DE102009054106A1 - Method for detecting data in redundant system in motor vehicle, involves activating safety path depending on input parameters, detecting activation of safety path, and activating or deactivating actuator of redundant system - Google Patents

Abstract

The method involves activating a safety path (108) depending on input parameters (101-107), and detecting activation of the safety path. An actuator (113) of a redundant system is activated or deactivated by a connection of the safety path and another safety path (109). The input parameters or a part of the input parameters are detected by activating the safety paths. The redundant system is adjusted based on the detected data. The data are detected during operation of the redundant system and/or during testing of the redundant system. The detected data are stored. An independent claim is also included for a device for detection of data in a redundant system.

Description

The invention relates to a method and a device for detecting data in a redundant system.

Vehicles are developed according to a catalog of requirements. Due to the ever-increasing use of electronics in the vehicle a variety of functions and settings are offered to a user. Also safety-related functions of the vehicle, eg. B. concerning airbag, anti-lock braking system (ABS), electronic stability program (ESP), active steering (AFS, Active Front Steering), require electronic control and / or evaluation. The requirements, z. As complexity, networking and communication, to the components. It is important that despite increasing demands, the components, for. As control units are manufactured according to specified safety regulations and that the function of the components is carried out in compliance with specified safety regulations.

For example, a so-called proof of safety serves that for a component, for. As a control unit, or a composite of several components is a documentation of actions performed, which are required to achieve a given (eg necessary) security.

• a) Komponenten (oder Teilsysteme) werden redundant ausgelegt.
• b) Es erfolgt eine Aufteilung von Funktionen und/oder Komponenten in sicherheitsrelevante und nicht-sicherheitsrelevante Teilfunktionen oder Teilsysteme.
• c) Die Komponenten verfügen jeweils über Diagnosemechanismen, insbesondere zur Eigendiagnose. Entsprechend kann je nach Anforderung eine hohe Diagnoseabdeckung erreicht werden.

Thus, a certain degree of security can be achieved by means of at least one of the following approaches to error control:

• a) Components (or subsystems) are designed redundantly.
• b) A subdivision of functions and / or components into safety-related and non-safety-relevant subfunctions or subsystems takes place.
• c) The components each have diagnostic mechanisms, in particular for self-diagnosis. Accordingly, depending on the requirement, a high level of diagnostic coverage can be achieved.

Thus, for example, errors or failures during the actual operation of the component as well as failures due to systematic errors, such as. B. in development, production, or maintenance can be detected.

• 1) Eine Sicherheitsmaßnahme, die bewirkt, dass eine sicherheitskritische Systemfunktion nicht aus- oder weitergeführt wird. Beispielsweise kann eine Überwachungskomponente (”Watchdog”) das Gesamtsystem bei Erkennung eines Fehlers in einen sicheren Zustand überführen, z. B. abschalten.
• 2) Eine Sicherheitsmaßnahme mit einem ermöglichendem Charakter: So kann über eine Aktivierung der Sicherheitsmaßnahme bewirkt werden, dass eine sicherheitskritische Systemfunktion ausgeführt wird.

In particular, there are the following types of security measures:

• 1) A security measure which means that a safety-critical system function is not executed or continued. For example, a monitoring component ("watchdog") can transform the entire system into a safe state upon detection of an error, eg. B. turn off.
• 2) A security measure with an enabling character: For example, activation of the security measure can cause a safety-critical system function to be executed.

A description of all security measures that are suitable or necessary for achieving the security of a function takes place in a so-called security concept.

Here, it is fundamentally problematic that z. B. in a redundant design of a component (eg., A control device) may be conflicting security requirements. In the case of an airbag control unit z. B. on the one hand, the safety requirement "preventing a false trip of the airbag" and on the other hand, the safety requirement "ensure the deployment of the airbag in an accident" are present.

Thus, on the one hand there is a conflict of objectives between the availability and the security of the component or function. If the security measure is designed to be too restrictive, the security of the overall function increases while the availability of the function decreases. If, on the other hand, the availability of the function is increased with a corresponding design of the safety measures, the safety of the component or function decreases.

It is also a problem that due to poor concrete data and / or low field experience at the time of development of new systems, estimates and assumptions are made regarding the design of security measures or the need for (possibly additional) security measures.

Such an estimate or assumption may u. U. be quite inaccurate and z. B. lead to a too conservative interpretation of the component or function.

The object of the invention is to avoid the abovementioned disadvantages and, in particular, to create a possibility for the efficient design of a safety-relevant component and / or function. For example, this improves the quality of the design of security measures.

This object is achieved according to the features of the independent claims. Further developments of the invention will become apparent from the dependent claims.

• – bei dem abhängig von Eingangsparametern mindestens einer der mindestens zwei Sicherheitspfade aktiviert wird;
• – bei dem die Aktivierung des mindestens einen Sicherheitspfads erfasst wird.

To achieve the object, a method for detecting data in a redundant system is proposed, comprising at least two security paths,

• In which, depending on input parameters, at least one of the at least two security paths is activated;
• - In which the activation of the at least one security path is detected.

For the interpretation of the safety measures with an enabling character, it is advantageous to know how often the safety measure has been or will be activated in "normal operation". The present approach provides such a size and thus advantageously allows a robust and at the same time not unnecessarily restrictive interpretation of the security measure. This increases the efficiency of the system and saves additional costs for further testing and safeguarding measures (eg in the form of otherwise required rework for inappropriately designed security measures).

Each safety path corresponds to z. B. a security measure or a partial safety measure of the system. The security measure may be an enabling measure or a prohibiting (disabling) measure. In the first case, the security path allows the security-relevant system to be activated if the other security path (in the case of two security paths) also proposes the activation. Thus, as a result, the security paths are logically AND linked. Alternatively, each safety path can prevent a safety-related system from being activated; Thus, it is sufficient if a single one of the multiple security paths indicates a ban on activation. This corresponds to a logical NOR operation.

It should be noted that the activation of the at least one security path can correspond to any given event. This event is detected appropriately. For example, the activation of the security path can also lead to a deactivation of an actuator. In particular, the activation of the at least one safety path corresponds to a change of state of the at least one safety path.

The security path can also be a function path, ie a path associated with a given function. The function path can be combined with another safety path, so that the safety path ensures activation or deactivation of an actuator, for. B. if in addition to or independent of the function path coinciding with this and the safety path proposes the activation or deactivation of the actuator.

A development is that the redundant system comprises at least one control unit or at least one control functionality.

For example, the controller may be a controller in a motor vehicle, e.g. As an airbag control unit, a control device for an anti-lock brake system, an active steering control unit, a control device for an electronic driving stability program, etc.

Another development is that the redundant system comprises at least one actuator which is activated or deactivated via a suitable linkage of the safety paths.

The linking of the security paths is, for example, an AND operation of the activation signals provided by the security paths. Other logical links, such. As an OR or a NOR-OR are possible. Also, combinations of (arbitrary) logical operations are possible, especially with a variety of security paths.

The at least one actuator can be any actuator, in particular an actuator in a motor vehicle.

In particular, it is a development that the activation of the at least one safety path, the input parameters or a part of the input parameters are detected.

It is also possible for GPS data to be detected together with the activation of the at least one safety path.

It is also a development that the system is adjusted based on the data collected.

In particular, the system can be changed or dimensioned based on the acquired data.

Further, it is a development that the data is collected during operation of the system and / or during the testing of the system.

The system is preferably a vehicle or a part in a vehicle.

As part of an additional training, the collected data is stored.

For example, the acquired data can be buffered for later processing and / or adaptation of the redundant system.

A next development is that the at least two safety paths evaluate different input parameters.

Optionally, the multiple safety paths can also evaluate the same input parameters. In particular, the multiple security paths may each provide different functions.

One embodiment is that the at least two security paths are designed with different hardware.

Optionally, the multiple security paths can also be equipped with the same or functionally identical hardware. Due to the different implementations of the multiple security paths, it is possible to provide sub-functions cost-effectively depending on the respective processing complexity. So z. B. in a safety path an ASIC can be used, which is inexpensive and can quickly perform appropriate evaluations; in a second security path, a processor with suitable shading can be present which carries out complex calculations (eg in real time) and is correspondingly more expensive than the abovementioned ASIC.

An alternative embodiment is that a duration of the activation of the at least one safety path is detected.

A next embodiment is that a frequency of activation of the at least one security path is detected.

It is also an embodiment that the at least two security paths have the same or different security goods.

The safety grade can z. B. a classification according to the standards IEC 61508 or ISO 26262 correspond. Thus, a higher level of safety can be achieved for the overall system, although the individual safety paths each have a lower safety quality: The redundancy of the safety paths increases the safety performance of the overall system.

A further embodiment is that the redundant system is a system or a function in a motor vehicle.

• – umfassend mindestens zwei Sicherheitspfade,
• – bei der abhängig von Eingangsparametern mindestens einer der mindestens zwei Sicherheitspfade aktivierbar ist;
• – bei der die Aktivierung des mindestens einen Sicherheitspfads erfassbar ist.

The above object is also achieved by a device for acquiring data in a redundant system

• Comprising at least two security paths,
• - In which dependent on input parameters of at least one of the at least two security paths can be activated;
• - In which the activation of the at least one security path is detected.

Also, the above object is achieved by a vehicle comprising at least one of the devices explained herein.

Embodiments of the invention are illustrated and explained below with reference to the drawing.

It shows:

1 a schematic block diagram for the realization of a safety-related function, eg. B. for triggering (at least) an airbag in a vehicle.

• – während einer Entwicklungsphase oder einer Erprobungsphase bzw.
• – während eines Feldbetriebs.

It is proposed that at least one activation of a security measure of a component or a function, in particular a security-relevant system, be detected. Such activation can z. B. stored, transferred and / or further processed. In particular, activation of the security measure may be detected during normal operation of the component or function, e.g. B.

• During a development phase or a trial phase or
• During a field operation.

The component or function may be subject to safety requirements and / or safety requirements which are met by at least one of the safety measures of an enabling nature.

In the security measure with ermöglichendem character, for example, a hedge of an airbag control unit to the effect that an undesirable error "false triggering of the airbag" is avoided by a redundant distribution of the total functionality in two safety paths. Preferably, the two security paths can perform different monitoring, z. B. based on different input parameters. The airbag control unit triggers in this example only if both safety paths consistently suggest the activation.

In particular, it is detected and / or stored how often and / or how long a safety path is activated and / or activated.

• a) ein Nachweis erbracht werden kann, dass die Komponente bzw. Funktion eine ausreichend robuste aber nicht unnötig restriktive Auslegung der Sicherheitsmaßnahme aufweist;
• b) ein Nachweis erbracht werden kann, dass eine ausreichende Sicherheit der Sicherheitsmaßnahme und/oder der Gesamtfunktion gegeben ist;
• c) ein Nachweis erbracht werden kann, dass eine Aufteilung der Gesamtfunktion in redundante Teilsysteme mit unterschiedlichen Sicherheitsguten funktioniert, insbesondere korrekt ist und eine entsprechende Gültigkeit aufweist.

The recorded or stored data z. B. from the trial or field operation can be evaluated, which

• (a) evidence can be provided that the component or function has a sufficiently robust but not unnecessarily restrictive interpretation of the security measure;
• (b) proof can be provided that adequate safety of the safety measure and / or the overall function is ensured;
• c) proof can be provided that a division of the overall function into redundant subsystems with different safety goods functions, in particular is correct and has a corresponding validity.

The above evidence a) to c) can be provided individually or in combination with each other.

The redundant components may have the same or different security goods. The safety grade can z. B. in the form of a SIL or ASIL classification according to standards IEC 61508 or ISO 26262 respectively.

In this case, it is advantageous that when subdividing the overall functions into at least partially redundant subsystems, each with different security goods, these subsystems only have to have a security good reduced compared to the requirement for the overall system. Thus, the overall redundant design allows a more cost effective implementation of the overall function.

By the solution proposed here, it is possible safety-related components or functions, eg. B. ECUs to develop efficiently while ensuring a given security quality.

Another advantage is that a proof of security can be provided. Thus, z. As a certification or it can be documented a safety grade accordingly.

1 shows a schematic block diagram for the realization of a safety-related function, eg. B. for triggering (at least) an airbag in a vehicle.

To a certain degree of security, z. As a given security quality to achieve, the safety-related function is designed redundantly in the form of sub-functions. Thus, the decision as to whether or not the airbag is fired may be made dependent on sub-functions consistently indicating activation. Each subfunction thus provides a security measure with an enabling character.

The safety-relevant function according to 1 has two security paths 108 . 109 on. In a motor vehicle, z. B. via a bus system, a variety of parameters 101 to 107 available, the redundant sub-functions of the safety-related function are provided. The first subfunction is by means of a microcontroller 110 and the second subfunction is by means of an ASIC 111 realized. The microcontroller 110 receives the parameters 102 . 103 . 105 and 106 and determines from this whether or not an activation of the first subfunction should take place. The ASIC receives accordingly 111 the parameters 101 . 103 . 106 and 107 and determines whether activation of the second subfunction is necessary.

The above assignment of parameters to subfunctions is only to be understood as an example. It is also possible that both sub-functions each receive the same parameters, or any assignments of parameters. Also, a variety of sub-functions (more than the two security paths shown 108 . 109 ), which access the same or different parameters and have the same or different processing means (microcontroller, processor, FPGA, ASIC, programmable logic, etc.).

By way of example, different subfunctions can be implemented with different hardware, eg. B. can be used in a safety path easier or cheaper hardware that z. B. provides a security measure with ermöglichendem character, while in the other security path more expensive hardware performs a more complex evaluation, whether or not the activation (eg., An airbag) should be made.

Both security paths 108 . 109 provide independently, if necessary, an activation signal; the activation signals are in one unit 112 combined, ie logically AND linked, so that an actor 113 only triggered when the signals of both safety paths 108 and 109 agree to suggest an activation.

It should be noted that the unit 112 can also have a different logical connection. For example, in the case of a safety-related function by means of the safety paths, it may be necessary for at least one safety path to activate the actuator 113 can perform. In this case, the unit 112 logically OR the security paths. In addition, it should be noted that the actor 113 be configured to transfer a function or component to a secure state. Especially in this case, the OR combination advantageous because each activation signal of each safety path initiates the safe state.

Furthermore, a unit 114 for detecting and / or evaluating activation signals of the two security paths 108 . 109 intended. The detection can z. B. at the output of the microcontroller 110 or the ASIC 111 respectively. The unit 114 stores the activation signals and the non-activation signals, so that in particular in connection with other data, eg. B. a detected route, it can be determined whether the design of the safety-relevant function corresponds to a specification. On the basis of the unit 114 recorded data, it is z. B. possible to evaluate all signals in which at least one safety path 108 . 109 an activation suggests. For example, with the aid of additionally stored parameters, the event can be evaluated and this evaluation can be used to set the triggering thresholds of the safety paths 108 . 109 be used. The above-mentioned stored parameters are, for. B. a temporal course of the parameters 101 to 107 over the route of a motor vehicle, wherein the route is determined and stored for example by means of GPS coordinates of a navigation system.

Furthermore, it is possible that the security paths 108 . 109 each with a lower safety grade allow a higher level of safety of the entire safety-related function. Furthermore, the quality of the safety-relevant function can be suitably documented by the approach proposed here. This transparency is suitable for further improving the safety-relevant function and for it to be designed such that it can be used, for example. B. is even better matched to the vehicle or the vehicle type.

LIST OF REFERENCE NUMBERS

101

parameter

102

parameter

103

parameter

104

parameter

105

parameter

106

parameter

107

parameter

108

safety path

109

safety path

110

microcontroller

111

ASIC

112

Unit (for logical linking of the activation signals of the safety paths 108 . 109 )

113

actuator

114

Unit for detecting and / or evaluating the activation signals

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• IEC 61508 [0039]
• ISO 26262 [0039]
• IEC 61508 [0052]
• ISO 26262 [0052]

Claims (15)

Method for collecting data in a redundant system comprising at least two security paths ( 108 . 109 ), - depending on the input parameters ( 101 - 107 ) at least one of the at least two security paths ( 108 . 109 ) is activated; In which the activation of the at least one security path is detected ( 114 ) becomes. The method of claim 1, wherein the redundant system comprises at least one controller or at least one control functionality. Method according to one of the preceding claims, in which the redundant system has at least one actuator ( 113 ), which is accessible via an appropriate linkage of the security paths ( 108 . 109 ) is activated or deactivated. Method according to one of the preceding claims, in which the activation of the at least one safety path, the input parameters or a part of the input parameters are detected. Method according to one of the preceding claims, in which the system is set on the basis of the acquired data. Method according to one of the preceding claims, wherein the data is detected during the operation of the system and / or during the testing of the system. Method according to one of the preceding claims, in which the acquired data are stored. Method according to one of the preceding claims, in which the at least two safety paths evaluate different input parameters. Method according to one of the preceding claims, in which the at least two security paths are designed with different hardware. Method according to one of the preceding claims, in which a duration of activation of the at least one safety path is detected. Method according to one of the preceding claims, in which a frequency of activation of the at least one safety path is detected. Method according to one of the preceding claims, in which the at least two security paths have identical or different security goods. Method according to one of the preceding claims, wherein the redundant system is a system or a function in a motor vehicle. Device for collecting data in a redundant system Comprising at least two security paths, - In which dependent on input parameters of at least one of the at least two security paths can be activated; - In which the activation of the at least one security path is detected. Vehicle comprising at least one device according to claim 14.

Images