Method for performing a function of a motor vehicle

Abstract

Method for safely performing a function provided by means of a motor vehicle (401), comprising the following steps: Receiving (101) infrastructure data signals representing infrastructure data intended for a function provided by means of a motor vehicle (401), Receiving (103) safety condition signals, which represent at least one safety condition that must be met in order for the function to be executed based on the infrastructure data, Checking (105) whether at least one safety condition is met, Determine (107) whether the function may be executed based on the infrastructure data, based on a result of the check, Generating (109) result signals which represent a result of determining, Output (111) the generated result signals.

Description

[0001] The invention relates to a method for the safe execution of a function provided by a motor vehicle. The invention further relates to a device, a computer program, and a machine-readable storage medium. State of the art

[0002] Patent DE 10 2013 108 034 B3 discloses a method for automatically controlling the entry of a road vehicle into a controlled section of road.

[0003] The patent application DE 10 2009 036 177 A1 discloses a method for increasing the road safety of vehicles.

[0004] Patent DE 10 2006 048 627 B3 discloses a method for controlling traffic flows involving hazardous materials.

[0005] Disclosure document DE 10 2017 204 603 A1 discloses a vehicle tax system and a method for controlling a vehicle.

[0006] The patent application DE 10 2018 124 807 A1 discloses a system and a method for operating a hybrid powertrain of a vehicle.

[0007] The patent application DE 10 2017 212 227 A1 discloses a method and a system for vehicle data collection and vehicle control in road traffic.

[0008] Motor vehicles that use data from an infrastructure use this data, for example, for warning functions, information functions and comfort functions.

[0009] When infrastructure data is used to execute a safety-critical function, such as an emergency braking function, it must be ensured that the infrastructure data has not been manipulated, for example. Disclosure of the invention

[0010] The object underlying the invention is to provide a concept for the efficient and safe execution of a function provided by means of a motor vehicle.

[0011] This problem is solved by means of the respective subject matter of the independent claims. Advantageous embodiments of the invention are the subject matter of dependent claims.

[0012] Following a first aspect, a procedure for the safe execution of a function provided by means of a motor vehicle is provided, comprising the following steps: Receiving infrastructure data signals representing infrastructure data intended for a function provided by a motor vehicle, Receiving safety condition signals, which represent at least one safety condition that must be met for the function to be executed based on the infrastructure data; checking whether at least one safety condition is met. Determine whether the function may be executed based on the infrastructure data, based on a test result. Generating result signals that represent a result of the determination, Outputting the generated result signals.

[0013] According to a second aspect, a device is provided which is set up to carry out all steps of the procedure according to the first aspect.

[0014] According to a third aspect, a computer program is provided which includes instructions that, when the computer program is executed by a computer, for example by the device according to the second aspect, cause it to execute a procedure according to the first aspect.

[0015] According to a fourth aspect, a machine-readable storage medium is provided on which the computer program is stored according to the third aspect.

[0016] The invention is based on the understanding that, before a motor vehicle function uses infrastructure data, it is checked whether at least one safety condition is met. Based on this result, it is then determined whether the function may be executed using the infrastructure data. Depending on this, corresponding result signals are then generated and output.

[0017] The function is then executed, or not, based in particular on the generated result signals using the infrastructure data.

[0018] This allows for the efficient and advantageous assurance that a secure environment is created when executing a function based on infrastructure data. The security condition can thus define or establish a context within which a vehicle function can be safely executed based on infrastructure data.

[0019] This results in the particular technical advantage of minimizing or preventing risks to other road users in the vicinity of the vehicle. In particular, it advantageously ensures that risks to the vehicle itself are minimized or prevented.

[0020] In this context, "Sicher" (safe) specifically means "safe" and "secure." While these two English terms are usually translated into German as "sicher," they have slightly different meanings in English.

[0021] The term "safe" refers specifically to the topic of accidents and accident prevention. Executing the function based on infrastructure data, which defines "safe," means, in particular, that the probability of an accident or collision is less than or equal to a predetermined probability threshold.

[0022] The term "secure" is specifically directed towards the topic of computer protection or hacker protection, i.e., how secure a (computer) infrastructure and / or a communication infrastructure, in particular a communication link between a motor vehicle and a device according to the second aspect, is against unauthorized access or data manipulation by third parties ("hackers").

[0023] Executing a function based on infrastructure data, which is "secure", therefore requires, in particular, adequate and sufficient computer protection or protection against hackers.

[0024] According to one embodiment, the at least one safety condition is selected from the following groups of safety conditions: the presence of a predetermined Safety Integrity Level (SIL or Automotive Safety Integrity Level ASIL) of at least the motor vehicle and the infrastructure, in particular including a communication link and / or communication components, especially with regard to the overall systems in the motor vehicle and infrastructure, and in particular parts; e.g., components, algorithms, interfaces, etc.; the presence of a maximum latency of communication between the motor vehicle and the infrastructure; the presence of a predetermined computer protection level of a device according to the second aspect; and the presence of predetermined components and / or algorithms and / or communication capabilities.which are used to execute the steps of the procedure according to the first aspect, the existence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication options, which are used to execute the steps of the procedure according to the first aspect, the existence of predetermined availability information indicating the availability of predetermined components and / or algorithms and / or communication options, the existence of predetermined quality criteria for the predetermined components and / or algorithms and / or communication options, the existence of a plan that includes measures to reduce errors and / or measures in case of failure of predetermined components and / or algorithms and / or communication options and / or measures for misanalysis and / or measures in case of misinterpretation, the existence of one or more fallback scenarios, the existence of a predetermined function,The existence of a predetermined traffic situation, the existence of predetermined weather conditions, the maximum possible time for each execution of a step or several steps of the procedure according to the first aspect, and the existence of a test result confirming that elements or functions used to execute the procedure according to the first aspect are currently functioning correctly.

[0025] A communication link is, for example, a communication link between the device described in the second aspect and the motor vehicle. A communication link comprises, for example, one or more communication channels.

[0026] In one embodiment, a component used to carry out the method according to the first aspect is an element selected from the following group of components: environment sensor, motor vehicle, infrastructure, device according to the second aspect, motor vehicle system, in particular drive system, clutch system, brake system, driver assistance system, communication interface of the motor vehicle or the infrastructure, processor, input, output of the device according to the second aspect, control unit, in particular main control unit of the motor vehicle.

[0027] A computer protection level is defined in particular as follows: an activated firewall and / or a valid encryption certificate for encrypting communication between the vehicle and the infrastructure and / or an activated virus program with current virus signatures and / or the presence of protection, in particular mechanical protection, especially burglary protection, for the computer, in particular the device according to the second aspect, and / or the presence of a means of verification that signals, in particular infrastructure data signals, have been transmitted correctly, i.e., without errors.

[0028] An algorithm, for example, includes the computer program according to the third aspect.

[0029] By specifically checking that redundancy and / or diversity exists in predetermined components and / or algorithms and / or communication options, the technical advantage is achieved, for example, that if the corresponding component, such as a computer, or the corresponding algorithm or communication option fails, a safe function can still be executed.

[0030] To ensure the accuracy of results, one embodiment allows them to be calculated multiple times and the corresponding results to be compared. Only if the results match is it determined that the results are correct. If an odd number occurs multiple times, it can be stipulated, for example, that the result with the highest number of identical results is considered correct.

[0031] According to one embodiment, it is provided that at least one safety condition is selected depending on a currently existing situation and / or depending on a motor vehicle model and / or a motor vehicle type and / or depending on an infrastructure model and / or an infrastructure type and / or depending on the function.

[0032] This results, for example, in the technical advantage that at least one safety condition can be selected efficiently.

[0033] According to one embodiment, the determination is carried out depending on a currently existing situation and / or depending on a motor vehicle model and / or a motor vehicle type and / or depending on an infrastructure model and / or an infrastructure type and / or depending on the function.

[0034] This results, for example, in the technical advantage that the determination step can be carried out efficiently.

[0035] According to one embodiment, if the result indicates that the function may be executed based on the infrastructure data, the execution of the function based on the infrastructure data is monitored by repeating the steps of checking, determining, and outputting the generated result signals, with the function continuing to be executed depending on a newly determined result.

[0036] This results, for example, in the technical advantage that the execution of the function can be efficiently monitored based on the infrastructure data.

[0037] For example, if the recheck reveals that at least one safety condition is no longer met, the execution of the function will be aborted.

[0038] For example, if the recheck shows that at least one safety condition is still met, the function will continue to be executed.

[0039] In one embodiment, it is provided that one or more process steps are carried out internally within the motor vehicle and / or that one or more process steps are carried out externally, in particular in the infrastructure and / or in particular in a cloud infrastructure.

[0040] This results, for example, in the technical advantage that the relevant process steps can be carried out efficiently and redundantly. This can be particularly advantageous in further increasing safety.

[0041] According to one embodiment, it is provided that one or more process steps are documented, in particular documented in a blockchain.

[0042] This results, for example, in the technical advantage that the process can be analyzed retrospectively after it has been carried out or executed, due to the documentation. Documenting in a blockchain offers the particular technical advantage that the documentation is tamper-proof and forgery-proof.

[0043] A blockchain (also called a block chain) is, in particular, a continuously expanding list of data records, called "blocks," that are linked together using one or more cryptographic methods. Each block contains, in particular, a cryptographically secure hash (value) of the previous block, a timestamp, and transaction data.

[0044] In one embodiment, it is provided that it is verified whether an entirety consisting of a motor vehicle and infrastructure involved in the procedure according to the first aspect, including communication between infrastructure and motor vehicle, is secure, so that the motor vehicle and / or a local and / or a global infrastructure and / or communication between motor vehicle and infrastructure are checked accordingly.

[0045] This means, in particular, that the components used in the execution of the procedure according to the first aspect are checked for security, i.e., whether they meet certain security conditions, before the function may be executed using or based on the infrastructure data.

[0046] Important or dependent criteria include, for example, one or more of the safety conditions described above.

[0047] According to one embodiment, the function is an element selected from the following group of functions: emergency braking function, guidance function for at least partially automated driving of the motor vehicle, lighting assistance function, in particular high beam assistance function, ESP function, ABS function, airbag function, driving planning function, traffic analysis function, braking function, drive function, in particular engine function, steering function.

[0048] This results, for example, in the technical advantage that particularly suitable functions can be used.

[0049] According to one embodiment, the infrastructure data comprises one or more elements selected from the following group of data: environmental sensor data from an infrastructure environmental sensor, environmental data representing the environment of the motor vehicle, weather data representing the weather in the environment of the motor vehicle, traffic data representing traffic in the environment of the motor vehicle, hazard data representing the location and / or type of hazard in the environment of the motor vehicle, and road user state data representing the state of a road user in the environment of the motor vehicle.

[0050] This results, for example, in the technical advantage that particularly suitable infrastructure data can be used.

[0051] The phrase "at least partially automated leadership" includes one or more of the following cases: assisted leadership, semi-automated leadership, highly automated leadership, fully automated leadership.

[0052] Assisted driving means that the driver of the vehicle is permanently responsible for either the lateral or longitudinal control of the vehicle. The other driving task (i.e., controlling the longitudinal or lateral movement of the vehicle) is performed automatically. This means that with assisted driving, either the lateral or longitudinal control of the vehicle is automatic.

[0053] Partially automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings) and / or for a certain period of time, the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. However, the driver must continuously monitor the automated control of the longitudinal and lateral steering in order to be able to intervene manually if necessary. The driver must be ready to take over full control of the vehicle at any time.

[0054] Highly automated driving means that for a certain period of time in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral steering. The driver does not need to constantly monitor the automated control of longitudinal and lateral steering in order to intervene manually if necessary. If required, a takeover request is automatically issued to the driver to assume control of longitudinal and lateral steering, with a sufficient time buffer. Therefore, the driver must be potentially capable of taking over control of longitudinal and lateral steering.The limits of automatic control of lateral and longitudinal guidance are automatically detected. With highly automated guidance, it is not possible to automatically create a risk-minimizing state in every initial situation.

[0055] Fully automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automated. The driver does not need to manually control the vehicle's longitudinal and lateral movements. The driver does not need to monitor the automated control of longitudinal and lateral movements in order to intervene manually if necessary. Before the automated control of longitudinal and lateral movements ends, the driver is automatically prompted to take over the driving task (controlling the vehicle's longitudinal and lateral movements), with sufficient time to do so. If the driver does not take over the driving task, the system automatically returns to a low-risk state.The limits of automatic control of lateral and longitudinal guidance are automatically detected. In all situations, it is possible to automatically return to a system state with minimal risk.

[0056] According to one embodiment, the method according to the first aspect includes executing the function based on the infrastructure data.

[0057] According to one embodiment, the method according to the first aspect is a computer-implemented method.

[0058] According to one embodiment, the method according to the first aspect is carried out or performed by means of the device according to the second aspect.

[0059] Device features are derived analogously from corresponding process features, and vice versa. This means, in particular, that the technical functions of the device according to the second aspect are derived analogously from corresponding technical functionalities of the process according to the first aspect, and vice versa.

[0060] The phrase “at least one” specifically means “one or more”.

[0061] The abbreviation "bzw." stands for "beziehungsweise", which in particular stands for "respective".

[0062] The phrase “respective” stands in particular for “and / or”.

[0063] Exemplary embodiments of the invention are shown in the drawings and explained in more detail in the following description. They show: Fig. 1. A flowchart of a procedure for the safe execution of a function provided by means of a motor vehicle, Fig. 2 a device, Fig. 3 a machine-readable storage medium, Fig. 4 a motor vehicle and Fig. 5 a table.

[0064] Fig. Figure 1 shows a flowchart of a procedure for the safe execution of a function provided by means of a motor vehicle.

[0065] The process includes the following steps: Receiving 101 infrastructure data signals representing infrastructure data intended for a function provided by means of a motor vehicle, Receive 103 safety condition signals, which represent at least one safety condition that must be met for the function to be executed based on the infrastructure data; Check 105 whether at least one safety condition is met. Determine whether the function may be executed based on the infrastructure data, based on a result of the check, Generating 109 result signals, which represent a result of the determination, Output 111 of the generated result signals.

[0066] The result of the test indicates, for example, whether at least one safety condition is met or not.

[0067] For example, it is stipulated that the function may not be executed based on the infrastructure data if the result of the check indicates that at least one security condition is not met.

[0068] For example, it is intended that the function may be executed based on the infrastructure data if the result of the check indicates that at least one security condition is met.

[0069] This means, in particular, that the result of the determination indicates whether or not the function may be executed based on the infrastructure data.

[0070] According to one embodiment, the method according to the first aspect includes executing the function based on the infrastructure data if the result of the determination indicates that the function may be executed based on the infrastructure data.

[0071] Fig. Figure 2 shows a device 201.

[0072] The device 201 is set up to perform all steps of the procedure according to the first aspect.

[0073] The device 201 includes an input 201, which is configured to receive the infrastructure data signals and the safety condition signals.

[0074] The device 201 further comprises a processor 205, which is configured to perform the steps of checking, determining and generating.

[0075] The device 201 further includes an output 207, which is configured to output the generated result signals.

[0076] Device 201, for example, is part of a cloud infrastructure.

[0077] Device 201, for example, is located within the infrastructure.

[0078] Generally, signals are received via input 203. Input 203 is therefore specifically configured to receive the corresponding signals.

[0079] Generally, signals that are output are output via output 207. Output 207 is therefore specifically configured to output the corresponding signals.

[0080] According to one embodiment, several processors are provided instead of the single processor 205.

[0081] According to one embodiment, the processor 205 is configured to perform the steps of checking, determining and generating described above and / or below.

[0082] Fig. Figure 3 shows a machine-readable storage medium 301.

[0083] A computer program 303 is stored on the machine-readable storage medium 301, which includes instructions that, when executed by a computer, cause the computer program 303 to perform a procedure according to the first aspect.

[0084] Fig. Figure 4 shows a motor vehicle 401 driving within an infrastructure 403.

[0085] Infrastructure 403 includes a road 405 on which the motor vehicle 401 travels.

[0086] The infrastructure 403 further comprises a video camera 407 including a video sensor (not shown), a light signaling system 409, and a cloud infrastructure 411, in which, for example, a device according to the second aspect may be arranged or provided. The device 201 is shown as an example. Fig. 2 drawn, which is located within infrastructure 403.

[0087] In an embodiment not shown, the infrastructure 403 comprises several environmental sensors which are spatially distributed within the infrastructure.

[0088] The environmental sensors of infrastructure 403 detect their respective environment and provide corresponding environmental sensor data for each detection.

[0089] Environmental sensor data is an example of infrastructure data.

[0090] In an embodiment not shown, the infrastructure 403 additionally or instead of the traffic signal system 409 includes further traffic facilities, for example signs, communication systems.

[0091] The motor vehicle 401 includes a roof-mounted video camera 413 comprising a video sensor (not shown).

[0092] In addition to or instead of the video camera 413, the motor vehicle 401 can, in an embodiment not shown, have further environmental sensors, which are arranged, for example, at the front and / or rear and / or side of the motor vehicle.

[0093] Further are in Fig. Four double arrows, 415, 417, 419, 421, and 423, are drawn. These symbolize a respective communication path or communication channel between individual components. Fig. 4 elements shown.

[0094] Thus, a first double arrow with the reference symbol 415 symbolizes a communication path between the motor vehicle 401 and the cloud infrastructure 411.

[0095] A second double arrow with the reference symbol 417 symbolizes a communication path between the video camera 407 of the infrastructure 403 and the cloud infrastructure 411.

[0096] A third double arrow with the reference symbol 419 symbolizes a communication link between the vehicle 401 and the traffic signal system 409. Via this communication link, the traffic signal system can, for example, send traffic signal image data—an example of infrastructure data—to the vehicle 401, where the traffic signal image data represents a current and / or a future traffic signal image. Based on the traffic signal image data, a guidance function for at least partially automated driving of the vehicle 401 can be executed.

[0097] A fourth double arrow with the reference symbol 421 symbolizes a communication path between the motor vehicle 401 and the device 201.

[0098] A fifth double arrow with the reference symbol 423 symbolizes a communication path between the device 201 and the cloud infrastructure 411.

[0099] The motor vehicle 401 includes a main control unit 425. The motor vehicle 401 can, for example, provide a first function 427, a second function 429, and a third function 431. Three quadrilaterals are shown as examples, each symbolically representing one of the functions 427, 429, and 431.

[0100] In an embodiment not shown, fewer or more functions, for example 5, can be provided by means of the motor vehicle 401.

[0101] The individual functions 427, 429, 431 can, for example, be executed using or based on the video data of the video camera 413.

[0102] In order for the individual functions 427, 429, 431 to be allowed to use infrastructure data of infrastructure 403 in addition to or instead of the video data, a prerequisite according to the concept described here is that the entirety of motor vehicle 401 and of elements involved in the procedure according to the first aspect are safe, i.e. “SAFE” and “SECURE”.

[0103] The elements involved in the procedure according to the first aspect therefore include, in particular, the infrastructure 403 and the motor vehicle 401 with its video camera 413 and the main control unit 425 with the individual functions 427, 429, 431. The elements of the infrastructure 403 are therefore, according to the Fig. In the embodiment shown in Figure 4, the cloud infrastructure 411, the video camera 407, the light signaling system 409 and the device 201.

[0104] Furthermore, the entire system also includes the respective communication paths 415, 417, 419, 421, 423 between the corresponding elements.

[0105] This means, in particular, that, for example, a communication link 415 between the vehicle 401 and the cloud infrastructure 411 is checked to see if it is secure.

[0106] Accordingly, for example, it is checked whether the video camera 407 is safe.

[0107] As criteria for determining whether a communication link or an element of the overall system is secure, one or more safety conditions are specified according to the concept described here, which must be met in order to determine that the corresponding element or communication link is secure.

[0108] For example, a communication link between two elements must have a minimum latency for the communication link to be considered secure.

[0109] For example, an environmental sensor must meet certain quality criteria to be considered safe.

[0110] For example, an environmental sensor data processing algorithm, which is executed in a device according to the second aspect in the cloud infrastructure 411 or in the device 201, must meet certain quality requirements.

[0111] For example, 411 specific emergency plans must be stored or saved in the cloud infrastructure in order for the infrastructure data to be used for executing any of the functions 427, 429, 431.

[0112] Fig. Figure 5 shows a table 501.

[0113] Table 501, viewed from top to bottom on the paper level, comprises a first row 503, a second row 505, a third row 507, a fourth row 509, a fifth row 511, a sixth row 513 and a seventh row 515.

[0114] Furthermore, Table 501, viewed from left to right on the paper level, comprises a first column 517, a second column 519, a third column 521, a fourth column 523, a fifth column 525, a sixth column 527 and a seventh column 529.

[0115] In the first row 503, the numbers 1 to 5 are entered into the individual table fields, each representing a different infrastructure.

[0116] Infrastructure 1 includes, for example, an intersection. Infrastructure 2 includes, for example, a highway on-ramp. Infrastructure 3 includes, for example, a roundabout. Infrastructure 4 includes, for example, a tunnel. Infrastructure 5 includes, for example, a traffic light system.

[0117] In the second line 505, the ASIL levels according to the ASIL classification, which infrastructures 1 to 5 each fulfill, are entered into the individual table fields.

[0118] The abbreviation "ASIL" stands for "Automotive Safety Integrity Level".

[0119] The following documents are referenced with regard to this classification: https: / / de.wikipedia.org / wiki / ISO_26262 https: / / www.iq.de / leistungen / iso-26262-fsm-und-fusi / fusi-asil-klassifikationen / https: / / en.wikipedia.org / wiki / Automotive_Safety_Integrity_Level

[0120] In the first column 517, Roman numerals I, II, III, IV and V are entered from top to bottom in the corresponding table fields, each representing a function that can be provided by means of a motor vehicle.

[0121] Function I could be, for example, an emergency braking function. Function II could be, for example, a guidance function for at least partially automated driving. Function III could be, for example, a lighting assistance function. Function IV could be, for example, a trip planning function. Function V could be, for example, an ESP function.

[0122] In the second column 519, the individual ASIL levels according to the ASIL classification are entered from top to bottom, each fulfilling the corresponding function I to V.

[0123] In the subsequent table fields, a checkmark with the reference number 531 indicates whether the combination of the corresponding function and infrastructure allows the corresponding function to be executed based on infrastructure data of the corresponding infrastructure, according to the ASIL levels.

[0124] If a diagonal line with the reference symbol 533 is entered in the corresponding table fields, it means that the corresponding combination of function and infrastructure does not allow the corresponding function to be executed based on infrastructure data due to the ASIL levels.

[0125] Table 501 therefore applies to one motor vehicle, i.e., one specific motor vehicle, with different infrastructures for different functions.

[0126] In an embodiment not shown (which is particularly independent of the one in Fig.5 shown embodiment is disclosed in itself,) it is provided that if it is determined that the infrastructure data may only be used to a limited extent, the function based on the infrastructure data may only be executed to a limited extent.

[0127] The fact that the infrastructure data may only be restricted means, for example, that the ASIL level of the corresponding infrastructure is lower than a predetermined ASIL level or the ASIL level of the function that is to be executed based on the infrastructure data. The predetermined ASIL level therefore corresponds, in particular, to the ASIL level that the infrastructure must meet so that the function may be executed without restriction based on the infrastructure data.

[0128] The restriction that the function may only be executed with limitations based on infrastructure data could, for example, mean that the function may only be executed up to a predetermined maximum vehicle speed. This means, for instance, that the function may only be executed up to a maximum vehicle speed of, say, 50 km / h (restriction) instead of, say, 120 km / h (without restriction).

[0129] The fact that the function may only be executed to a limited extent based on the infrastructure data can mean, for example, that the function may only be executed based on the infrastructure data in certain weather conditions, i.e., only in dry weather (restriction) instead of also in rain (without restriction).

[0130] In summary, the core of the invention is based, among other things, on the provision of a concept that ensures that, particularly in the case of at least partially automated, especially self-driving, motor vehicles, only functions or actions that are “SAFE” and “SECURE” are triggered or carried out when using infrastructure data.

[0131] The concept is based, among other things, in particular on analyzing how “SAFE” and “SECURE” the individual systems, i.e. the individual components, such as motor vehicles, infrastructure traffic facilities, infrastructure sensors, infrastructure computer systems (local, cloud) and communication, are.

[0132] The analysis focuses on how secure the entire system is with regard to the desired function. Specifically, this means ensuring that the requirements for "SAFE" and "SECURE" are met for a given action or function in a specific vehicle and within a specific infrastructure.

[0133] At least one security condition, i.e., the requirement, is analyzed and defined in advance, so that it does not have to be determined additionally online.

[0134] In one embodiment, it is provided that at least one safety condition is continuously analyzed online or, in particular, determined within a specific area.

[0135] For example, it is taken into account that the procedure is carried out for a specific motor vehicle or a specific motor vehicle model and the desired infrastructure, for example on a specific motorway or at a specific intersection.

[0136] One reason for this is that every vehicle and every piece of infrastructure can have different components. This means, in particular, that it must be checked each time whether at least one safety condition is met for the specific infrastructure or vehicle. Even if standards existed, current limitations, malfunctions, or influences that, for example, contradict assumptions must be verified.

[0137] Therefore, in order to execute a function based on infrastructure data, or to trigger or activate such a function, the requirements of the individual systems and the overall system must be sufficient. For example, the individual systems or components and the overall system must have at least a certain ASIL level according to the ASIL classification, such as ASIL B.

[0138] In one embodiment, the verification step(s) are subsequently checked, i.e., at a later time, for example, regularly. For instance, the verification step(s) are subsequently checked at a predetermined frequency, for example, every 100 ms.

[0139] For example, according to one embodiment, this verification, i.e., checking whether at least one safety condition is met, takes place before and / or after and / or during one or more predetermined process steps.

[0140] According to one embodiment, the checking process is carried out or performed in case of problems.

[0141] In summary, the concept described here is based in particular on the fact that, before activating a function, i.e., before using or executing the function, it is determined whether the individual elements or components involved in the process or used to determine the infrastructure data meet certain security requirements or conditions, based on infrastructure data (i.e., data provided by an infrastructure).

Claims

[1] Method for safely performing a function provided by means of a motor vehicle (401), comprising the following steps: Receiving (101) infrastructure data signals representing infrastructure data intended for a function provided by means of a motor vehicle (401), Receiving (103) safety condition signals, which represent at least one safety condition that must be met in order for the function to be executed based on the infrastructure data, Checking (105) whether at least one safety condition is met, Determine (107) whether the function may be executed based on the infrastructure data, based on a result of the check, Generating (109) result signals which represent a result of determining, Output (111) the generated result signals. [2] Method according to claim 1, wherein the at least one safety condition is selected from the following groups of safety conditions: the presence of a predetermined level of safety integrity of at least the motor vehicle (401) and the infrastructure (403), in particular including a communication link and / or communication components, especially with respect to the overall systems in the motor vehicle (401) and infrastructure (403) and in particular parts; e.g. components, algorithms, interfaces, etc., the presence of a maximum latency of communication between the motor vehicle (401) and the infrastructure (403), the presence of a predetermined level of computer protection of a device for carrying out the steps of the method according to one of the preceding claims, the presence of predetermined components and / or algorithms and / or communication capabilities.which are used to execute the steps of the method according to one of the preceding claims, the existence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication capabilities, which are used to execute the steps of the method according to one of the preceding claims, the existence of predetermined availability information indicating the availability of predetermined components and / or algorithms and / or communication capabilities, the existence of predetermined quality criteria for the predetermined components and / or algorithms and / or communication capabilities, the existence of a plan that includes measures for reducing errors and / or measures in the event of failures of predetermined components and / or algorithms and / or communication capabilities and / or measures for misanalysis and / or measures in the event of misinterpretations, the existence of one or more fallback scenarios,The existence of a predetermined function, the existence of a predetermined traffic situation, the existence of predetermined weather conditions, the maximum possible time for each execution of a step or several steps of the method according to one of the preceding claims, the existence of a test result that elements or functions used to execute the method according to one of the preceding claims are currently functioning without errors. [3] Method according to claim 2, wherein the at least one safety condition is selected depending on a currently existing situation and / or depending on a motor vehicle model and / or a motor vehicle type of the motor vehicle (401) and / or depending on an infrastructure model and / or an infrastructure type of the infrastructure (403) and / or depending on the function. [4] Method according to one of the preceding claims, wherein the determination is carried out depending on a currently existing situation and / or depending on a motor vehicle model and / or a motor vehicle type of the motor vehicle (401) and / or depending on an infrastructure model and / or an infrastructure type of the infrastructure (403) and / or depending on the function. [5] Method according to any of the preceding claims, wherein, if the result indicates that the function may be executed based on the infrastructure data, the execution of the function based on the infrastructure data is monitored by repeating the steps of checking, determining and outputting the generated result signals, with the function being executed further depending on a newly determined result. [6] Method according to any of the preceding claims, wherein one or more method steps are carried out inside the motor vehicle and / or wherein one or more method steps are carried out outside the motor vehicle, in particular in the infrastructure (403) and / or in particular in a cloud infrastructure. [7] Method according to any of the preceding claims, wherein one or more method steps are documented, in particular documented in a blockchain. [8] Method according to any of the preceding claims, wherein it is verified whether an assembly consisting of a motor vehicle (401) and infrastructure (403) involved in the method according to any of the preceding claims, including communication between infrastructure (403) and motor vehicle (401), is safe, such that the motor vehicle (401) and / or a local and / or a global infrastructure (403) and / or communication between motor vehicle (401) and infrastructure (403) are checked accordingly. [9] Method according to any of the preceding claims, wherein the function is an element selected from the following group of functions: Emergency braking function, guidance function for at least partially automated driving of the motor vehicle (401), lighting assistance function, in particular high beam assistance function, ESP function, ABS function, airbag function, driving planning function, traffic analysis function, braking function, drive function, in particular engine function, steering function. [10] Method according to any of the preceding claims, wherein the infrastructure data comprises one or more elements selected from the following group of data: environment sensor data of an infrastructure environment sensor, environment data representing an environment of the motor vehicle (401), weather data representing weather in an environment of the motor vehicle (401), traffic data representing traffic in an environment of the motor vehicle (401), hazard data representing a location and / or type of hazard in the environment of the motor vehicle (401), road user state data representing a state of a road user in the environment of the motor vehicle (401). [11] Device (201) configured to perform all steps of the method according to any of the preceding claims. [12] Computer program (303) comprising instructions which, when the computer program (303) is executed by a computer, cause it to execute a method according to any one of claims 1 to 10. [13] Machine-readable storage medium (301) on which the computer program (303) according to claim 12 is stored.

Images