Method and device for ensuring compliance with partial requirements of system elements of a vehicle during the development of a vehicle

Abstract

The invention relates to a method and a device (100) for ensuring compliance with partial requirements of system elements (X n ) for the development of a vehicle (10). A hierarchical system element structure (20) based on determined functional relationships (W n ) between system elements (X n ) is generated, which is hierarchically distributed on, N, N ≥ 2, system levels (E n ) and are distributed with sub-requirements for system elements (X i ). It is systematically verified whether the sub-requirement (T {n} , TX n ) of a system element (X n ) a system level (E n ) by the system elements that are in functional interaction (X n-1 ) of the next lower system level (E n+1 ) is fulfilled or not, based on a test comparison with a physical realization of the system elements (X n) and / or the vehicle or by means of a modeled implementation. Optimizations and / or adaptations can be carried out using the hierarchical system element structure (20).

Description

[0001] The invention relates to a method and a device for ensuring compliance with partial requirements of system elements of a vehicle during the development of a vehicle.

[0002] Modern vehicles, due to their complexity, pose a significant development challenge. Therefore, effective development processes play a crucial role in terms of time and production costs. In addition to the safety-critical aspects of modern vehicles, usability, user-friendliness, and costs for the driver also play a very important role.

[0003] During the development process, the interaction of individual system elements should always be taken into account so that control processes in the complex vehicle system are optimized and carried out in compliance with the desired minimum requirements.

[0004] In CN 113 467 474 A, an autonomous driving system is divided into five layers. Each layer can realize a predefined function of the layer using one or more limited functional components. Each layer feeds back the information of the layer to the upper layer. The information returned by the lower layer is evaluated by the upper layer, and a new instruction is formulated. Each layer performs its own functions without interfering with each other. The functions of each layer are neither complicated nor simplified, so that the development direction of the existing platform in the field of automotive technology and the rapid development of the field of artificial intelligence can be simultaneously taken into account.

[0005] DE 41 11 023 A1 describes an electronic system for a vehicle consisting of interacting elements for performing control tasks. The elements are arranged in a hierarchy, with at least one coordination element of a hierarchy level intervening in the implementation of the driver's command into a corresponding operating behavior on the elements of the next hierarchy level and thus on a predetermined subsystem of the driver-vehicle system, providing the behavior required by the higher hierarchy level for this subsystem.

[0006] DE 197 09 317 A1 proposes a method and device for controlling a vehicle, which comprises at least one source for at least one resource and at least one consumer that consumes this resource. Furthermore, at least one coordinator is provided, which allocates the resource to the consumer depending on the potential of the source and the resource requirements of the consumer.

[0007] The invention is based on the object of providing a method and a device for developing a vehicle which makes it possible to ensure during the development of the vehicle that the required control requirements are met and, if necessary, to adapt and optimize these in order to reduce the number of testing steps or the verification effort and computation effort.

[0008] In a preferred embodiment of the invention, a method for ensuring compliance with partial requirements of system elements of a vehicle for the development of a vehicle is proposed. The method can be executed by at least one processor which is operatively connected to a memory. The method comprises determining system elements for the vehicle for executing at least one predetermined control task for the vehicle. The method further comprises generating a hierarchical system element structure comprising a plurality of N, N ≥ 2, system levels, wherein at least two system elements of an nth, 2 ≤ n ≤ N, system level form a system element of the next higher (n-1)th system level and together are functionally related to executing a partial control task of this system element of the next higher system level.The method further comprises defining subrequirements for each system element of the hierarchical system element structure for executing the at least one predetermined control task of the vehicle. Furthermore, the method comprises verifying whether or not a subrequirement of a system element of a system level is met by the system elements of the next lower system level that are functionally related, based on a test comparison with a physical implementation of the system elements (or the vehicle). If the required subrequirement of a tested system element is not met, the subrequirement of the tested system element and at least one subrequirement of another system element are adjusted using the hierarchical system element structure.

[0009] A partial requirement can be a requirement or condition to be met by a system element. The partial requirements can be for compliance with an overall requirement or target requirement for the at least one control task of the vehicle. For example, the partial requirement and / or target requirement can be a product requirement or a normative requirement. A partial control task is the contribution of a system element to the predetermined control task. In concrete embodiments, the partial requirement and / or target requirement can be a time requirement or a consumption requirement. For example, it can be ensured that a complex control process of a predetermined control task of the vehicle is completed within a predetermined time (i.e. time requirement as target specification or target requirement). This can be, for example, a reaction time of a steering system orof the steering actuators to a steering command in autonomous vehicles, although this is only one example. For example, the predetermined control task can relate to operation of the vehicle, wherein sub-requirements and / or target requirements correspond to consumption requirements of the system elements of the vehicle in order to achieve a desired overall consumption of the vehicle. The sub-control tasks of the system elements contribute to the predetermined control task of the vehicle according to their sub-task. According to the system element structure, each system element of a system level is broken down into its subsystems in a lower system level, which lie immediately below this system level and are interrelated, i.e. they physically interact with one another or exchange information with one another. The system structure thus defines that the system elements can only be interrelated with system elements in the same system level.This means that the system elements in the next lower system level define a substructure of the system element in the next higher layer and are required to perform their partial control task. If the overall system is a vehicle, the first system level can correspond to the entire vehicle. The second system level can include the system elements of the driving system, energy system, body system, ADAS / HAF system, and / or infotainment system. The third system level for the driving system would consist of the drive system, braking system, steering system, etc. The test comparison against the physical realization of the system elements and / or the vehicle (right-hand side V-model) can be based on a mixture of models and physical realizations, can be made from pure physical realizations, or can be made from pure models. A modeled, e.g., simulated, realization of the system elements and / or the vehicle can also be made here.A modeled implementation can, for example, be achieved using Model Based System Engineering. In other words, the system element structure can also be a system tree or a system data structure. A system element can be a mechatronic system and can consist of electronics and / or software and mechanics. Furthermore, a system element can also include a hydraulic element and / or pneumatic element. The test comparison with a physical implementation of the system elements and / or the vehicle can also be carried out by taking measurements directly on the physical product, i.e. on the vehicle and / or system element. The adaptation of the sub-requirement of the tested system element is carried out by utilising the hierarchical system element structure and in particular the system levels. The adaptation can be carried out for a system element in the next higher or on the same system level.It is always possible to check whether the other system element offers an optimization margin, for example, a margin from the specified sub-requirement. This allows for successive elimination of violated sub-requirements. For example, sub-requirements can be adjusted without violating a target requirement for the predetermined control task.

[0010] Using the described method, the interaction of individual system elements can be considered during the development process, ensuring that control processes in the complex vehicle system are optimized and adhere to the desired minimum requirements. For example, it ensures that a complex control process is completed within a specified time. Using the proposed method, consistency can be achieved between the system levels with regard to time specifications or partial requirements for the system elements by utilizing the system element structure in the development process. Furthermore, at any point in the project, all system levels can be checked across all system elements to determine whether they are adhering to their time specifications. This reduces the need for validation and iteration loops.The application of the method presented here also makes it possible to predict during development whether the timing behavior or another sub-condition or target condition meets the normative requirements (e.g., ISO 26262). The development process ensures compliance with a target requirement for the development of a vehicle. In this case, the generated system element structure of different system levels can be used to quickly optimize and validate the timing behavior of the system elements and achieve good consistency between the system levels. The development process also allows optimization of the individual system elements even after all sub-requirements have already been met and verified. An effective development procedure is also described. The system element structure can thus be used to validate the timing behavior of the system elements.

[0011] In a further preferred embodiment of the invention, at least one subrequirement of an associated system element of the next higher system element level is adapted with respect to the system element level of the tested system element. This corresponds to a vertical optimization in the hierarchical system element structure. Thus, the system element structure is directly utilized to locally adapt the subrequirement and thus optimize it in a targeted manner. It can always be checked whether an optimization margin, for example, a distance from the specified subrequirement, is available for the other system element of the next higher system element level. In this way, violated subrequirements can be successively eliminated.

[0012] In a further preferred embodiment of the invention, at least one subrequirement of a system element that is located on the same system level as the tested system element and that is functionally related to each other is adapted in order to fulfill the adapted subrequirements. In this case, it can always be checked whether the other system element on the same system level has an optimization margin (distance) available, for example, a distance to its subrequirement. If this is the case, this distance can be made available to the other system element. Thus, the system element structure is directly utilized to locally adapt and thus optimize the subrequirement.

[0013] In a further preferred embodiment of the invention, the method comprises iteratively repeating the testing and adaptation steps until all subrequirements of the system elements are met. Thus, an automatic optimization algorithm can be provided that successively adapts the subrequirements until a consistent system of subrequirements is generated at the various levels.

[0014] In a further preferred embodiment of the invention, the method comprises re-optimizing one or more subrequirements of system elements by adapting them based on optimization variables for a respective system element. Furthermore, the following testing and adaptation steps are repeated iteratively until all subrequirements of the system elements are met. Optimization variables can include, for example, material consumption, wear, costs, etc. Thus, system elements can be subsequently optimized even if the subrequirements are already met in the product-ready state, allowing further optimization and validation to be achieved using the system element structure.

[0015] In a further preferred embodiment of the invention, the sub-requirements include fluctuations caused by influencing factors. Sub-requirements such as times for transport, implementation, or consumption in the system elements can vary greatly and are dependent on, for example, the influencing factors of temperature, humidity, radiation, manufacturing tolerances of the system elements, material fluctuations, friction, various calculation paths within electronics and / or software. However, the invention is not limited to this; further dependencies exist. The advantage here is that by taking the fluctuations into account, corridors / intervals can be specified within whose limits the actual corresponding quantities should lie (provided no adjustment is necessary). For example, a time condition such as 15.2 ms ± 0.5 ms can be taken into account. Accordingly, fluctuations (here the value 0) can also be taken into account.5 ms) can be adjusted and optimized.

[0016] In a further preferred embodiment of the invention, the step of defining subrequirements is followed by a step of determining (before the verification step) a worst-case behavior based on fluctuations in the subrequirement caused by influencing factors and using the hierarchical system element structure. Subsequently, the (defined) subrequirements are adapted based on the determined worst-case time behavior using the hierarchical system element structure. This has the advantage that the consistency in the hierarchical system element structure can be increased even before the actual verification and / or functional safety can be increased. For example, the fluctuations can be adapted / selected such that even rarely occurring cases are covered, as required, for example, in safety-relevant areas.Influencing factors can include temperature, humidity, radiation, and manufacturing tolerances. For functional safety, the response time of a system and the achievement of safe states are particularly important. Given the existing dependencies of time on humidity, temperature, etc., the worst-case times can be determined using the system tree, thus providing a basis for determining and evaluating the achievement of safe states. Any violation of the time specifications can lead to an adjustment of the time requirements (sub-requirements) through horizontal and vertical optimization, as described above.

[0017] In a further preferred embodiment of the invention, subrequirements are each time requirements that must be met by each system element to execute the subcontrol task. Time requirements and control processes are of great importance. For example, this can ensure that a complex vehicle control process is not secured and is completed within a predetermined time or time requirement. This can be, for example, the reaction time of an actuator to a steering command in autonomous driving, although there are numerous other application examples.

[0018] In a further preferred embodiment of the invention, the time requirements include not only the implementation time at each system element but also transport times between system elements. By taking transport times (and their variations) into account, suitable criteria can be developed. This better represents a real system in which information has a transmission time before it leads to an action / implementation in another system element. Thus, fluctuations (time variance) in transport times and implementation times can be incorporated into the calculations of the optimal time limits and also to safeguard the required time limits.

[0019] In a preferred embodiment of the invention, a device for ensuring compliance with a control requirement for the development of a vehicle is provided. The device comprises at least one processor operatively connected to a memory. The at least one processor is configured to carry out the method according to one of the above embodiments. With the described device, the interaction of individual system elements can be taken into account during the development process, so that control sequences in the complex vehicle system are optimized and carried out in compliance with desired minimum requirements. For example, it can be ensured that a complex control process of the vehicle (e.g., a steering process) is completed within a specified time.

[0020] In a further embodiment, a computer program product is described, comprising instructions which, when a program is executed by a computer, cause the computer to carry out the method according to the above embodiments.

[0021] In a further embodiment, a computer-readable storage medium is described, comprising instructions which, when a program is executed by a computer, cause the computer to carry out the method according to the above embodiments.

[0022] In a preferred embodiment, a vehicle is described which is developed according to the above method.

[0023] The various embodiments of the invention mentioned in this application can be advantageously combined with one another, unless otherwise stated in the individual case.

[0024] The invention is explained below in exemplary embodiments with reference to the accompanying drawings. They show: Fig. 1 is a schematic flow diagram of a method for ensuring compliance with subrequirements of system elements of a vehicle for the development of a vehicle according to one embodiment; Fig. 2 shows a schematic representation of a device for ensuring compliance with sub-requirements of system elements of a vehicle for the development of a vehicle according to an embodiment; Fig. 3 a schematic representation of a system element structure according to an embodiment; Fig. 4 a schematic representation of the causal relationships of a section of the system element structure; Fig. 5 a schematic representation of a section of the system element structure; Fig. 6 a schematic representation of a system element structure with optimization paths according to an embodiment; and Fig. 7 a schematic representation of a time variance of a transport time or implementation time as an example of a partial requirement.

[0025] Fig. 1 shows a schematic flow diagram of a method for ensuring compliance with sub-requirements of system elements to achieve a target requirement for developing a vehicle 10 according to an embodiment of the invention. The method is further described in connection with the Fig. 2 to 7 are described below. The vehicle 10 to be developed can be a newly designed vehicle 10 with new system elements X n or a vehicle 10 with at least one new system element X n or a replaced system element X n and thus a new interaction of different system elements X nThe method can be carried out by at least one processor 110, which is operatively connected to a memory 120. Such a device 100 is described, for example, in Fig. 2. Furthermore, the device 100 may also include at least one sensor.

[0026] The method comprises, in a first step, determining S100 system elements X n for the vehicle to execute at least one predetermined control task of the vehicle 10. In particular, the system elements are mechatronic system elements, which may include electronics, software and / or mechanics, or even pneumatics and hydraulics. The system elements X n serve to carry out a predetermined control task of the vehicle 10 while maintaining a target requirement (overall target requirement). The effect relationships W n between the system elements X nserve to carry out the control task of the vehicle 10. The predetermined control task can, for example, be a steering process of the actuators in response to a driver input in autonomous vehicles or consumption such as fuel consumption or electrical consumption during operation of the vehicle in order to maintain a target consumption, whereby the invention is not limited thereto.

[0027] In the example of Fig. 4, a system element C2 is described. This system element C2 generates several outputs O1, O2, O3 based on inputs K1, K2. This is achieved by the architecture of the system element C2, i.e., to achieve these outputs O1, O2, O3, the system elements A3, B3, C3, D3 and E3 interact with each other, which are thus hierarchically below the system element C2. This means that system element C2 requires the interaction of the system elements A3, B3, C3, D3 and E3 to achieve the outputs O1, O2, O3. The system elements A3, B3, C3, D3 and E3 are thus operatively related to each other, for example through information exchange (control signals or measurement signals) or through physical interaction (e.g. mechanical transmission of forces such as friction or torque). The system elements A3, B3, C3, D3 and E3 together thus result in the system element C2.

[0028] The system elements of the architecture layer can exist or act in any complex relationships, depending on the control task. Fig. In the example shown in Figure 4, for example, there is a time path T2, TB3, T4, TC3, T6, TE3, T9 with a complex causal chain. System element C2 can be the driving system, for example, and system elements A3, B3, C3, D3, and E3 can consist of the drive system, braking system, steering system, etc., although the invention is not limited thereto.

[0029] The method further comprises generating S200 a hierarchical system element structure 20 based on the functional interactions W n . Such a system element structure 20 is, for example, in the Fig. 3 shown.

[0030] The system elements X n are distributed across a variety of N, N≥2, system levels E n with n=1, ... , N arranged or assigned according to their functional relationships W n. According to the example Fig. 3, N=4 system levels E1, E2, E3, E4 are provided here, ie, n=1, 2, 3, 4. However, the invention is not limited to this. At least two system elements X n an n-th, 2 ≤ n ≤ N, system level E n a system element X n-1 the next higher (n-1)th system level E n-1 . These work together in a functional relationship W n to execute a partial control task of this system element X n-1 the next higher system level E n-1 . The W3 causal relationships of system elements A3, B3, C3, D3, and E3 are shown purely as examples. The further causal relationships of other system elements are not shown for reasons of clarity, as complex internal causal relationships may arise.

[0031] In the present example, the first level E1 corresponds to the highest level of the system element structure 20. This system level E1 corresponds, for example, to an overall vehicle level within the system element structure 20. This means that the system element A1 can correspond to the entire vehicle 10 within the hierarchy. All four system levels are purely systemic levels, ie, system levels E n . The lowest system level E4 can be broken down into the electronics / software and pure mechanics components for a fifth level (not shown here). Each system level E n comprises a requirements layer and an architecture layer. The architecture includes the requirements for the sub-system elements of system level E. n+1 out.

[0032] Regarding the architecture layer, see example of Fig. 3, it is shown that the system element C2 of the system level E2 in the architecture layer, i.e., the system level E3, is divided into five system elements A3, B3, C3, D3, and E3 of the system level E3 (architecture layer). The requirements layer further includes assigned subrequirements T {n} , TX n , which the system elements must adhere to when carrying out their partial control task. The totality of the system elements X n are on the system levels E n according to their causal relationships. This means that those system elements X n an n-th, 2≤n≤N, system level E n , which is a system element X n-1 the next higher (n-1)th system level E n-1 are functionally related to the execution of a partial control task of the system element X n-1 the next higher system level E n-1 In other words, each system element X n-1an effective contribution with the associated system elements of the same system level in order to carry out the subtask for the associated system element X n the next higher level E n-1 Conversely, there can also be system elements A2, B2, E2 that do not decompose into subsystems or lower system elements, as in Fig. 3 shown.

[0033] For the example of the system element C2, the effect relationships W n to the system elements A3, B3, C3, D3, E3 an architecture layer for the system element C2. This is in the Fig. 5 with the effect relationships W n from the Fig. 4 for illustration purposes, which forms a substructure 20' of the system element structure 20. That is, the Fig. The substructure 20' shown in Figure 5 can also be found in the system element structure 20.

[0034] The method further comprises the definition S300 of sub-requirements T {n}, TX n for each system element X n the hierarchical system element structure 20. The sub-requirements serve to fulfill the predetermined control task of the vehicle 10. The sub-requirements T {n} , TX n can be set as assumptions, e.g. from experience, or predetermined using a model.

[0035] In the present example, the sub-requirements are time requirements that are fulfilled by each system element X n must be met to execute the partial control task. For such a requirement (requirement parameter), it can be ensured that the complex vehicle control task is completed within a specified time or time requirement. This can, for example, be the reaction time of an actuator to a steering command in autonomous driving, although there are numerous other application examples.

[0036] For example, in the Fig. 5 Implementation times TX n : TA3, TB3, TC3, TD3, TE3 are required to effect the subtask of the corresponding system element and to fulfill the implementation time TA3 in system element C2. Transport times T {n} , can be considered as described below. This means, as described above, the system level E n from a requirement layer with the assigned sub-requirements T {n} , TX n and an architectural layer. For example, the level 2 system element C2 in the level 2 architecture is broken down into five further system elements A3, B3, C3, D3, and E3 for level E3.

[0037] The method further comprises verifying S400 whether a sub-requirement T {n} , TX n a system element X n a system level E nis fulfilled or not fulfilled. This would be the case, for example, if one of the system elements X that are functionally related to each other n+1 the next lower system level E n-1 , which the system element X n whose assigned sub-requirements are not met. This test is designed as a test with the physical realization, ie on the real system, of the system elements X n and / or the vehicle 10, as a comparison of whether the sub-requirements T {n} , TX n in practice from the system element(s) X nor can be implemented by the vehicle. For this purpose, a test device with corresponding sensors (not shown here) can be used to perform a measurement directly on the system element and / or vehicle. The evaluation is carried out in the verification step S400 by the at least one processor 110 based on the test result. In embodiments, the device 100 can also comprise a sensor system for testing as a system. Alternatively, the test can also be carried out on a model of the system element and / or the vehicle, for example, using model-based system engineering, or a mixture of model and physical realization.

[0038] If the required sub-requirement T {n} , TX n all tested system elements X n is fulfilled (Y in S400) or complied with, the procedure can already be carried out if all sub-requirements T {n} , TX nare fulfilled, development is complete. Then the system elements X n already designed for the vehicle in such a way that they meet the required sub-requirements T {n} , TX n to meet the target requirement.

[0039] If the required sub-requirement T {n} , TX n a verified system element X n is not fulfilled (N in S400), ie, the required sub-requirement T {n} , TX n is violated, an adjustment S500 of the sub-requirement of the tested system element and at least one further sub-requirement of another system element takes place using the hierarchical system element structure 20.

[0040] The hierarchical system element structure 20 and the determined causal relationships W n can therefore be used directly to meet the sub-requirements T {n} , TX nto adapt in a targeted manner and thus safeguard the required control process or the predetermined control task of the vehicle 10. It can always be checked whether a deviation from the specified partial requirement was determined for the other system element during verification, so that a targeted local optimization is achieved and, for example, a target requirement for the predetermined control task is not violated.

[0041] The adjustment process will now be carried out according to the Fig. 6 is described in more detail. This provides methods for systematically using the hierarchical system element structure 20.

[0042] As in the Fig. As shown in Figure 6, the adaptation 510 can be performed as a local, vertical optimization. In this case, a partial requirement of another system element Y n-1 (here A1) of the next higher system element level E n-1 (here E1) is adjusted. This next higher system element level E n-1(here E1) is a system element level which is directly above the system element level E n (here E2) of the tested system element X n (here C2). First, it can be checked whether there is still margin (distance) to fulfill its partial requirement for the system element Y n-1 (here A1) is present and then adjusted if a margin exists. The adjustment is then carried out by adjusting the sub-requirement of the tested system element X. n (here C2) such that the respective adapted sub-requirements can be technically met by the vehicle and / or system element. This can be verified in a subsequent step S400. This thus corresponds to a vertical optimization in the system element structure 20.

[0043] As in the Fig. As shown in Figure 6, the adaptation 520 can also be performed as a local, horizontal optimization. In this case, the adaptation S520 is performed for at least one further sub-requirement of another system element Y n , which is connected to the tested system element X n in the same system level E n (here, for example, A2, B2, D2, E2) and are functionally related to each other. The functional relationship exists between the system elements X n which together form a system element of the next higher system element level E n-1 form (here A1).

[0044] Then this sub-requirement of one of the other system elements Y n (here, for example, A2, B2, D2, E2). Here, it can again be checked beforehand whether the additional system element Y nhave a margin (distance) to fulfill their sub-requirement. This sub-requirement can then be adjusted together with the sub-requirement of the tested system element so that the system elements can fulfill the adjusted sub-requirements. This can be verified in a subsequent step S400. In order to determine the margin (distance), this can be preceded by a check to determine whether the adjustment of the sub-conditions of the system element at the same system level E n is possible. The described optimization is therefore a horizontal optimization in the system element structure 20. This has the advantage that the next higher system level does not have to be changed and thus a compensation within the same system level E n occurs.

[0045] As in the Fig. 1, the steps of verifying S400 and adapting S500 can be continued iteratively until all sub-requirements T {n}, TX n the system elements X n are met according to verification S400. This allows for fully automatic adjustment of the subrequirements until the system elements meet all requirements (Y in S400).

[0046] In a further step, the method can include a re-optimization S600 of one or more sub-requirements T {n} , TX n of at least one system element X n This can be achieved by adjusting based on optimization parameters for at least one system element X n This means that even though the system is already removable, the process allows for subsequent optimizations. Optimization parameters can include, for example, material consumption, wear and tear, costs, etc. This allows individual system elements to be optimized retrospectively, allowing both optimization and validation to be achieved using the system element structure.

[0047] The method then further comprises the step described above, after iteratively repeating the following steps of verifying S400 and adapting S500, until all sub-requirements of the system elements X n are fulfilled.

[0048] In a further embodiment, the method can perform an optimization of sub-requirements in the step of determining S300 prior to the verification S400. In one embodiment, a first step involves determining, prior to the step of verifying S400, a worst-case behavior based on fluctuations in the sub-requirement (for example, time fluctuations or consumption fluctuations). Such fluctuations can be caused by various influencing factors. For example, influencing factors such as temperature, humidity, radiation, manufacturing tolerances, material fluctuations, friction, or different paths of the electronics (jitter) and / or software. Such a fluctuation in a sub-requirement is, for example, in the Fig. 7, in which a distribution of times is shown (here for times, but can also be present for other sub-requirements). Worst-case time behavior can now be derived from the hierarchical system element structure 20. For example, scenarios may exist that are very unlikely if, for example, along a chain of effects, several sizes of the sub-requirements of the system elements fluctuate extremely in a certain direction and thus form a corner case (cf. here T C for illustration in Fig. 7, which deviates significantly from the mean of the distribution). Then, based on the determined worst-case behavior, at least one sub-requirement can be adapted. This takes place in step S300 and thus before verification S400. This has the advantage that consistency in the hierarchical system element structure can be increased even before the actual verification. For example, the fluctuations can be adjusted / selected in such a way that rarely occurring cases are covered, such as those required in safety-relevant areas. The response time of a system or the achievement of safe states is particularly important for functional safety. Given the existing dependencies of time on humidity, temperature, etc., the worst-case times can be determined using the system tree, and thus a statement on the achievement of the safe states can be determined and evaluated.

[0049] In particular, in the event of a violation (failure to meet worst-case time constraints) of the time specifications, a new proposal for the time budget can be developed using the described horizontal and / or vertical optimization based on the system element structure 20. In contrast to step S500, however, this step takes place before verification S400, for example, through a model comparison.

[0050] In versions such as in the Fig. 4, the control request and the sub-requests can each be time requests which are issued by each system element X n to execute the control task. These time requirements T {n} , TX n can, as in Fig. 4, next to the implementation time TX n at each system element X n also transport times T {n} between the system elements X nThis results in increased complexity, which can, however, also be used for optimization. Furthermore, real-world behavior can be better modeled because information along a chain of effects is not provided immediately (instantaneous), but rather with a transport time. This means that transport times can be adjusted while implementation times are retained, implementation times can be adjusted while transport times are retained, or both can be adjusted. This results in greater optimization scope for a more precise method that offers a further degree of optimization freedom.

[0051] Furthermore, as already described above and in the Fig. 7 clearly shows the sub-requirements T {n} , TX ninclude fluctuations caused by influencing factors. For example, the times for transport and implementation in the system elements can vary greatly and depend on factors such as temperature, humidity, radiation, manufacturing tolerances of the system elements, material fluctuations, friction, different calculation paths within electronics and / or software. Certainly, there are even more dependencies. To refine time requirements, T {n} , TX n The fluctuations can be considered as dimensions of the time variance and used in the calculation of the optimal time limits as well as to ensure the required time limits. Such fluctuations are illustrative in the Fig. 6, where θ(T) corresponds to a distribution of transport times or conversion times.

[0052] In summary, a development method for ensuring compliance with a control requirement for a vehicle 10 is described. In this method, an optimization and safeguarding of the time behavior of the system elements X is carried out via a system element structure 20 of different system levels E1, ..., E4. n quickly achieved and good consistency between the system levels E n The development process also allows for optimization of individual system elements even after all subrequirements have been met and verified. List of reference symbols 10 vehicles 20 System element structure 100 device 110 processor 120 memory 130 sensors S100 Determination of system elements S200 Creating a hierarchical system element structure S300 Defining sub-requirements S400 Verify whether a sub-requirement of a system element is met or not met S500 Adjusting partial requirements S600 Optimization of sub-requirements S510 Adjusting subrequirements S520 Adjusting subrequirements E n nth system level X n , Y n System element in the nth system level T n Time requirement transport (requirement) TX n Time requirement for implementation (requirement) W n functional effect relationship A3 system element B3 System element C3 system element D3 system element E3 system element A2 System element B2 System element C2 system element E2 system element K1 entrance K2 entrance O1 Output O2 output O3 output QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] CN 113 467 474 A

[0004] DE 41 11 023 A1

[0005] DE 197 09 317 A1

[0006]

Claims

[1] A method for ensuring compliance with sub-requirements of system elements of a vehicle for the development of a vehicle (10), executed by at least one processor (110) operatively connected to a memory (120), comprising: - Determination (S100) of system elements (X n ) for the vehicle (10) for carrying out a predetermined control task for the vehicle (10), - generating (S200) a hierarchical system element structure (20) comprising a plurality of N, N ≥ 2, system levels (E n ), where at least two system elements (X n ) of an n-th, 2 ≤ n ≤ N, system level (E n ) a system element (X n-1 ) of the next higher (n-1)th system level (E n-1 ) and together in a functional relationship (W n ) to execute a partial control task of this system element (X n-1 ) of the next higher system level (E n-1 ) stand, - Specify (S300) sub-requirements for each system element (X n ) the hierarchical system element structure (20) for executing the predetermined control task of the vehicle (10), - Verify (S400) whether a partial requirement (T {n} , TX n ) of a system element (X n ) a system level (E n ) by the functional interaction (W n ) system elements (X n-1 ) of the next lower system level (E n+1 ) is fulfilled or not, based on a test comparison with a physical or modeled realization of the system elements (X n ) and / or the vehicle, and - if the required sub-requirement of a tested system element is not fulfilled, adapt (S500) the sub-requirement (T {n} , TX n ) of the tested system element (X n ) and at least one further sub-requirement of another system element (Y n , Y n-1) using the hierarchical system element structure (20). [2] The method according to claim 1, wherein the adapting (S500) of at least one further sub-requirement comprises: - Adjusting (510) a partial requirement of the associated system element (X n-1 ) of the next higher system element level (E n-1 ) regarding the system element level (E n ) of the tested system element (X n ). [3] Method according to one of claims 1 to 2, wherein the adapting (S500) of at least one partial requirement comprises: - Adapting (S520) at least one further sub-requirement of another system element (Y n ), which is connected to the tested system element (X n ) in the same system level (E n ) and are functionally related to each other. [4] Method according to one of the preceding claims 1 to 3, further comprising: - iteratively repeating the following steps of verification (S400) and adaptation (S500) until all sub-requirements of all system elements (X n ) are met. [5] The method of claim 4, further comprising: - Re-optimization (S600) of one or more sub-requirements (T {n} , TX n ) of at least one system element (X n ) by adaptation based on optimization parameters for at least one system element (X n ); and - iteratively repeating the following steps of verification (S400) and adaptation (S500) until all sub-requirements (T {n} , TX n ) of the system elements (X n ) are met. [6] Method according to one of claims 1 to 5, wherein the partial requirements (T {n} , TX n ) include fluctuations caused by influencing factors. [7] Method according to one of claims 1 to 6, wherein the step of specifying (S300) sub-requirements comprises: - determining, before the verification step (S400), a worst-case behavior based on fluctuations in the partial requirement due to influencing factors using the hierarchical system element structure (20), and - Adapting at least one sub-requirement based on the determined worst-case behavior. [8] Method according to one of claims 1 to 7, wherein the partial requirements are time requirements which are made by each system element (X n ) must be fulfilled. [9] Method according to claim 8, wherein the time requirements (T {n} , TX n ) in addition to the implementation time (TX n ) at each system element (X n ) also transport times (T {n} ) between the interacting system elements (X n ) include. [10] Device (100) for ensuring compliance with a control requirement for the development of a vehicle (10), comprising at least one processor (110) which is operatively connected to a memory (120) and is arranged to carry out the method according to one of claims 1 to 9.

Images