Method and device for controlling a system with requirements for its functional safety

Abstract

Disclosed are a system, a device, and a method for controlling the system with requirements for its functional safety. The method comprises determining a control for the system according to a first control method that satisfies first requirements for the functional safety of the system; determining a control for the system according to a second control method; determining a difference between the control for the system according to the first control method and the control for the system according to the second control method; and outputting a signal for controlling the system according to the first requirements for the functional safety of the system based on the determined difference.

Description

[0001] The present invention relates to a method and a device for controlling a system with requirements for its functional safety, in particular for systems in the vehicle, aviation and / or aerospace industries. State of the art

[0002] When manufacturing, modifying and / or improving components of a system that is subject to safety requirements, it is necessary to develop the system and its components in such a way that the functional safety requirements of the components and the system are met.

[0003] In the exemplary case of using an indirect, electromechanical braking device, for example instead of a direct, mechanical braking device, in a vehicle as in Fig. As shown in Figure 2, it may be necessary to meet the requirements for vehicle control, for example, when cornering. Yaw of the vehicle can be prevented, for example, so that no one is injured by the vehicle.

[0004] In the exemplary case of the use of indirect, automatic steering of an aircraft, it may be necessary to meet the requirements for the possibility of correction of the automatic steering by a pilot so that the aircraft can be controlled directly if the indirect, automatic steering is malfunctioning and needs to be corrected to prevent damage.

[0005] Electromechanical devices are generally characterized by the fact that an actuator, such as an electric motor, is indirectly operated via an electronic controller to control a system in such a way that the system's functional safety requirements are met. The use of, for example, sensor data and / or complex algorithms to control the actuators can complicate the implementation of the system's functional safety requirements, both from a technical perspective due to the more complex implementation and financially due to the increased development effort from the component to the system level.

[0006] Conventional devices for controlling a system use redundant control methods and / or devices for controlling the system and a unit for monitoring an active control method and / or an active device for controlling the system. The monitoring unit is configured to switch from the active control method and / or active device to the redundant control method and / or redundant device in response to a determination that one or more monitoring criteria are met or not met. Therefore, both the active control method and / or active device and the redundant control method and / or redundant device must meet the functional safety requirements of the system.

[0007] DE 10 2021 121 828 A1 discloses an electromechanical braking device for a vehicle, comprising at least one friction braking device and an electromechanical actuator for actuating the friction braking device. The electromechanical braking device comprises a pneumatically releasable spring-loaded actuator. The spring-loaded actuator can be arranged and / or configured to directly exert force on at least one friction braking element. Disclosure of the invention

[0008] The invention provides a method and a device for controlling a system with requirements for its functional safety with the features of the independent patent claims.

[0009] Preferred embodiments are the subject of the respective subclaims.

[0010] The disclosed methods and apparatus for controlling a system enable a simplified implementation of complex controls for the system while always meeting the requirements for the functional safety of the system.

[0011] According to a first aspect, the invention relates to a method for controlling a system with requirements for its functional safety. The method comprises determining a control for the system according to a first control method that satisfies first requirements for the functional safety of the system; determining a control for the system according to a second control method; determining a difference between the control for the system according to the first control method and the control for the system according to the second control method; and outputting a signal for controlling the system according to the first requirements for the functional safety of the system based on the determined difference.

[0012] According to a further development, the method further comprises determining whether the difference is within a first tolerance range around a control for the system according to the first control method; and in response to a determination that the difference is within the first tolerance range, outputting the signal for controlling the system, wherein the signal follows the control for the system according to the second control method.

[0013] According to a further development, the method further comprises, in response to a determination that the difference is outside the first tolerance range, outputting the signal for controlling the system, wherein the signal follows the control for the system according to the first control method.

[0014] According to a further development, the method further comprises, in response to a determination that the difference is outside the first tolerance range, determining whether the difference is within a second tolerance range around the control for the system according to the first control method; and outputting the signal for controlling the system, wherein the signal follows a control for the system according to a third control method that satisfies second requirements for the functional safety of the system.

[0015] According to a further development, the determination of the control for the system according to the first control method and the determination of the control for the system according to the second control method take place simultaneously and / or continuously and / or in parallel and / or alternately sequentially.

[0016] According to a further development, the first control method is selected depending on an operating mode of the system and / or depending on a selection of a user of the system.

[0017] According to a further development, the first control method is selected from a plurality of first control methods, wherein each of the plurality of first control methods satisfies the first requirements for functional safety.

[0018] According to a second aspect, the invention relates to a device for controlling a system with functional safety requirements. The device comprises one or more processors; and a non-transitory, computer-readable storage medium having instructions stored thereon that, when executed by the one or more processors, cause the device to control the system according to the method described above.

[0019] According to a further development, the device further comprises at least one electromechanical control device, wherein the electromechanical control device does not allow direct mechanical control.

[0020] According to a third aspect, the invention relates to a system, wherein the system comprises at least one of the devices described above. Short description of the drawings

[0021] It shows: Fig. 1 a schematic representation of an exemplary embodiment of a device for controlling a system with high requirements for its functional safety; Fig. 2 is a schematic representation of an exemplary embodiment of an electromechanical braking device which is provided by an exemplary embodiment of the device for controlling a system according to. Fig. 1 is to be controlled; Fig. 3 a schematic representation of a vehicle with the exemplary embodiments of the electromechanical braking device according to. Fig. 2, which is represented by an exemplary embodiment of the device for controlling the system according to. Fig. 1 be controlled; Fig. 4 is a schematic representation of a control signal for controlling a system according to a conventional method (top) and according to an exemplary method according to the invention (bottom); and Fig. 5 Schematic representation of a method for controlling a system with high requirements for its functional safety.

[0022] In all figures, identical or functionally equivalent elements and devices are provided with the same reference numerals. The numbering of process steps serves the purpose of clarity and is generally not intended to imply a specific chronological order. In particular, several process steps can be performed simultaneously. Description of the embodiments

[0023] Fig. 1 shows a schematic representation of an exemplary embodiment of a device 1200 for controlling a system 1000 with high requirements for its functional safety. The system 1000, for example, a vehicle or an aircraft, comprises a component 1300 that is important for the functional safety of the system 1000. The system 1000 comprises the device 1100 and may further comprise a sensor system 1100.

[0024] The sensor system 1100 may include one or a plurality of sensors 1100. A sensor may, for example, be a force sensor, a position sensor, a current sensor, a sensor providing data related to a rotational speed of one or more wheels of the system 1000, an acceleration sensor, an airspeed sensor, an angle of attack sensor, attitude sensors, a gyroscope, a sensor for receiving data from a radio network and / or a satellite, and / or any other sensor that can provide data relevant to the functional safety of the system 1000. The sensor system 1100 may include any combination of two or more of the above-mentioned sensors.

[0025] The device 1200 for controlling the system 1000 is configured to control the component 1300 according to a first control method 1210. The first control method 1210, the so-called "direct law," meets the functional safety requirements of the system 1000. The first control method 1210 can, for example, meet the requirements of ASIL D, i.e., the requirement of "Automotive Safety Integrity Level D." ASIL D refers to the highest classification of an initial hazard (risk of injury) defined in the ISO 26262 standard and to the strictest level of safety measures that must be applied according to this standard to prevent a residual risk. Alternatively, the "direct law" can be developed according to DAL A, i.e., according to the requirement of "Design Assurance Level A" in aviation, if the system 1000 is classified as safety-critical according to the "cartostrophic" hazard class.

[0026] The first control method 1210 can receive data from a minimum number of sensors required to control the system 1000 such that the functional safety requirements are met, e.g., ASIL D. The device 1200 can also be configured to control the system 1000 such that the system 1000 is subject to lower functional safety requirements, such as ASIL C, ASIL B, ASIL A, or quality management (QM) requirements. This can be achieved, for example, by the first control method 1210 a priori preventing operating states of the system 1000 that would result in the system 1000 being subject to higher functional safety requirements, such as yawing of a vehicle during high-speed cornering.

[0027] The first control method 1210 can, for example, be based on data from a single sensor, a maximum of two sensors, or a maximum of three sensors. The effort required for implementation and / or proving that functional safety requirements are met can therefore be reduced compared to more complex control methods.

[0028] The device 1200 for controlling the system 1000 is further configured to control the component 1300 according to a second control method 1220. The second control method 1220, the so-called "normal low," does not necessarily have to meet the functional safety requirements of the system 1000. The second control method 1220 may meet none or only some of the requirements. For example, the second control method 1220 may meet the requirements according to QM, ASIL A, ASIL B, or ASIL C.

[0029] The second control method 1220 may receive data from any number of sensors and / or models to control the system 1000. The second control method 1220 may, for example, be based on data from at least one sensor, at least two sensors, or at least three sensors. The number of sensors used to control the system 1000 according to the second control method 1220 may, in particular, be greater than the number of sensors used to control the system 1000 according to the first control method 1210.

[0030] The second control method 1220 may, in particular, be more complex than the first control method 1210. For example, the second control method 1220 may detect wear on components such as an electric motor, a spindle, etc., see Fig. 2, when controlling the system 1000, e.g., using data from sensors or based on one or more models. In particular, the second control method 1220 can take external disturbances such as wind forces into account. In particular, the second control method 1220 can use artificial intelligence to improve the control method 1220 during operation, e.g., to continuously adapt it to a user of the system 1000 or to the system 1000 itself.

[0031] Fig. 2 shows a schematic representation of an exemplary embodiment of a component of a system, an electromechanical braking device 2300, which can be controlled, for example, by a device for controlling a system. The electromechanical braking device 2300 includes a brake disc with brake pads 2340, a spindle 2330, a gear 2320, and an electric motor 2310. The electromechanical braking device 2300 is designed for indirect actuation of the braking device and does not allow purely mechanical actuation of the brake, for example, hydraulic actuation.

[0032] Figure 3 shows a schematic representation of a vehicle 3000 with exemplary embodiments of electromechanical braking devices 3300 controlled by exemplary embodiments of the device 3200 for controlling the system 3000.

[0033] The vehicle 3000 includes, for example, four electromechanical braking devices 3300. Each electromechanical braking device 3300 may be coupled to one or more devices 3200 for controlling the system 3000 to control the system 3000. The system 3000 may be steered by a steering system 3400. The steering system 3400 may be coupled directly or indirectly to one or more devices 3200 for controlling the system 3000.

[0034] Fig. 4 shows a schematic representation of a control signal s(t) for controlling a system according to a conventional method 4100 (top) and according to an exemplary inventive method 4200 (bottom).

[0035] According to the conventional method 4100, a control signal s(t) is controlled for controlling a system or a component according to an active control method 4110, wherein the active control method 4110 and / or the system and / or components thereof are monitored. The active control method 4110 meets the functional safety requirements of the system, e.g., ASIL D. In response to a determination that one or more monitoring criteria are met or not met, item 4115 in the Fig. 4, in the conventional method 4100, the active control method 4110 is switched to a redundant control method 4120, and the control signal s(t) is output based on the redundant control method 4120. In this case, the redundant control method 4120 can represent a deterioration, i.e., a degradation, of the system behavior.

[0036] The determination that one or more monitoring criteria are met or not met may be made, for example, based on sensor data and, for example, using a switch to switch between devices in which the active control method 4110 or the redundant control method 4120 are implemented.

[0037] According to the exemplary method 4200 according to the invention, a control signal s(t) for controlling a system or a component is always output as the result of at least two possible control methods, which are available in parallel for controlling the system. The requirements for the functional safety of the system and / or components thereof are not, or not necessarily, met by all of the at least two possible control methods. However, at least one of the at least two possible control methods meets the requirements for the functional safety of the system and / or components thereof.

[0038] As without restriction of generality (oBdA) in Fig. As shown in Figure 4, a method according to the invention can output a control signal s(t) that follows a control according to a second control method 4220, as long as the control signal s(t) lies within a tolerance range around a control signal according to a first control method 4210. The first control method 4210 meets the requirements for the functional safety of the system and / or components thereof within the tolerance range, so that the second control method 4220 does not necessarily have to meet the requirements for the functional safety if the control signal s(t) output to the system lies within the tolerance range around the control signal according to the first control method 4210. In other words, the requirements for the functional safety of the system are met, while the requirements for the implementation of the second control method 4220 are relaxed.

[0039] If the control signal s(t) leaves the tolerance range, e.g., at reference numeral 4215, the control signal s(t) essentially follows the control according to the first control method 4210, possibly smoothing the signal in the transition range. Upon resumption of control according to the second control method 4220, the output control signal s(t) can again follow the control according to the second control method 4220.

[0040] Furthermore, the control can be carried out differently, for example based on driving situations, for example based on control procedures when driving straight ahead or cornering.

[0041] If a change occurs from one control method to another, e.g., from the first control method 4210 to the second control method 4220 and / or vice versa, the change can be registered. Registration can be performed, for example, to read out the event, e.g., in a workshop, and / or to transmit associated data wirelessly and / or wired directly to a manufacturer of the device and / or a component.

[0042] Several tolerance ranges can also be used to output the signal s(t), e.g. depending on the driving situation and / or depending on available control methods that meet the same or different requirements for the functional safety of the system.

[0043] The signal s(t) can be output in such a way that a brief exceeding of a tolerance range is permitted, for example, for 1, 2, 5, or 10 seconds. Alternatively, a brief exceeding of a first tolerance range can be permitted, while an exceeding of a second tolerance range is not permitted in order to meet the requirements for the functional safety of the system. In particular, the signal s(t) can be output in such a way that the output signal always lies within a tolerance range of the control method that meets the highest requirements for the functional safety of the system. If several control methods meet the highest requirements, the output of the signal s(t) can follow the control according to the control method that is selected, for example, by a user.

[0044] Fig.5 shows a schematic representation of a method 5000 for controlling a system with high requirements for its functional safety. The method comprises determining 5100 a control for a system according to a first control method that satisfies first requirements for the functional safety of the system; determining 5200 a control for a system according to a second control method; determining 5300 a difference between the control for the system according to the first control method and the control for the system according to the second control method; outputting 5400 a signal for controlling the system according to the requirements for the functional safety of the system based on the determined difference.

[0045] It should be noted that different standards may be applicable in different industries, countries, and regions, to which reference is made generally without clearly identifying each applicable standard. The principles of the devices and methods disclosed herein are applicable in conjunction with any of these standards. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] DE 10 2021 121 828 A1

[0007]

Claims

[1] Method (5000) for controlling a system (1000; 3000) with requirements for its functional safety, the method (5000) comprising: Determining (5100) a control for the system (1000; 3000) according to a first control method (1210; 4210) which satisfies first requirements for the functional safety of the system (1000; 3000); Determining (5200) a control for the system (1000; 3000) according to a second control method (1220; 4220); Determining (5300) a difference between the control for the system according to the first control method (1210; 4210) and the control for the system according to the second control method (1220; 4220); and Outputting (5500) a signal for controlling the system (1000; 3000) according to the first functional safety requirements of the system (1000; 3000) based on the determined difference. [2] The method (5000) of claim 1, wherein the method (5000) further comprises: Determining (5400) whether the difference is within a first tolerance range for a control for the system (1000; 3000) according to the first control method (1210; 4210); and in response to a determination that the difference is within the first tolerance range, outputting (5500) the signal for controlling the system (1000; 3000), the signal following the control for the system (1000; 3000) according to the second control method (1220; 4220). [3] The method (5000) of claim 2, wherein the method (5000) further comprises: in response to a determination that the difference is outside the first tolerance range, outputting (5500) the signal for controlling the system (1000; 3000), the signal following the control for the system (1000; 3000) according to the first control method (1210; 4210); [4] The method (5000) of claim 2, wherein the method further comprises: in response to a determination that the difference is outside the first tolerance range, determining whether the difference is within a second tolerance range around the control for the system (1000; 3000) according to the first control method (1210; 4210); and Outputting (5500) the signal for controlling the system (1000; 3000), wherein the signal follows a control for the system (1000; 3000) according to a third control method which satisfies second requirements for the functional safety of the system (1000; 3000). [5] Method (5000) according to any one of claims 1 to 4, wherein the determining (5100) of the control for the system (1000; 3000) according to the first control method (1210; 4210) and the determining (5200) of the control for the system (1000; 3000) according to the second control method (1220; 4220) take place simultaneously and / or continuously and / or in parallel and / or sequentially. [6] Method (5000) according to any one of claims 1 to 5, wherein the first control method (1210; 4210) is selected depending on an operating mode of the system (1000; 3000) and / or depending on a selection of a user of the system (1000; 3000). [7] The method (5000) of any one of claims 1 to 6, wherein the first control method (1210; 4210) is selected from a plurality of first control methods, each of the plurality of first control methods satisfying the first functional safety requirements. [8] Device (1200; 3200) for controlling a system (1000; 3000) with requirements for its functional safety, the device (1200; 3200) comprising: one or more processors; and a non-transitory, computer-readable storage medium comprising instructions stored thereon that, when executed by the one or more processors, cause the apparatus (1200; 3200) to control the system (1000; 3000) according to the method of any one of claims 1 to 7. [9] The device (1200; 3200) of claim 8, wherein the device further comprises: at least one electromechanical control device, wherein the electromechanical control device does not allow direct mechanical control. [10] System (1000; 3000), wherein the system (1000; 3000) comprises at least one device according to any one of claims 8 or 9.

Images