehicle sends a message to other vehicles notifying them of its presence on the road, allowing these vehicles to activate appropriate safety functions if necessary. For instance, braking could be triggered in a vehicle approaching the broken-down vehicle at excessive speed. This so-called Stationary Vehicle Warning (SVW) with braking represents a safety improvement over a simple warning, as it helps prevent accidents. With appropriately adjusted parameters, it can also be used in autonomous vehicles.

[0088] The KPIs provided in the container according to the present invention can be used in the following manner, wherein the abbreviations used are:

[0089] λ: Failure rate for all failures, λ D : Dangerous failure rate, λ DUNo hazardous failure rate detected; PFH: Probability of failure per hour.

[0090] 1 fit = 10 -9 / h (According to IEC61508 and ISO26262, "fit" = "Failure in time")

[0091] DC: Diagnostic coverage, e.g., DC DU =(1-λ DU / λ D )

[0092] TTF: Time-to-fault

[0093] t Det Failure detection time, i.e., the time until a failure is detected.

[0094] ESC: Electronic Stability Control = Electronic Braking System

[0095] The critical failure rate is calculated by taking the failure rate PFH on the sender side. TX Failure rate on the receiver side (PFH) RX and the failure rate on the transmission path PFH Comm To calculate by addition: PFH = PFH TX + PFH RX + PFH Comm The failure rate on the transmitting side is calculated as the sum of the individual failure rates. The calculation considers eight dynamic values: velocity, longitudinal and lateral acceleration, yaw rate and their respective confidence levels, and four positional values: location, orientation and their confidence levels.

[0096] PFH TX =λ TX,DU,总计 = λ DU,ESC + λ DU,Pos + λ DU,TX

[0097] = 8*λ DU,ESC,信号 + 4*λ DU,Pos,信号 + λ DU,TX

[0098] = 8*0.1 fit + 4*40 fit + 10 fit = 171 fit

[0099] As can be seen, the value of λ is taken from the security signal container of the message described earlier.

[0100] For the value PFH Comm PFH applies here. Comm = 1 fit, which is given by using a checksum (CRC) with a Hamming distance of 6 and additional data such as a counter, ID, etc. Furthermore, assuming that the sending and receiving sides use structurally identical equipment, there is PFH. RX = PFH TX Under normal circumstances, PFH RX ≠PFH TX However, since the receiver always knows its own PFH... RX Therefore, the corresponding values ​​can be substituted into the calculation.

[0101] Therefore, we get: PFH = PFH TX + PFH RX + PFH Comm = 343 fit

[0102] Therefore, the security features meet ASIL A requirements because the input data used remains below the 1000 fit threshold defined in ISO 26262. To achieve the next higher ASIL B level, the transmitted security metrics must be even better. For example, if DC... Pos >90% and DC TX >91%, then λ DU,Pos,信号 <10 fits and λ DU,TX < 9fit, therefore PFH TX <50 fit, and therefore PFH<100 fit, which meets the ASIL B requirement.

[0103] It should be noted that terms such as "having" or "comprising" do not exclude other elements or steps, and terms such as "a" or "an" do not exclude multiple. Reference numerals in the claims should not be considered restrictive.

[0104] It should also be noted that the configurations, features, and variations described and / or shown in the accompanying drawings in different embodiments or examples of the present invention can be arbitrarily combined with each other. Individual or multiple features are arbitrarily interchangeable. The resulting combinations of features are to be understood as covered by the disclosure of this application.

[0105] References in dependent claims are not construed as a waiver of independent object protection for the features of the referenced dependent claim. These features can also be combined with other features arbitrarily.

[0106] Features disclosed only in the specification, or features disclosed in the specification or in the claims only in combination with other features, can in principle have independent significance necessary to the invention. Therefore, these features can also be included separately in the claims to demarcate them from the prior art.

Claims

1. A method for a sender in a V2X communication network, wherein, The method includes: Retrieve data for V2X messages; Obtain one or more corresponding functional safety indicators; Send the acquired data along with one or more corresponding functional safety indicators.

2. The method according to claim 1, wherein, The acquired data, along with the acquired functional safety metrics, is sent in the form of a V2X message. The V2X message includes at least a first container and a second container. The first container includes data for the V2X message, and the second container includes at least one acquired and associated functional safety metric.

3. The method according to claim 2, wherein, The second container contains at least one of the following information: - Secure timestamp; - Time confidence level; - Security message counter; - Security ID; - Development process; - Failure rate of the data generation unit; or - Facility Layer CRC.

4. The method according to claim 2 or 3, wherein, The second container includes one or more sub-containers, and one of the sub-containers includes at least one of the following metrics: - No critical failure rate was detected; - Failure detection time; - Protection level; - A list of data to which the indicators apply.

5. A method for a receiver in a V2X communication network, wherein, The method includes: Receive V2X data and functional safety indicators; Inferring whether V2X data is used in safety functions based on functional safety indicators; and The V2X data is used in security features.

6. The method according to claim 5, wherein, The received V2X data and associated functional safety metrics are included in a V2X message, which includes at least a first container and a second container. The first container includes V2X data, and the second container includes at least one associated functional safety metric.

7. The method according to claim 6, wherein, The second container contains at least one of the following information: - Secure timestamp; - Time confidence level; - Security message counter; - Security ID; - Development process; - Failure rate of data generation unit; - Facility-level CRC checksum.

8. The method according to claim 6 or 7, wherein, The second container includes one or more sub-containers, and one sub-container includes at least one of the following metrics: - No critical failure rate was detected; - Failure detection time; - Protection level; - A list of signals to which the indicator applies.

9. A transmitting device (110) in a V2X communication network, the transmitting device comprising: The first acquisition module (111) is configured to acquire data for V2X messages; A second acquisition module (112) is configured to acquire one or more corresponding functional safety indicators; and The sending module (113) is configured to send together the data acquired by the first acquisition module (111) and one or more corresponding functional safety indicators acquired by the second acquisition module (112).

10. A receiving device in a V2X communication network, the receiving device comprising: Receiver module (121), the receiver module being configured to receive V2X data and functional safety indicators, The judgment module (122) is configured to determine whether V2X data is used in a safety function based on functional safety indicators. A control module (123) is configured to control security functions based on the judgment of the judgment module when using V2X data.

11. A communication system (100) in a V2X communication network, the communication system comprising: The transmitting device according to claim 9, and The receiving device according to claim 10.

12. A data structure (150) for use in a V2X communication network, the data structure comprising: V2X data; as well as Corresponding functional safety indicators; The data structure includes at least a first container (151) and a second container (154), the first container including V2X data and the second container including at least one associated functional safety indicator.

Images