Method and device for controlling system requiring functional safety

Abstract

To provide a method, device, and system for controlling a system requiring functional safety.SOLUTION: A method includes: determining control of a system according to a first control method satisfying a first requirement related to the functional safety of the system; determining control of the system according to a second control method; determining a difference between the control of the system according to the first control method and the control of the system according to the second control method; and outputting a signal for controlling the system according to the first requirement related to the functional safety of the system on the basis of the determined difference.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a method and a device for controlling systems in which functional safety is required, in particular in the automotive, aircraft and / or aerospace industries. [Background technology]

[0002] When manufacturing, modifying and / or improving components of a system that has safety requirements, the system and its components must be developed in such a way that the functional safety requirements of the components and the system are met.

[0003] For example, if an indirect electromechanical braking system is used in a vehicle instead of a direct mechanical braking system, as shown by way of example in Figure 2, requirements may need to be met regarding the controllability of the vehicle when cornering, for example: yaw of the vehicle may be prevented, for example, so that no one is harmed by the vehicle.

[0004] For example, when using indirect autopilot for an aircraft, requirements may need to be met regarding the pilot's ability to correct the autopilot, so that if the indirect autopilot is accidentally activated and must be corrected, the pilot can take direct control of the aircraft to avoid damage.

[0005] Electromechanical devices are generally advantageous in that actuators, e.g., electric motors, are indirectly operated via electronic controls to control the system so that the system's functional safety requirements are met. The use of, e.g., multiple sensor data and / or complex algorithms to control the actuators can make the system's functional safety requirements difficult to achieve both from a technical standpoint due to expensive implementation and from a financial standpoint due to the high costs of development from the component level to the system level.

[0006] Conventional devices for controlling a system use redundant control methods and / or devices for controlling the system and a unit for monitoring an active control method and / or active device for controlling the system. The monitoring unit is configured to switch from the active control method and / or active device to the redundant control method and / or redundant device in response to determining whether one or more monitoring criteria are met or not. Both the active control method and / or active device and the redundant control method and / or redundant device must meet requirements related to the functional safety of the system.

[0007] Patent Document 1 discloses an electromechanical braking system for a vehicle, which has at least one friction brake device and an electromechanical actuator for operating the friction brake device, where the electromechanical brake device has a pneumatically releasable energy storage spring actuator, which may be arranged and / or provided to apply a force directly to the at least one friction brake element. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] German Patent Publication No. 102021121828 Summary of the Invention

[0009] The present invention provides a method and a device for controlling a system requiring functional safety, having the features set out in the independent claims.

[0010] Preferred embodiments are the subject of the respective dependent claims.

[0011] The disclosed method and apparatus for controlling a system allows for a simplified implementation of complex controls for the system, while the requirements regarding the functional safety of the system are always met.

[0012] According to a first aspect, the present invention relates to a method for controlling a system requiring functional safety, the method comprising: determining a control of the system according to a first control method that satisfies a first requirement regarding the functional safety of the system; determining a control of the system according to a second control method; determining a difference between the control of the system according to the first control method and the control of the system according to the second control method; and outputting a signal for controlling the system according to the first requirement regarding the functional safety of the system based on the determined difference.

[0013] According to one embodiment, the method further includes determining whether the difference is within a first tolerance range around control of the system according to a first control method; and if the difference is determined to be within the first tolerance range, outputting a signal for controlling the system in response to the determination, which follows control of the system according to a second control method.

[0014] According to one embodiment, the method further includes, when the difference is determined to be outside a first tolerance range, outputting a signal for controlling the system in response to the determination, followed by controlling the system according to a first control method.

[0015] According to one embodiment, the method further includes, when the difference is determined to be outside the first tolerance range, outputting, in response to the determination, a signal for controlling the system to determine whether the difference is within a second tolerance range around control of the system according to the first control strategy, followed by control of the system according to a third control strategy that satisfies a second requirement regarding functional safety of the system.

[0016] According to one embodiment, a decision to control the system according to a first control method and a decision to control the system according to a second control method are made simultaneously and / or consecutively and / or in parallel and / or alternately in sequence.

[0017] According to one embodiment, the first control method is selected depending on the operating mode of the system and / or depending on the preferences of a user of the system.

[0018] According to one embodiment, a first control method is selected from a plurality of first control methods, where each of the plurality of first control methods satisfies a first requirement regarding functional safety.

[0019] According to a second aspect, the present invention relates to an apparatus for controlling a system requiring functional safety, the apparatus having one or more processors and a computer-readable non-volatile storage medium having stored thereon instructions that, when executed by the processor or processors, cause the apparatus to control the system according to any of the methods described above.

[0020] According to one embodiment, the device further comprises at least one electromechanical control device, the electromechanical control device not allowing direct mechanical control.

[0021] According to a third aspect, the invention relates to a system, which comprises at least one of the devices described above. [Brief explanation of the drawings]

[0022] [Figure 1] 1 is a schematic diagram of an embodiment of an apparatus for controlling a system with high demands on functional safety; [Figure 2] 2 is a schematic diagram of an embodiment of an electromechanical braking device to be controlled by an embodiment of an apparatus for controlling the system shown in FIG. 1; [Figure 3] 3 is a schematic diagram of a vehicle having an electromechanical braking device according to an embodiment shown in FIG. 2 controlled by an apparatus according to an embodiment for controlling the system shown in FIG. 1; [Figure 4] 1 is a schematic diagram of control signals for controlling a system according to a conventional method (top) and a schematic diagram of control signals for controlling a system according to a method according to one embodiment of the present invention (bottom). [Figure 5] 1 is a schematic diagram of a method for controlling a system with high demands on functional safety; DETAILED DESCRIPTION OF THE INVENTION

[0023] In all figures, identical or functionally identical components and devices are labeled with the same reference numerals. The numbering of method steps serves for clarity but generally does not imply a specific temporal sequence. In particular, several method steps may be performed simultaneously.

[0024] 1 shows a schematic diagram of an embodiment of an apparatus 1200 for controlling a system 1000 with high demands regarding functional safety. The system 1000 or a vehicle or aircraft comprises a component 1300 that is critical for the functional safety of the system 1000. The system 1000 comprises an apparatus 1100 and may further comprise a sensor system 1100.

[0025] The sensor system 1100 may include one sensor or multiple sensors 1100. The sensors may be, for example, force sensors, position sensors, current sensors, sensors providing data on the rotational speed of one or more wheels of the system 1000, acceleration sensors, air speed sensors, tilt angle sensors, position sensors, gyroscopes, sensors for receiving radio net and / or satellite data, and / or any other sensor providing data important for the functional safety of the system 1000. The sensor system 1100 may include a combination of two or more of each of the above sensors.

[0026] The device 1200 for controlling the system 1000 is configured to control the component 1300 according to a first control method 1210. The first control method 1210, the so-called "direct law," satisfies the functional safety requirements of the system 1000. The first control method 1210 can, for example, satisfy the requirements according to ASIL D, i.e., "Automotive Safety Integrity Level D." ASIL D is associated with the highest classification of incipient hazard (risk of injury) specified in ISO standard 26262 and is associated with an extremely strict level of safety measures applied in accordance with this standard to avoid the remaining risk. Alternatively, if the system 1000 is classified as safety-critical according to the hazard class "catastrophic," the "direct law" method may be developed in the aircraft industry according to DAL A, i.e., according to the requirements of "Design Assurance Level A."

[0027] The first control method 1210 can receive data from the minimum required number of sensors needed to control the system 1000 such that functional safety requirements are met, for example according to ASIL D. The apparatus 1200 can also be configured to control the system 1000 such that lower functional safety requirements are imposed on the system 1000, such as ASIL C, ASIL B, ASIL A, or Requirement Quality Management (QR). This can be achieved, for example, by the first control method 1210 avoiding operating states of the system 1000 “a priori” that would impose higher requirements on the functional safety of the system 1000, such as vehicle yaw when cornering at high speed.

[0028] The first control method 1210 may be based on data from, for example, a single sensor, up to two sensors, or up to three sensors, and therefore the costs of proving and / or implementing that functional safety requirements are met may be reduced compared to complex control methods.

[0029] The device 1200 for controlling the system 1000 is further configured to control the component 1300 according to a second control method 1220. The second control method 1220, the so-called "normal law," does not necessarily have to meet the functional safety requirements of the system 1000. The second control method 1220 may not meet these requirements at all or may only partially meet them. For example, the second control method 1220 may meet requirements according to QM, ASIL A, ASIL B, or ASIL C.

[0030] The second control method 1220 can receive data from any number of sensors and / or models to control the system 1000. The second control method 1220 can be based on data from at least one sensor, at least two sensors, or at least three sensors. The number of sensors used to control the system 1000 according to the second control method 1220 can be greater than the number of sensors used to control the system 1000 according to the first control method 1210, among other things.

[0031] The second control method 1220 may in particular be more complex than the first control method 1210. For example, the second control method 1220 may take into account wear, e.g., of the motor, spindle, or other components as shown in FIG. 2 , when controlling the system 1000, e.g., by sensor data or based on one or more models. In particular, the second control method 1220 may take into account external disturbance factors, e.g., wind force. In particular, the second control method 1220 may use artificial intelligence to improve the control method 1220 during operation, e.g., to continuously adapt it to the user of the system 1000 or to the system 1000 itself.

[0032] 2 shows a schematic diagram of an embodiment of a system component, e.g., an electromechanical braking device 2300, which can be controlled by a device for controlling the system. The electromechanical braking device 2300 shows a brake disc with brake lining 2340, a spindle 2330, a transmission 2320, and an electric motor 2310. The electromechanical braking device 2300 is designed for indirect actuation of the braking device, and a purely mechanical, e.g., hydraulic, actuation of the brake is not possible.

[0033] FIG. 3 shows a schematic diagram of a vehicle 3000 having an embodiment of an electromechanical braking device 3300 controlled by an embodiment of an apparatus 3200 for controlling a system 3000 .

[0034] The vehicle 3000 has, for example, four electromechanical braking devices 3300. Each electromechanical braking device 3300 may have one or more devices 3200 for controlling the system 3000 to control the system 3000. The system 3000 may be steered by a steering 3400. The steering 3400 may be directly or indirectly coupled to one or more devices 3200 for controlling the system 3000.

[0035] FIG. 4 shows a schematic diagram of a control signal s(t) for controlling a system according to a conventional method 4100 (top) and a schematic diagram of a control signal s(t) for controlling a system according to a method 4200 (bottom) according to one embodiment of the present invention.

[0036] According to conventional method 4100, a control signal s(t) for controlling a system or component is controlled according to an active control method 4110, where the active control method 4110 and / or the system and / or component are monitored by this control signal s(t). The active control method 4110 meets the functional safety requirements of the system, for example, ASIL D. In response to determining whether one or more monitoring criteria are met or not met, at time 4115 in FIG. 4 , conventional method 4100 switches from active control method 4110 to redundant control method 4120 and outputs control signal s(t) based on redundant control method 4120. In this case, redundant control method 4120 indicates degradation, i.e., a degradation in system operation.

[0037] The determination of whether one or more monitoring criteria are met or not met is made, for example based on sensor data, using a switch to switch between devices in which the active control method 4110 or the redundant control method 4120 is implemented.

[0038] According to method 4200 in accordance with one embodiment of the present invention, a control signal s(t) for controlling a system or a component is always output as a result of at least two possible control strategies that can be provided in parallel in time to control the system. In this case, the functional safety requirements of the system and / or the system component are not or not necessarily met by all of the at least two possible control strategies. However, at least one of the at least two possible control strategies satisfies the functional safety requirements of the system and / or the system component.

[0039] 4, the method of the present invention can output a control signal s(t) that follows control according to a second control method 4220 while the control signal s(t) is within a tolerance range around the control signal according to a first control method 4210. Because the first control method 4210 satisfies the functional safety requirements of the system and / or system components within the tolerance range, the second control method 4220 does not necessarily have to satisfy the functional safety requirements as long as the control signal s(t) output to the system is within a tolerance range around the control signal according to the first control method 4210. In other words, the functional safety requirements of the system are satisfied while the requirements on the execution of the second control method 4220 are relaxed.

[0040] When the control signal s(t) deviates from the tolerance range, for example as shown by reference numeral 4215, the control signal s(t) generally follows control according to the first control method 4210, possibly smoothed within a transition range. When control according to the second control method 4220 is resumed, the output control signal s(t) can again follow control according to the second control method 4220.

[0041] The control may further be carried out in various ways depending on the driving state, for example, based on the control method when driving straight or when driving in a curve.

[0042] When a switch is made from one control method to another, for example from the first control method 4210 to the second control method 4220 and / or vice versa, the switch may be logged, for example for retrieval at a service workshop and / or for wireless and / or wired transmission of associated data directly to the device and / or component manufacturer.

[0043] A number of tolerance ranges may be used to output the signal s(t), for example depending on the driving conditions and / or depending on the available control methods, which may meet the same or different requirements regarding the functional safety of the system.

[0044] The output of the signal s(t) can be performed in such a way that exceeding the tolerance ranges for a short time, for example for 1, 2, 5, or 10 seconds, is permitted. Optionally, to meet the requirements for the functional safety of the system, exceeding a first tolerance range for a short time may be permitted, whereas exceeding a second tolerance range may not be permitted. The output of the signal s(t) can be performed in particular in such a way that the output signal is always within the tolerance range of the control method that meets the highest requirements for the functional safety of the system. If multiple control methods meet the highest requirements, the output of the signal s(t) can be subject to control according to a control method selected, for example, by a user.

[0045] 5 shows a schematic diagram of a method 5000 for controlling a system with high requirements regarding functional safety. The method includes determining 5100 a control of the system according to a first control method that satisfies a first requirement regarding the functional safety of the system; determining 5200 a control of the system according to a second control method; determining 5300 a difference between the control of the system according to the first control method and the control of the system according to the second control method; and outputting 5400 a signal for controlling the system according to the requirements of the functional safety of the system based on the predetermined difference.

[0046] It is noted that various standards generally referenced herein may be relevant in various industries, countries, and fields without specific identification of each relevant standard, and the principles of the apparatus and methods disclosed herein may be modified with respect to each of these standards. [Explanation of symbols]

[0047] 1000 systems 1100 Devices, sensors, and sensor systems 1200 Device for controlling the system 1000 1210 First Control Method 1220 Second Control Method 1300 components 2300 Electromechanical braking devices 2310 Electric motor 2320 Transmission equipment 2330 Spindle 2340 Brake lining 3000 vehicles and systems 3200 Device for controlling system 3000 3300 Electromechanical brake device 3400 steering 4100 Conventional Method 4110 Active Control Methods As of 4115 4120 Redundancy Control Method 4200 A method according to one embodiment of the present invention 4210 First Control Method 4215 code 4220 Second Control Method 5000 Method for controlling a system with high requirements regarding functional safety 5100 Determining the control of a system according to a primary control method that satisfies the primary requirement for the functional safety of the system 5200 Determining the control of a system according to a second control method 5300 Determining the difference between control of the system according to a first control method and control of the system according to a second control method 5400 Output of signals for the control of systems according to the requirements of the functional safety of the system based on a predetermined difference Output of signals for controlling the 5500 system s(t) control signal

Claims

1. A method (5000) for controlling a system (1000; 3000) requiring functional safety, comprising: The method (5000) determining (5100) a control of the system (1000; 3000) according to a first control method (1210; 4210) that satisfies a first requirement regarding the functional safety of the system (1000; 3000); determining (5200) the control of said system (1000; 3000) according to a second control method (1220; 4220); determining (5300) a difference between the control of the system according to the first control method (1210; 4210) and the control of the system according to the second control method (1220; 4220); outputting (5500) a signal for controlling said system (1000; 3000) according to said first requirement regarding the functional safety of said system (1000; 3000) based on said determined difference, A method (5000) for controlling a system (1000; 3000) requiring functional safety, comprising:

2. The method (5000) further comprises: determining (5400) whether said difference is within a first tolerance range around control of said system (1000; 3000) according to said first control method (1210; 4210); if the difference is determined to be within the first tolerance range, outputting (5500) a signal for controlling the system (1000; 3000) in response to that determination, followed by controlling the system (1000; 3000) in accordance with the second control method (1220; 4220); The method (5000) of claim 1, comprising:

3. The method (5000) further comprises: if the difference is determined to be outside the first tolerance range, outputting (5500) a signal for controlling the system (1000; 3000) in response to said determination, followed by controlling the system (1000; 3000) in accordance with said first control method (1210; 4210); The method (5000) of claim 2, comprising:

4. The method further comprises: if the difference is determined to be outside the first tolerance range, then in response to that determination, determining whether the difference is within a second tolerance range around control of the system (1000; 3000) according to the first control method (1210; 4210); outputting (5500) a signal for controlling the system (1000; 3000) following a control of the system (1000; 3000) according to a third control method that satisfies a second requirement regarding the functional safety of the system (1000; 3000); The method (5000) of claim 2, comprising:

5. A method (5000) according to any one of claims 1 to 4, wherein the determination (5100) of the control of the system (1000; 3000) according to the first control method (1210; 4210) and the determination (5200) of the control of the system (1000; 3000) according to the second control method (1220; 4220) are performed simultaneously and / or consecutively and / or in parallel and / or sequentially.

6. A method (5000) according to any one of claims 1 to 5, wherein the first control method (1210; 4210) is selected depending on the operating mode of the system (1000; 3000) and / or depending on the selection of a user of the system (1000; 3000).

7. A method (5000) according to any one of claims 1 to 6, wherein the first control method (1210:4210) is selected from a plurality of first control methods, wherein each of the plurality of first control methods satisfies the first requirement regarding functional safety.

8. In an apparatus (1200; 3200) for controlling a system (1000; 3000) requiring functional safety, The device (1200; 3200) having one or more processors, a computer-readable non-volatile storage medium having stored thereon instructions that, when executed by the processor(s), cause the device (1200; 3200) to control the system (1000; 3000) according to a method as claimed in any one of claims 1 to 7; A device (1200; 3200) for controlling a system (1000; 3000) in which functional safety is required.

9. 10. The device (1200; 3200) of claim 8, further comprising at least one electromechanical control device, the electromechanical control device disallowing direct mechanical control.

10. A system (1000; 3000), said system (1000; 3000) comprising at least one device according to any one of claims 8 or 9.

Images