Computer-implemented method for controlling a vehicle and vehicle

Abstract

The invention relates to a computer-implemented method (100) for controlling a vehicle, wherein the vehicle has at least one vehicle function and at least one domain agent for monitoring the at least one vehicle function, comprising at least the following steps: When the at least one domain agent detects anomalous behavior in the at least one vehicle function: transmitting (102) at least one anomaly report to at least one, in particular central, safety and security orchestrator agent having a large-language model, by means of the at least one domain agent; interpreting (104) the at least one anomaly report in the context of vehicle operating data, vehicle telemetry data and / or data on external environmental conditions of the vehicle, by means of the at least one safety and security orchestrator agent;Decide (106) based on the interpretation of whether at least one anomaly exists, using the at least one Safety and Security Orchestrator agent; and if an anomaly exists: generate (108) at least one control command for the at least one vehicle function. The procedure (100) can provide increased vehicle availability.

Description

[0001] The invention relates to a computer-implemented method for controlling a vehicle and a vehicle.

[0002] With the increasing complexity of modern vehicle architectures, the reliance on software-based functions for propulsion, braking, steering, driver assistance, and communication is growing. These systems are safety-critical and subject to stringent standards such as ISO 26262 (Functional Safety) and ISO / SAE 21434 (Cybersecurity). Current monitoring systems are structured separately: Functional safety systems monitor internal vehicle states (e.g., sensor failures, communication errors), while cybersecurity systems detect attacks or data manipulation. Modern attack vectors increasingly mimic functional effects (e.g., false sensor data through manipulation), and conversely, malfunctions can be misinterpreted as attacks.

[0003] Current vehicle safety systems exhibit the following limitations: Separate domain logics: Functional safety (ISO 26262) and cybersecurity (ISO 21434) operate in isolation, without joint evaluation. Lack of context interpretation: Systems detect errors but cannot distinguish between technical malfunctions and targeted attacks. Reactive measures: Malfunctions are only addressed after they occur; no proactive risk assessment. Lack of learning capability: Current monitoring systems are based on fixed rules and signatures, without adaptive adjustment to new scenarios. Lack of transparency: Drivers and developers do not receive explainable root cause analyses for safety-relevant events.

[0004] The object of the invention is to provide a computer-implemented method and a vehicle that provide increased vehicle availability.

[0005] The problem is solved by the features of the independent claims. Advantageous further developments are the subject of the dependent claims and the following description.

[0006] According to a first aspect, a computer-implemented method for controlling a vehicle is described, wherein the vehicle has at least one vehicle function and at least one domain agent for monitoring the at least one vehicle function, comprising at least the following steps: If the at least one domain agent detects anomalous behavior in the at least one vehicle function: transmitting at least one anomaly report to at least one, in particular central, safety and security orchestrator agent, which has a large-language model, by means of the at least one domain agent; interpreting the at least one anomaly report in the context of vehicle operating data, vehicle telemetry data and / or data on external environmental conditions of the vehicle, by means of the at least one safety and security orchestrator agent;Decide, based on the interpretation of whether at least one anomaly exists, using at least one Safety and Security Orchestrator agent; and if an anomaly exists: generate at least one control command for at least one vehicle function.

[0007] The invention describes a large-language model-based multi-agent architecture that functions as a higher-level security instance in the vehicle. At least one, preferably several, specialized agent(s) can monitor at least one, preferably different, domain(s), e.g., drive, brakes, sensors, and / or communication, and report anomalies to a central safety and security orchestrator agent. This central agent uses a large language model (LLM) to interpret events contextually and to determine whether an anomaly exists, in particular a technical fault (functional anomaly), a potential cyberattack (IT anomaly), or a combined effect.

[0008] An agent is understood to be a program that can act independently and autonomously to a certain extent.

[0009] In some implementations, a combination of functional and IT security can be provided. This can be an architecture that combines ISO 26262 and ISO 21434 on a common decision logic.

[0010] Furthermore, in some implementation examples, LLM reasoning can be provided for safety contexts, whereby an understanding of complex error patterns can be carried out through language model-based logic interpretation.

[0011] In some implementation examples, an adaptive risk assessment can be performed, whereby a continuous evaluation of sensor, network and control unit states can be carried out during operation.

[0012] Furthermore, in some implementation examples, a cross-domain agent architecture can be provided, whereby an interaction of specialized agents (brake agent, sensor agent, comm agent, etc.) can take place under central coordination.

[0013] Furthermore, in some implementation examples, explainable decisions can be provided. This allows for a transparent justification for system reactions, e.g., "Brake assist deactivated due to sensor conflict between radar and camera".

[0014] In some implementation examples, a system architecture can be configured as follows: Domain-specific agents can monitor local signals, status messages, and / or communication channels. Furthermore, they can detect anomalies in real time and roughly classify them according to severity. The Safety & Security Orchestrator agent can aggregate all anomaly reports. It can then transmit structured data to the LLM for semantic evaluation. The LLM component can interpret unstructured log data, error codes, and network communication, and recognize patterns, correlations, and conflicts, such as discrepancies between sensor and vehicle dynamics data. Finally, the LLM can trigger appropriate countermeasures via standardized vehicle safety mechanisms.

[0015] In some implementations, communication and integration can involve networking the agents via a zonal E / E architecture of the vehicle. Furthermore, some implementations can utilize more secure communication protocols (TLS, Secure CAN, Automotive Ethernet).

[0016] Furthermore, in some implementation examples, edge inference for real-time decisions and / or cloud connectivity for model training and scenario learning may be provided.

[0017] In some embodiments, security mechanisms can be designed as fail-operational and / or fail-safe modes, whereby adaptive system degradation can be provided instead of a complete shutdown. Furthermore, in some embodiments, isolation of compromised domains can be provided, for example, by separating vulnerable communication paths using agent logic.

[0018] This enables holistic security through the combination of functional and cybersecurity within a single system. Furthermore, adaptive protective measures can be provided through a dynamic response to new error or attack patterns. Reduced misclassifications can also be achieved by differentiating between technical defects and attacks. As a result, increased vehicle availability can be ensured by preventing unnecessary safety shutdowns through precise root cause analysis. Explainable intelligence can also be provided, offering transparent feedback to developers and drivers. Finally, compliance with standards can be maintained through support for ISO 26262, ISO / SAE 21434, and UNECE R155 within an integrated framework.

[0019] Furthermore, in some embodiments, an explainable user interaction can be provided, whereby understandable system instructions can be displayed in the vehicle cockpit.

[0020] In one example scenario, a discrepancy between the radar sensor and the camera system can be detected. The LLM agent can interpret this discrepancy by considering weather data (fog) and communication logs. As a result, it can be classified as a functional sensor failure, not an attack, and the issued control command can trigger an adaptive adjustment of the security strategy.

[0021] The LLM performs semantic reasoning on diagnostic data, network communication, system protocols, and environmental conditions to determine cause, risk, and action required.

[0022] This provides an integrated security logic that combines both domains of "functional safety systems" and "cybersecurity." Furthermore, the invention provides a higher-level, intelligent system that interprets anomalies contextually, differentiates their causes, and derives appropriate countermeasures—both with regard to functional safety and cyber resilience. With this LLM-supported multi-agent approach, security-relevant events across all domains can be semantically analyzed, evaluated, and adaptive protective responses triggered.

[0023] According to some embodiments, it is conceivable that at least one control command can be designed as a shutdown command.

[0024] According to some embodiments, it is conceivable that a type of anomaly can be identified, in particular from the group: technical error and / or potential cyberattack, whereby at least one instruction of at least one control command can be generated based on the type of anomaly.

[0025] According to some embodiments, it is conceivable that the at least one vehicle function may have at least one drive function, at least one braking function, at least one sensor function and / or at least one communication function.

[0026] According to some embodiments, it is conceivable that a signal can be provided for display on a screen or for output via a loudspeaker, which can contain information about the provision of at least one control command and a justification as to why the control command can be used, in natural language.

[0027] According to a second aspect, a computer program product is described, comprising instructions that, when the program is executed by a computer, cause it to perform the steps of the procedure according to the preceding description.

[0028] The advantages, effects, and further developments of the computer program product result from the advantages, effects, and further developments of the method described above. Therefore, reference is made to the preceding description in this regard. A computer program product can be understood, for example, as a data carrier on which a computer program element is stored, containing instructions executable by a computer. Alternatively or additionally, a computer program product can also be understood, for example, as a permanent or volatile data storage medium, such as flash memory or main memory, that contains the computer program element. However, this does not exclude other types of data storage media that contain the computer program element.

[0029] According to a third aspect, a vehicle is described comprising at least one vehicle function, at least one domain agent for monitoring the at least one vehicle function, and at least one computer trained to perform the steps of the procedure according to the preceding description.

[0030] The advantages, effects, and further developments of the vehicle result from the advantages, effects, and further developments of the procedure described above. To avoid repetition, reference is therefore made to the preceding description in this regard.

[0031] The invention is described below with reference to an exemplary embodiment and the accompanying drawing. It shows: Fig. 1. A flowchart of the process.

[0032] The computer-implemented method for controlling a vehicle is according to Fig.1 shall hereinafter be referred to in its entirety by reference numeral 100

[0033] The computer-implemented method 100 is executed in connection with a vehicle, wherein the vehicle has at least one vehicle function and at least one domain agent for monitoring the at least one vehicle function. The at least one vehicle function may include at least one drive function, at least one braking function, at least one sensor function, at least one steering function, at least one driver assistance function, and / or at least one communication function.

[0034] If anomalous behavior in at least one vehicle function is detected by the at least one domain agent, step 102 can be performed, whereby at least one anomaly report is transmitted to at least one, in particular central, safety and security orchestrator agent that has a large language model. The at least one anomaly report can be created and transmitted by the at least one domain agent.

[0035] According to step 104, the at least one anomaly report, in the context of vehicle operating data, vehicle telemetry data, and / or data on the vehicle's external environmental conditions, can then be interpreted by the at least one safety and security orchestrator agent. Data on the vehicle's external environmental conditions can include, for example, weather data and / or road surface data. The vehicle operating data and / or vehicle telemetry data can include diagnostic data, network communication, and system logs.

[0036] According to step 106, at least one Safety and Security Orchestrator agent can be used to determine, based on interpretation, whether at least one anomaly exists. This allows for the identification of an anomaly type, particularly from the group consisting of technical errors and / or potential cyberattacks.

[0037] If an anomaly is detected, at least one control command for at least one vehicle function can be generated in step 108 using the at least one Safety and Security Orchestrator agent. This control command can, for example, be configured as a shutdown command for the at least one vehicle function. Control commands can only be issued for vehicle functions in which an anomaly has been detected. In particular, the at least one instruction of the control command can be generated based on the type of anomaly.

[0038] Furthermore, in an optional step 110, a signal can be provided for display on a screen or for output via a loudspeaker, which can contain information about the provision of at least one control command and a justification for why the control command is being used, in natural language.

[0039] The example described above does not in any way limit the invention. Rather, the invention can be modified in numerous ways. All features of the invention described above can be essential to the invention, either alone or in combination.

Claims

[1] Computer-implemented method (100) for controlling a vehicle, wherein the vehicle has at least one vehicle function and at least one domain agent for monitoring the at least one vehicle function, comprising at least the following steps: a. If anomalous behavior in the at least one vehicle function is detected by the at least one domain agent: Transmit (102) at least one anomaly report to at least one, in particular central, safety and security orchestrator agent having a large language model, by means of the at least one domain agent; b. Interpreting (104) the at least one anomaly report in the context of vehicle operating data, vehicle telemetry data and / or data on the vehicle's external environmental conditions, using the at least one Safety and Security Orchestrator agent; c. Decide (106) based on the interpretation of whether at least one anomaly exists, using the at least one Safety and Security Orchestrator agent; and d. If an anomaly is present: Generate (108) at least one control command for at least one vehicle function. [2] Computer-implemented method (100) according to claim 1, characterized by that at least one control command is configured as a shutdown command. [3] Computer-implemented method (100) according to claim 1 or 2, characterized by , that a type of anomaly is identified, in particular from the group: technical error and / or potential cyberattack, whereby at least one instruction of at least one control command is generated based on the type of anomaly. [4] Computer-implemented method (100) according to any one of the preceding claims, characterized bythat the vehicle has at least one drive function, at least one braking function, at least one sensor function, at least one steering function, at least one driver assistance function and / or at least one communication function. [5] Computer-implemented method (100) according to any one of the preceding claims, characterized by , that a signal is provided for display on a screen or for output by means of a loudspeaker (110) which contains information about the provision of at least one control command and a reason why the control command is being used, in natural language. [6] Computer program product comprising instructions which, when the program is executed by a computer, cause it to perform the steps of the method (100) according to any one of claims 1 to 5. [7] Vehicle comprising at least one vehicle function, at least one domain agent for monitoring the at least one vehicle function and at least one computer configured to perform the steps of the method (100) according to any one of claims 1 to 5.

Images