Monitored machine learning of a computer-implemented method for carrying out a technical process

Abstract

The invention relates to monitored machine learning of a method for carrying out a technical process (TPR), in which output data containing data sets (x; y) with input data and describing a correct process result are created in a data pool (DP), the method is trained in a training phase (TP), wherein procedure parameters of the method are varied when repetitions of the method are carried out, in a validation phase (VP) the trained method is checked in that the output data calculated with the input data by means of the trained method are compared with the output data describing the correct process result and as a result of said comparison, an actual probability of failure (Ptrue) is calculated for the method. It is proposed that all data sets (x,- y) in the data pool (DP) are provided as both training data sets (TD) and validation data sets (VD), for the training phase (TP) an empirical probability of failure (Pemp) is defined which is at most as high as a predefined target probability of failure (PFD), the validation phase (VP) is initiated after it has been ascertained, in the training phase (TP), that the empirical probability of failure (Pemp) has not been exceeded. It is furthermore proposed that a statistical significance (α) of the result of the validation phase (VP) is taken into consideration in that, in the validation phase (VP), for comparison with the actual probability of failure (Ptrue) a corrected probability of failure (Pval) is defined which is lower than the predefined target probability of failure (PFD).

Description

[0001] 2022P13562WO Clean copy 1 Description A supervised machine learning of a computer-implemented method for carrying out a technical process. The present invention relates to a method for supervised machine learning of a computer-implemented method for carrying out a technical process, as well as to a technical system for carrying out a technical process. Furthermore, the invention relates to a computer program and a computer-readable storage medium, both of which have a program for carrying out said supervised machine learning. Machine learning methods for training algorithms based on artificial intelligence are currently the focus of research. Machine learning successively improves the success rate when applying the algorithm in question.The success rate can be represented statistically, for example. Artificial intelligence (hereinafter also abbreviated to AI), also referred to as artificial intelligence, is understood in the context of this invention in the narrower sense as the capability of computer-aided machine learning, also referred to as machine learning (hereinafter also abbreviated to ML). This involves the statistical learning of the parameterization of algorithms, preferably for very complex applications. Using ML, the system recognizes and learns patterns and regularities in the recorded process data based on previously input learning data. With the help of suitable algorithms, ML can independently find solutions to emerging problems. ML is divided into three fields: supervised learning, unsupervised learning, and reinforcement learning, with more specific applications, for example, regression and classification.Structure recognition and prediction, data generation (sampling), or autonomous action. In supervised learning, the system is trained by the correlation of input and corresponding output of known data and thus learns approximate functional relationships. The availability of suitable and sufficient data is crucial, because if the system is trained with unsuitable (e.g., non-representative) data, it learns incorrect functional relationships. It learns how to form and expand data groups, what is typical for the respective application, and where deviations or anomalies occur. This allows use cases to be described and error states to be discovered. In reinforcement learning, the system learns through trial and error.by proposing solutions to given problems and receiving a positive or negative evaluation of this suggestion via a feedback function. Depending on the reward mechanism, the AI ​​system learns to execute corresponding functions. The construction of a function f based on (x1, y1), ..., (xn, yn)—for the sake of clarity, the example of value pairs in a two-dimensional space is shown here, but the invention is not limited to this—is referred to as statistical learning. The variable x denotes the input values, and the variable y the output values ​​of the function f. This statistical learning is the basis of machine learning. The known prior art, DE 102021 200 803 A1, from which the invention is based, relates to supervised machine learning. It is envisaged that the learning phase also includes a training step based on simulated measurement data.which have been generated by simulation based on a simulation model of the technical device, and / or real measurement data generated by one or more real measurement data sources of the technical device, and a validation step that checks the quality of the training phase. The problem with the prior art is that safety-relevant applications must meet special requirements for approval. Predefined safety standards must be achieved, but it has not yet been possible to provide a suitable safety proof for an algorithm trained by machine learning that uses artificial intelligence so that it can optimize the safety-relevant application during operation. The object of the present invention is therefore to improve supervised machine learning in such a way thatthat a training phase of machine learning can be completed as reliably as possible so that subsequent validation of the method will be successful with the highest possible probability. In particular, the object of the invention is to ensure that validation of the result of supervised machine learning corresponds to the highest possible probability of correctness and can thus also be used for safety-relevant technical processes, especially during ongoing operation. Furthermore, the object of the invention is to provide a technical system that is accessible to machine learning, especially when it must be operated with high safety requirements. Finally, the object of the invention is to provide a computer program and a computer-readable storage medium,with which supervised machine learning can be carried out. To achieve this object, the invention proposes a method for supervised machine learning (hereinafter referred to as supervised machine learning) according to claim 1. 2022P13562WO Fair copy 4 Accordingly, supervised machine learning of a computer-implemented method for carrying out a technical process is proposed, in which the following steps are carried out: a data pool containing data sets with input data for the process and output data associated with the input data describing a correct process result is created, the computer-implemented method is trained using the data sets as training data sets in a training phase, wherein process parameters of the computer-implemented method are varied during repeated process executions,In a validation phase, the trained computer-implemented method is verified using the data sets as validation data sets. The output data calculated using the trained computer-implemented method with the input data is compared with the output data describing the correct process result. As a result of the comparison, an actual failure probability for the computer-implemented method is calculated. It should be noted that the process result described by the output data was generated by the input data to which the process result is assigned. In other words, the process result in the form of the output data is already known in the data pool for all input data. This makes the implementation of supervised machine learning possible, since supervision consists in verifyingwhether the output data describe the correct (known) process result. According to the invention, the mathematical principles of statistical learning theory are applied here. In order for the output data describing the correct process result, which is available in the data pool (hereinafter referred to as "correct output data"), and the calculated output data to be considered equal, they do not necessarily have to be identical. For example, a tolerance range can be defined for the output data, which, for example, takes into account or allows for a certain degree of inaccuracy of the computer-implemented process. As long as the determined output data lie within such a tolerance range, they can be considered consistent with the output data describing the correct process result. The situation is different, for example, for technical processes,address the classification problems. If the output data describes a specific class, for example, of obstacles, then the class described by the calculated output data must exactly match the class identified by the correct output data. Otherwise, a misclassification occurs. In these simple cases, the probability of misclassification corresponds to the safety risk to be assessed in the classification problem. The prerequisite for implementing the method according to the invention isthat the data in the data pool is sufficiently representative. This can be ensured, for example, by randomly selecting the data sets for the group of training data sets and for the group of validation data sets. The data sets in the data pool can be obtained from a data collection, for example, through measurements in a real process or by simulating this real process. The simulation of the real process can be carried out using known simulation methods. However, this is not the training phase in which the computer-implemented process is trained. While the computer-implemented 2022P13562WO Reinschrift 6 process can be varied during the training phase in order to optimize the implementation of the associated technical process as much as possible, the process may no longer be changed during the validation phase. The training phase serves to optimize the process,while the validation phase serves to determine the reliability of the optimized process. To vary the process, process parameters can be changed, for example. This preferably occurs between individual process executions so that the results of the process executions can be assessed in the form of the calculated output data with regard to the optimization progress. In particular, the calculated output data can be compared with the output data describing the correct process result, whereby the latter output data is present in the data sets. A process execution is therefore to be understood as a part of the process flow that can be delimited within the process in such a way that this part enables an evaluation of the optimization progress. In particular, a respective process execution is characterized bythat input data from a data set is processed within the process execution, and calculated output data is generated within the process execution. The reliability of the system is assessed based on the failure probability of the process with regard to correctly generated output data. The failure probability must in any case be below a target failure probability.so that the validation of the procedure can be assessed as successful in the validation phase (more on the application of a more stringent criterion in the form of a corrected failure probability later). In safety engineering, the target failure probability is also referred to as the safety target or target failure measure. A failure occurs, for example, in the case of misclassification or a deviation of the calculated output data from the correct output data beyond the permissible tolerances. For safety-relevant processes, it is essential that a specified target failure probability is not exceeded during their use in order to exclude hazards. For this purpose, for example, a probability of a dangerous failure is determined when the output data of the procedure required for the safety-relevant process is requested.considered (in English: probability of dangerous failure on demand, PFD for short). According to the international standard IEC 61508, or specifically for the railway sector according to the European standard EN 50129, four safety integrity levels (SIL) are distinguished for technical processes executing safety functions. Safety integrity level 4 represents the highest level of safety integrity, and safety integrity level 1 the lowest. The respective safety integrity level influences the confidence interval of a measured value in such a way that the higher the safety integrity level, the smaller the confidence interval.which must be fulfilled by the respective device. The safety dimension of the various safety integrity levels can be clearly described by the expected frequency of failure of the safety-relevant system MTBF (Mean Time Between Failures). For SIL-1, this is in the range of 10 ... 100 a, for SIL-2 in the range of 100 ... 1000 a, for SIL-3 in the range of 1000 ... 10000 a, and for SIL-4 in the range of 10000 ... 100000 a. If the actual failure probability is higher than the target failure probability, then the result of the validation 2022P13562WO Clean Copy 8 is that the trained procedure does not meet the reliability requirements of the process to be performed. The trained procedure can therefore be blocked for use. Furthermore, a new training phase can be initiated. If the actual failure probability is at most as high as the target failure probability,then the validation was successful. The trained method can thus be released for use. A device is computer-supported or computer-implemented if it has at least one computer or processor, or a method if at least one computer or processor executes at least one method step of the method. A computing environment is an IT infrastructure consisting of components such as computers, storage units, programs, and data to be processed with the programs, which are used to execute at least one application that has to perform a task. The IT infrastructure can also consist of a network of the aforementioned components. Computing instances (or instances for short) form functional units within a computing environment.which can be assigned to applications (given, for example, by a number of program modules) and can execute them. These functional units form self-contained systems, physically (e.g., computer, processor) and / or virtually (e.g., program module), when the application is executed. Computers are electronic devices with data processing capabilities. Computers can, for example, be clients, servers, handheld computers, communication devices, and other electronic devices for data processing, which can have processors and memory units 2022P13562WO Reinschrift 9 and can also be connected to a network via interfaces. Processors can, for example, be converters, sensors for generating measurement signals, or electronic circuits. A processor can be a central processing unit (CPU), a microprocessor, a microcontroller,or a digital signal processor, possibly in combination with a memory unit for storing program instructions and data. A processor can also be understood as a virtualized processor or a soft CPU. Memory units can be implemented as computer-readable memory in the form of a random-access memory (RAM) or data storage (hard disk or data carrier). Program modules are individual software functional units that enable a program sequence of method steps according to the invention. These software functional units can be implemented in a single computer program or in several computer programs that communicate with each other. The interfaces implemented here can be implemented in software within a single processor or in hardware if multiple processors are used. Interfaces can be implemented in hardware,for example, by cable or radio connection, or by software, for example, as interaction between individual program modules of one or more computer programs. Unless otherwise stated in the following description, the terms "create," "determine," "calculate," "generate," "configure," "modify," and the like preferably refer to processes that generate and / or modify data and / or convert the data into other data. The data is present, in particular, as physical quantities, for example, as electrical impulses or analog electrical quantities. The necessary instructions are summarized in a computer program as software. Furthermore, the terms "send," "receive," "read in," "read out," "transmit," and the like refer to the interaction of individual hardware components, in particular processors, and / or software components.especially program modules via interfaces. It is now essential that all datasets in the data pool are made available both as training datasets and as validation datasets, that an empirical failure probability is set for the training phase that is lower than a specified target failure probability, and that the validation phase is initiated after it has been determined in the training phase that the empirical failure probability is not exceeded. The fact that the datasets in the data pool can be used as training datasets and / or as validation datasets means thatthat all data sets are available both as training data sets for the training phase and as validation data sets for the validation phase (but do not necessarily have to be used for both training and validation – but are advantageously used). The training data sets and the validation data sets are therefore always the data sets from the data pool. The conceptual distinction is chosen in the context of the description of this invention only becauseso that the intended purpose of using the data sets is better expressed - in other words: The same data sets can be used consecutively both as training data sets for training during machine learning and as validation data sets for validating the result achieved by machine learning. The above-mentioned reusability of the data sets for both training and validation has the advantage that, with the given number of data sets, the result of the technical process to be optimized can be optimized as much as possible and subsequently validated as reliably as possible. In particular, when, as in railway applications, comparatively few data sets are available for training and validation, this results in the following with respect to known methods:where the data sets are used exclusively either for training or validation, advantageously a better training result (with regard to the optimum) and a reliable validation result. The method for supervised machine learning also utilizes fundamental principles that apply to statistical learning. Since the actual failure probability of the method to be trained is not yet known after the training phase, there is uncertainty as to whether this actual failure probability will exceed the specified target failure probability and thus the validation will fail. The actual failure probability is only determined in the validation phase. However, the chances of success for supervised machine learning improve if a lower value is set for the empirical failure probability.than specified by the target failure probability. A safety buffer, so to speak, is created that comes into effect when the actual failure probability determined in the validation phase exceeds the empirical failure probability, because for successful validation, only the condition that the higher target failure probability is undercut must be met. One embodiment of the invention relates to supervised machine learning, wherein, during a training phase, a beta distribution B(p,q) is defined for a probability density of the failure probability by specifying a first parameter p and a second parameter q for the beta distribution, and the training phase is initiated, the probability density is checked at intervals,where a sample size n is taken into account for the number of procedure executions and a success number m is taken into account for the number of successfully carried out procedure executions (both within a training phase), a modified beta distribution B(pmod,qmod) is estimated, a P-quantile is determined for the modified beta distribution, where for the determination a required probability (PQ) that a value of the modified beta distribution lies to the left of the P-quantile is equated with the empirical failure probability and in the event that the P-quantile is greater than the empirical failure probability, the training phase is continued with step a) of this claim, where for the beta distribution (B) the first parameter p and the second parameter q of the modified beta distribution are used, and in the event that the P-quantile is less than or equal to the empirical failure probability (P, emp), the training phase is terminated. The procedure carried out according to this embodiment of the invention is based on the statistical approach of Bayes. The probability density results from the probability distribution, i.e. from the curve of the beta distribution between zero and one, whereby the curve reflects the probability distribution. 2022P13562WO Fair Copy 13 The aim of the Bayesian procedure within the scope of this invention is to increase the probability density in a first range defined by the range from zero up to the empirical failure probability and to decrease it accordingly in a second range above the empirical failure probability up to one.The machine learning process during the training phase can be considered complete when the probability density in the first region is so high that the process can be carried out with a failure probability below the empirical failure probability. The described goal will normally not be achieved with a single execution of the training phase with the beta distribution determined in the first step. This is because the beta distribution, which achieves the goal in the present optimization problem, is usually unknown at the beginning of the training phase and is therefore usually set to default values, e.g., uniformly to 1. This makes training the process using multiple training phases necessary in the first place. To monitor the training, iterative statistical evaluation according to the Bayesian approach is carried out.The run count D refers to the number of training phases performed. The sample size n in a training phase corresponds to the number of training data sets used. The success count m is the number of process executions successfully performed in a training phase. For the purposes of the invention, successfully performed process executions are those process executions in which the process did not fail (the ratio between unsuccessful process executions and the total number of process executions performed thus determines the failure probability). 2022P13562WO Clean Copy 14 In the previous step, Bayes' theorem is applied to the beta distribution to calculate the modified beta distribution.While the beta distribution used in the training phase is also called the prior beta distribution, the modified beta distribution is also called the posterior beta distribution. In other words, this means that the posterior beta distribution is defined as the prior beta distribution in a subsequent recursive iteration step in the training phase (if necessary). If the training phase can be terminated, the validation phase is subsequently initiated after it has been determined in the training phase that the empirical failure probability is not exceeded. One embodiment of the invention relates to supervised machine learning, wherein the first parameter p and the second parameter q are specified as 1 during the first run through a training phase of step a) of claim 2.As already mentioned, the beta distribution for the desired reliability of the process (in this context, reliability means the probability of success with a sufficiently low probability of failure) is usually unknown at the beginning of the training phase. However, expert estimates for p and q can be included here. If there is no prior knowledge that suggests a specific beta distribution for starting the training process, the beta distribution B(1,1) can be used in any case. In principle, however, the closer the beta distribution used at the start of the training phase is to the beta distribution describing the optimum to be found, the faster a training phase can be completed.2022P13562WO Fair copy 15 One embodiment of the invention relates to supervised machine learning, wherein the output data calculated so far in the training phase (TP) with the input data in the process executions are compared with the output data describing the correct process result, the result of the comparison being used as the current failure probability (P. cur ) is calculated for the computer-implemented method, the probability density is checked in step b) of claim 2 by using the sample size n and the success number m to calculate a probability function L for the current failure probability (P cur ) is formed to L(P cur ) = P cur m (1-P cur ) n-m. Applying Bayes' theorem to the probability function L means that the modified beta distribution B(pmod,qmod) can be understood as the distribution for the successful implementation of the technical process. The modified beta distribution for the failure probability of the technical process is therefore B(pmod,qmod). It should be noted that this is an as yet unknown failure probability, which should, however, be tied to its associated quantile (more on this below). The advantage of repeatedly checking compliance with the empirical failure probability (this is met if the calculated current failure probability is lower than the empirical failure probability) is that the monitoring of the training phase can be carried out alongside training.As soon as the repeated test meets certain predefined termination criteria for the training phase, it can be terminated. This may mean that not all training datasets have been used yet (potentially, all datasets are available for training). On the other hand, this may also mean that all training datasets have already been used once and that training continues by repeatedly using the available training datasets. Additionally, the condition can be set that if a termination criterion for the training phase has been met but not all (training) datasets have been used at least once, training continues until all datasets in the data pool have been used as training datasets.This will normally (but not necessarily) lead to a further improvement in the performance of the computer-implemented method and the technical process associated with it. By repeatedly running through observation intervals, a trend can advantageously be identified, which allows for targeted optimization during the training phase and will ultimately lead to success. With regard to the training phase, success lies in the initiation of the validation phase as mentioned above. For example, the P quantile can be specified for n+p = 1. n+p = 1 applies if no error occurred in the training phase, but did occur in the validation phase, or vice versa, if an error occurred in the validation phase but not in the training phase. In this case, the P quantile can be specified as follows: Q = ି. ln^^ି^^ ^ ି^ା^For all n+p > 1, the P-quantile can be determined numerically in a conventional manner. The goal, of course, must be that Q < PFD. To ensure that this statement can be made with sufficient statistical reliability, the empirical 2022P13562WO Reinschrift 17 failure probability is used in the training phase, as already explained, rather than the target failure probability, so that the relationship results in Q < P emp. It is preferably proposed that a safety factor related to the target failure probability be specified, with which the empirical failure probability is calculated, whereby the empirical failure probability is reduced by a confidence level compared to the target failure probability. Taking the safety factor into account must ensure that the empirical failure probability is lower than the target failure probability. The safety factor is therefore to be set as less than 1 when multiplied by the target failure probability. If a number greater than 1 is defined as the safety factor, this describes the (multiple) certainty that the empirical failure probability is greater than the target failure probability. The target failure probability must therefore be divided by the safety factor greater than 1.Specifying a safety factor advantageously makes it possible to obtain a measure of the improvement in the chances of success of machine learning in order to better assess this reliability. According to the invention, this creates a confidence factor that takes into account an uncertainty regarding the achievement of the desired result of the training phase. This uncertainty consists in the fact that the actual probability of failure determined at the end of the validation phase is higher than the empirical probability of failure achieved by training, which cannot yet be determined with high reliability in the training phase. 2022P13562WO Clean copy 18 It should be noted that it is sometimes difficult to provide a large number of data sets for use as training data sets and / or validation data sets. With very large numbers of data sets, the chances of success also increase.However, if fewer data sets are available, the chances of success can be improved with the safety factor, especially in this case (although, of course, the chances of success for the training phase are also improved with a large number of data sets). Training is carried out by a machine learning algorithm that can be described by a function f. This must be feasible empirically, i.e. during training, with a lower empirical failure probability than the required failure probability, taking into account the safety factor, so that the machine learning can be completed successfully with a very high probability. Preferably, it is proposed that the safety factor be set to at least 1 / 3 and at most 2 / 3, preferably 1 / 2.In the case of a safety factor of 1 / 2, for example, half the required failure probability PFD / 2 can be used de facto. The confidence factor in this case is also PFD / 2. In other words, according to the invention, a safety factor is taken into account, which ultimately generates a confidence factor that is taken into account when determining the empirical failure probability, with the sum of the safety factor and the confidence factor being exactly 1. This naturally also applies to other safety factors, for example, from 1 / 3 up to and including 2 / 3. Using the safety factor advantageously results in a very simple method for safeguarding the training phase 2022P13562WO Fair Copy 19 with regard to the reliability of the achieved training result, especially with a small number of data sets.According to the invention, the relationships described below are taken into account. It is assumed that the data sets are sufficiently representative for machine learning. This must be the case regardless of whether they originate from the actual implementation of the technical process or the simulation of the technical process. For both the training phase and the validation phase, the data sets are preferably randomly distributed. During the training phase, as already explained, an empirical failure probability is determined that depends on the actual failure probability, which is unknown. This dependency is preferably given by the following failure probability function, which results from taking statistical learning theory into account. ^^ ^| ^^ ^^ ^^ ^^ − ^^ ^^ ^^ ^^ | > ^^ ^ < ^^ (1)with P misclassification probability for a successful training P emp empirical failure probability P trueActual failure probability (unknown) of the trained procedure to be validated ^^ Accuracy ^^ Statistical significance (error probability) for the training phase This formula generally provides a basis for estimating whether machine learning is incorrectly assessed as successful in the training phase. Success in this case means that the trained procedure remains below or equal to the target failure probability during its implementation, whereby the statistical significance for the training phase must be taken into account. The formula easily shows that the unknown actual failure probability may be greater than the empirical failure probability to be determined, whereby the difference depends on the required accuracy.In other words, the sum of the empirical failure probability and the required accuracy may not exceed the actual failure probability (not yet known at the time of the estimation). According to the invention, a safety factor dependent on the required accuracy is taken into account, by which the empirical failure probability to be achieved is reduced so that, after completion of the training, the required actual failure probability is very likely to be undercut or at most achieved. The safety factor can, for example, be at least 1 / 3 and at most 2 / 3. Preferably, the safety factor can be set at 1 / 2. For a safety factor of 1 / 2, for example, the following applies: P emp= ε =PFD / 2 (2), where the accuracy and empirical probability of failure are equal. In the following, a value expressing the accuracy is also referred to as the confidence factor because, as will be shown, this confidence factor can be derived from the required accuracy. This means that the lower the accuracy of the estimate (i.e., the larger ε), the larger the confidence factor must be. Preferably, it can be provided that the training data sets are released for multiple use for method runs in the training phase. 2022P13562WO Clean copy 21 It is important to note here that training data sets can be used multiple times for training, whereby an optimization of a partially trained computer-implemented method can also be improved if a specific data set is used repeatedly for training.Unlike validation, this does not compromise the reliable assessment of learning success during the validation phase. It is preferably proposed that the statistical significance of the validation phase result be taken into account by specifying a corrected failure probability during the validation phase for comparison with the actual failure probability, which is lower than the specified target failure probability. The corrected failure probability thus makes it possible to consider statistical significance for the validation phase, with statistical significance expressing the probability that the validation of a trained computer-implemented procedure is incorrect. This means that the validation is successful even though the actual failure probability is higher than the target failure probability.According to the invention, a circumstance is utilized that generally arises when interpreting statistical probabilities and can be used for the validation procedure. According to this, the probability is to be assessed as low for the case, which occurs with the relevant statistical significance, that the actual failure probability is greater than the target failure probability and that the actual failure probability significantly exceeds the target failure probability.In contrast, the probability is to be assessed as high for the case, which occurs with the relevant statistical significance, that the actual failure probability is greater than the target failure probability and that the actual failure probability exceeds the target failure probability by a small amount. In other words, by considering a corrected failure probability that is lower than the target failure probability according to the invention, most cases of validation errors will be covered and the probability that the validation is falsely successful will be further reduced. In this case, values ​​in the range between 0.9 and 1.0 (where 1.0 itself is excluded) can advantageously be selected for the correction factor c.This finding according to the invention is particularly advantageously applicable to safety-relevant technical processes, since these processes also place very high demands on the accuracy of a successful validation of a specific learned computer-implemented method. These requirements can be met with the above-mentioned safety argumentation, particularly through successful expert certification. This advantageously makes it possible to successfully permit the application of machine learning in a safety-relevant environment even under high safety requirements (permit in the sense of a positive certification), so that machine learning can also be carried out within the framework of ongoing safety-relevant operations without violating safety specifications.According to the invention, a violation is counteracted by imposing a stricter requirement, namely that during validation, the determined actual 2022P13562WO clean copy 23 failure probability must be lower than the corrected failure probability, even though the target failure probability to be achieved is higher than the corrected failure probability. This advantageously reduces the risk of erroneous validation, since the resulting difference between the target failure probability and the corrected failure probability creates a statistical safety buffer, so to speak.Preferably, it is proposed that the corrected failure probability be calculated by multiplying the target failure probability by a factor resulting from subtracting the statistical significance from 1 and adding the statistical significance multiplied by a correction factor less than 1. In other words, the following condition for the corrected failure probability must be met:^^ ^^ ^^ ^^ = ^^ ^^PFD +. ^ 1 − ^^ ^ PFD = PFD ^ 1 − ^^ + ^^ ^^ ^ (5) with P valCorrected failure probability taking validation errors (misclassification) into account ^^ Statistical significance (error probability) for the validation phase1 − ^^ Statistical confidence (confidence probability) for the validation phase c Constant (< 1) PFD Target failure probability In order to be able to depict a dependence of the corrected failure probability on the statistical significance, the correction factor c is required. 2022P13562WO Fair copy 24 This should be set to < 1 so that the corrected failure probability is lower than the target failure probability. To determine the correction factor, successful applications of supervised machine learning, for example, can be evaluated. In addition, the correction factor c can be varied if it turns out that it does not produce any reliable statements regarding the reliability of validations.By repeatedly applying supervised machine learning, it is also possible to "learn" the correction factor c. The application of the equation explained above has the advantage that a measure is available with simple means to increase the reliability of the validation phase. This can be advantageously integrated particularly easily into computer-implemented machine learning by specifying a calculation formula. The advantages explained for the above claim apply accordingly to the application of this formula. Alternatively, the stated object is also achieved according to the invention with the subject matter of the claim specified at the beginning (technical system) in that the system component of the technical system is configured to execute the computer-implemented method according to one of the aforementioned claims. The device allows the advantages already explained in connection with the method described in more detail above to be achieved.The statements regarding the method according to the invention also apply accordingly to the device according to the invention. Furthermore, a computer program containing program modules with program instructions for implementing the aforementioned method according to the invention and / or its embodiments is claimed, wherein the method according to the invention and / or its embodiments can be implemented using the computer program. Furthermore, a provision device for storing and / or providing the computer program is claimed. The provision device is, for example, a memory unit that stores and / or provides the computer program.Alternatively and / or additionally, the provision device is, for example, a network service, a computer system, a server system, in particular a distributed, for example cloud-based computer system and / or virtual computer system, which preferably stores and / or provides the computer program in the form of a data stream. The provision takes place in the form of a program data set as a file, in particular as a download file, or as a data stream, in particular as a download data stream, of the computer program. However, this provision can also take place, for example, as a partial download consisting of several parts. Such a computer program is read into a system, for example using the provision device, so that the method according to the invention is executed on a computer. Further details of the invention are described below with reference to the drawing.Identical or corresponding drawing elements are each provided with the same reference numerals and are only explained multiple times to the extent that differences arise between the individual figures. The exemplary embodiments explained below are preferred embodiments of the invention. In the exemplary embodiments, the described components of the embodiments each represent individual features of the invention that are to be considered independently of one another, which also further develop the invention independently of one another and are therefore to be regarded as part of the invention, either individually or in a combination other than that shown. Furthermore, the described components can also be combined with the features of the invention described above.1 shows an exemplary embodiment of the device according to the invention (technical system in the form of a level crossing) with its functional relationships, Figure 2 shows an exemplary embodiment of a computing environment for the device according to Figure 1 as a block diagram, wherein the individual computing instances execute program modules which can each run in one or more of the computers shown as examples and wherein the interfaces shown can accordingly be implemented in software in one computer or in hardware between different computers, Figure 3 shows an exemplary embodiment of the method according to the invention as a flow chart, wherein the individual method steps can be implemented individually or in groups by program modules and wherein the computing instances and interfaces according to Figure 2 are indicated by way of example, Figure 4 shows an example and schematically the models used for calculation andEstimation of different probabilities, represented on a ray for the probability P. Figure 1 shows a level crossing BU. In the area of ​​the level crossing BU, a railway line BSR crosses a road STR for motor vehicles. In the crossing area, a danger zone is created where a rail-guided vehicle traveling on the railway line BSR could potentially collide with obstacles on the road 2022P13562WO Reinschrift 27 STR (e.g. vehicles or pedestrians). For this reason, the level crossing BU is demarcated by barriers SR, which are connected to a level crossing controller BUC via a first interface S1 and a second interface S2. The level crossing controller BUC is connected via a third interface S3 to a camera controller CAC, which in turn is connected to a camera CA via a fifth interface S5.The level crossing controller BUC is connected to one of two barriers SR via a first interface S1 and a second interface S2, so that they can receive and implement a closing command and an opening command. The camera CA is used for optical monitoring of the danger zone GB (often also referred to as the danger space) so that obstacles in the danger zone GB can be detected. In order for the camera controller CAC to be able to perform image recognition for the purpose of detecting obstacles, it is trained according to the invention using machine learning. For this purpose, it has a first computer CP1 and a first storage device SE1, which are connected to one another via a fourth interface S4 (see also Figure 2). In addition, the camera controller CAC is connected to a signal box STW via a sixth interface S6.The interlocking system STW is connected to a control center LZ via a seventh interface. The level crossing controller BUC, chamber controller CMC, interlocking system STW, and control center LZ thus form a network, which, as a technical system TS (see Figure 2), comprises a railway facility, in this case the level crossing BU and other infrastructure components of the railway facility (not shown in Figure 1). Figure 2 shows a computer infrastructure that can be assigned to an operator BT and a service provider DL. The operator BT and the service provider DL can communicate with each other via a ninth interface, which connects the first computer CP1 to a second computer C2. The second computer C2 is also connected to a second storage device SE2 via an eighth interface.The first computer CP1, which is assigned to the operator BT, communicates via the fifth interface S5 with the technical system TS, which is representatively indicated in Figure 1 by the camera CA, but, as already explained, can also include other components of the railway infrastructure. The computer-implemented method for carrying out the technical process TPR can be carried out as shown in Figure 3, whereby, for example, output variables y can be determined by measurements in a measuring step MSR, which result from the associated input variables x. As an alternative to carrying out the technical process TPR in reality, this technical process TPR can also be simulated in a simulation step SIM, whereby the output variables y that would result from carrying out the process are calculated by simulating the input variables x.The data sets x, y, which result from the input variables x and the output variables y, are stored in a data pool DP. As already explained, the data sets x, y can be used both as training data sets TD and as validation data sets VD, which is indicated by the curly brackets. Furthermore, the training data sets TD can also be used multiple times during a training phase TP. In Figure 3, the simulation step SIM is performed by the service provider DL. This is indicated by a dot-dash dividing line. In contrast, the measurement step MSR and the machine learning, consisting of the training phase TP and the validation phase VP, are performed by the operator BT.If the data pool DP is available with a sufficient number n of data sets x, y, the machine learning process is started, followed by a training phase TP of the method according to the invention. In a training step TRN, the method is trained using a repeated variation step VAR_f(x) to train an algorithm. After training is complete, the algorithm is defined. Subsequently, a first query step P follows. cur <P empwhether the result of the algorithm for the respective input variable x produces the output variable y stored in the data pool DP (if necessary, taking into account a tolerance range that defines a permissible deviation of the stored output variable y from the output variable calculated using the algorithm). If this is the case, the training phase TP is completed. The training phase TP is followed by a validation phase VP. The following steps are performed in the validation phase VP. In a determination step CLC_α, the statistical significance α is determined. This is followed by a determination step in which a corrected failure probability Pval is determined. The corrected failure probability P val takes into account the specified statistical significance α with respect to a failure, i.e., incorrect result of the validation phase VP. In a second query step P tru <P valit is checked whether the actual failure probability P true is smaller than the corrected failure probability P val . If this query is positive, the machine-learned algorithm is released and introduced in an initialization step INI for subsequent use in the relevant technical process TPR. If the second query step P tru <P valHowever, if the result is negative, an error message is output in an output step ERR. In both cases, the entire machine learning process is subsequently terminated. Figure 4 schematically shows the relationships between the individual calculated and actual probabilities that are relevant for the machine learning method according to the invention using a ray representing the probability P (hereinafter referred to as the probability ray). If machine learning begins with the training phase TP, the validation phase VP still has to be carried out. However, special features that exist with the statistical uncertainty associated with the validation phase VP should already be taken into account in the training phase TP. For this purpose, a two-stage approach is used to effectively protect the reliability of the machine learning against failure.These two stages increase the security against failure independently of each other. Due to the safety relevance of the technical process (TPR) for which an algorithm is to be trained using machine learning, a target failure probability (PFD) is specified, which results from the specific circumstances of the technical system (TS) and its operation. After completion of the training phase (TP) of machine learning, this target failure probability (PFD) must be strictly adhered to. This indicates the probability that the algorithm will fail when executing the technical process (TPR) as required in the technical system (TS).In order to create a certainty that the algorithm trained in the training phase TP will successfully complete the validation phase VP with a limited number of training data sets TD, an empirical 2022P13562WO Reinschrift 31 failure probability Pemp is defined in a first stage, which in the example according to Figure 4 lies at a safety s = 1 / 3 (also called safety factor), i.e. one third of the target failure probability PFD. The sequence of the training phase can be clearly described as follows using Figure 4. To start the training phase, a beta distribution is defined as the starting value. If no information about the process is available, the beta distribution B(1,1) can be used in any case. Based on prior knowledge, however, a beta distribution B (p) that is closer to the goal to be achieved can also be used. start ,q start) if it is already known. The training phase starts based on this beta distribution. During the training phase, the computer-implemented method for carrying out the technical process is iteratively improved (through machine learning). At intervals, it is checked how the probability density changes as a result of the training carried out. In each training phase, a (possibly different) sample size n is taken into account. Taking into account the sample size n and the success rate m, a modified beta distribution B(pmod,qmod) can be estimated. Generally, after checking, the modified beta distribution found is set as the underlying beta distribution for the further training steps until a P-quantile Q is less than or equal to the empirical failure probability. Then the training phase is finished.The procedure shown in Figure 4 is based on Bayes' statistical approach. The probability density results from the probability distribution, i.e., from the curve of the beta distribution B between zero and one, where the curve represents the probability distribution. The goal of the Bayesian approach is to increase the probability density in a first range defined by the range from zero to the empirical failure probability, and to decrease it accordingly in a second range above the empirical failure probability up to one. The machine learning process during the training phase is complete when the probability density in the first range is so high that the process can be carried out with a failure probability below the empirical failure probability.To assess the probability distribution for the failure probability, the P-quantile Q is formed, which represents a measure of the failure probability achieved so far in the training phase (shaded in Figure 4). Q is assumed to be P. emp, i.e. in the case shown in Figure 4, just reach or fall below 1 / 3 PFD. Figure 4 shows the hatched area to show how large the range is for the probability density B(pmod,qmod). It is clear that in the case shown in Figure 4, the P-quartile is still greater than the empirical failure probability Pemp and therefore the process is not yet complete. If the P-quartile Q falls below the empirical failure probability Pemp, the training phase has been successfully completed. The described goal of the training phase will normally not be achieved with the beta distribution determined in the first step. This is because the beta distribution, which achieves the goal in the present optimization problem, is usually not known at the beginning of the training phase. This makes it necessary to train the process in the training phase.To monitor the training, iterative statistical evaluation is performed according to the Bayesian approach. As already described, the validation phase (VP) should be carried out after the training phase (TP). This phase serves to validate the trained algorithm using the validation data sets (VD). For each of these data sets x;y, the algorithm is run with the corresponding input data in a validation step, and the result is compared with the target result stored in the validation data set (VD) (this is the output data). The sum of all validation steps, which corresponds to the number of validation data sets (VD), forms a validation run. The ratio of the number of validation steps (n) is used. fail , where the algorithm failed, to the total n valof the validation steps, the actual failure probability P true directly calculate to: P true = n fail / n val The validation process, which is carried out in the validation phase (VP) (validation run), is also subject to statistical uncertainty, which can be described by the statistical significance α. If the machine learning method is to be certified for safety-critical applications, this statistical uncertainty must be taken into account when implementing the machine learning process. This is done by determining a corrected failure probability P val , which must be used as the basis for the validation procedure in the second stage. For validation, it is required that this corrected failure probability P val in validation, ie in determining the actual failure probability P truemust be taken as a basis, in other words the determined actual 2022P13562WO Fair Copy 34 failure probability P true must be lower than the corrected failure probability P val (and not the target failure probability PFD). The corrected failure probability P val results in:^^ ^^ ^^ ^^ = ^^ ^^PFD + ^ 1 − ^^ ^ PFD = PFD ^ 1 − ^^ + ^^ ^^ ^ (5) It should be noted that the first and second stages are carried out independently of each other. This means, in particular, that for the assessment of whether the empirical failure probability P emp for the given number n valof validation data sets VD is sufficient, the target failure probability PFD can be used as a basis, regardless of this, however, for the validation taking into account the statistical significance α a lower corrected failure probability P val which is determined by the actual failure probability P true must not be exceeded.

[0002] 2022P13562WO Fair copy 35 List of reference symbols BI Observation interval BSR Railway line B(…) Beta distribution p first parameter q second parameter BT Operator BU Level crossing BUC Level crossing controller C2 second computer CA Camera CAC Camera controller CLC_α Determination step CP1 first computer DL Service provider DP Data pool ERR Output step GB Danger zone INI Initialization step LZ Control center L Probability function MSR Measurement step n Sample size m Success rate n val Number of validation steps n failNumber of validation steps PQ Failure probability according to P-quartile P cur current failure probability P cur <P emp first query step P emp empirical failure probability PFD target failure probability P true <P val second query step P true actual failure probability P val corrected failure probability 2022P13562WO fair copy 36 Q P-quantile s safety factor S1 … S9 interface SE1 first storage device SE2 second storage device SIM simulation step SR barrier STR road STW interlocking TD training data sets TP training phase TPR technical process TRN training step TS technical system VA confidence fraction VAR_f(x) variation step VD validation data sets VP validation phase x input variable x;y data sets y output variable z critical factor α statistical significance

Claims

2022P13562WO Fair copy 37 claims 1. A supervised machine learning of a computer-implemented method for carrying out a technical process (TPR), in which the following steps are carried out: a) a data pool (DP) containing data records (x;y) is created with input data for the process and output data describing a correct process result assigned to the input data, b) the computer-implemented method is trained using the data sets as training data sets (TD) in a training phase (TP), wherein process parameters of the computer-implemented method are varied during repeated process executions, c) in a validation phase (VP) the trained computer-implemented method is checked using the data sets as validation data sets (VD) by comparing the output data calculated with the trained computer-implemented method using the input data with the output data describing the correct process result and as a result of the comparison an actual failure probability (P; true) is calculated for the computer-implemented method, wherein for a successful validation the condition must be met that at least a predetermined target failure probability (PFD) is undercut, and wherein the trained computer-implemented method is released for use in the event of a successful validation, characterized in that I) the same data sets (x;y) in the data pool (DP) are used both as training data sets (TD) and as validation data sets (VD). 2022P13562WO Reinschrift 38 II) for the training phase (TP) an empirical failure probability (P emp ) is set which is lower than the specified target failure probability (PFD), III) the validation phase (VP) is initiated after it has been determined in the training phase (TP) that the empirical failure probability (P emp) is not exceeded.

2. A supervised machine learning system according to claim 1, characterized in that during the execution of the training phase a) a beta distribution B(p,q) is determined for a probability density of the failure probability by specifying a first parameter p and a second parameter q for the beta distribution, and the training phase is initiated, b) the probability density is checked at intervals, taking into account a sample size n for the number of method executions in the training phase and a success number m for the number of method executions successfully carried out in the training phase, c) a modified beta distribution B(pmod,qmod) is estimated, d) a P-quantile is determined for the modified beta distribution, wherein for determining a required probability (PQ) that a value of the modified beta distribution lies to the left of the P-quantile,is equated with the empirical probability of failure, 2022P13562WO Reinschrift 39 e) in the event that the P-quantile is greater than the empirical failure probability, the training phase is continued with step a) of this claim, wherein the first parameter p and the second parameter q of the modified beta distribution are used for the beta distribution (B), and in the event that the P-quantile is less than or equal to the empirical failure probability (P emp), the training phase is terminated.

3. A supervised machine learning system according to claim 2, characterized in that the first parameter p and the second parameter q are specified as one when step a) of the preceding claim is run for the first time.

4. A supervised machine learning system according to claim 2 or 3, characterized in that a) the output data calculated so far in the training phase (TP) with the input data in the method executions are compared with the output data describing the correct process result, the result of the comparison is used as the current failure probability (P cur ) is calculated for the computer-implemented method, b) the probability density in step b) of claim 2 is checked by using the sample size n and the success number m to calculate a probability function L for the current failure probability (P cur ) is formed to L(P cur ) = P curm (1-P cur ) n-m .

5. A supervised machine learning system according to any one of the preceding claims, characterized in that a safety factor (s) related to the target failure probability (PFD) is defined, with which the empirical failure probability (P emp ) is calculated, where the empirical failure probability (P emp ) to a 2022P13562WO Fair Copy 40 confidence factor (VA) is reduced compared to the target failure probability (PFD).

6. A supervised machine learning method according to claim 5, characterized in that the safety factor (s) is set at at least 1 / 3 and at most 2 / 3, preferably at 1 / 2.

7. A supervised machine learning method according to one of the preceding claims, characterized in that the training data sets (TD) are released for multiple use for method runs in the training phase (TP).

8. A supervised machine learning method according to one of the preceding claims, characterized in that a statistical significance (α) of the result of the validation phase (VP) is taken into account by comparing the actual failure probability (P true ) a corrected probability of failure (P val) which is lower than the predetermined target failure probability (PFD).

9. A supervised machine learning system according to claim 8, characterized in that the corrected failure probability (P val ) is calculated by multiplying the target failure probability (PFD) by a factor resulting from subtracting the statistical significance (α) from 1 and adding the statistical significance (α) multiplied by a correction factor (c) that is less than 1.

10. A technical system for carrying out a technical process (TPR) with a system component that has a computer, characterized in that 2022P13562WO Fair Copy 41 the system component of the technical system (TS) is configured to carry out the computer-implemented method according to one of the preceding claims.

11. A technical system according to claim 10, characterized in that the technical system (TS) is a railway installation, 12. A technical system according to claim 10, characterized in that the technical system (TS) is a level crossing (BU), wherein at this level crossing (BU) the computer-implemented method is configured to carry out obstacle detection in a danger zone (GB) of the level crossing (BU).

13. A computer program comprising program instructions which, when the program is executed by a computer, cause the computer to carry out at least steps b) and c) as well as features I) and II) of the machine learning according to claim 1 when carrying out the method according to one of claims 1-10. 14.A computer-readable storage medium on which the computer program according to the last preceding claim is stored.

Images