DE102018217729B4 - Method and device for estimating at least one performance indicator of a system - Google Patents

Abstract

The invention relates to a method for estimating at least one key performance indicator (32, 33, 34) of a system, comprising the following steps: receiving functional structural information (20) of the system by means of an input device (2), the functional structural information (20) being information to individual components (22) of the system and their structural arrangement, and by means of a calculation device (3): generating a state diagram (23) of the system comprising a plurality of system states (Zx), the system states (Zx) of the system being based on transition probability information between component states of the individual components (22) are linked to one another, defining categories of the at least one performance indicator (32, 33, 34) and assigning the defined categories to system states (Zx), determining probability of residence values (30) of the system in the individual system states (Zx) , Determine the minimum at least one performance indicator (32, 33, 34) for each of the defined categories on the basis of the determined residence probability values (30) and outputting the determined at least one performance indicator (32, 33, 34) for each of the defined categories as a performance indicator signal (11) by means of an output device (4). The invention further relates to an associated device (1).

Description

The invention relates to a method and a device for estimating at least one performance indicator of a system.

It is known to assess complex systems with several components with regard to a failure probability and to determine a corresponding key performance indicator. Here, on the basis of functional structural information of the system in the form of reliability block diagrams, various interrelated system states are defined and a failure behavior of the system is simulated on the basis of properties of the individual components. The key performance indicator is then determined from the simulation result.

From the DE 601 06 799 T2 a diagnostic device for diagnosing a unit with a plurality of components is known, the diagnostic device being set up in such a way that it calculates the following: the probability that a certain group of components is faulty and all other components are faultless and that the states are assumed the components are probabilistic (from a probability point of view) independent of one another; the likelihood that any particular group of shared functions will fail and another group of functions will remain intact if a particular group of components is faulty, assuming that the shared function states are equally applicable to testing the functionality of some components are probabilistically independent given states of components; and the likelihood that any particular set of tests will fail and another set of tests will succeed if a particular set of devices are faulty and the rest are healthy, a certain set of shared functions fail, and the rest are intact, assuming that the tests to be applied to the unit are probabilistically independent given states of components as well as states of the shared functions; the diagnostic device is configured to receive: data representing the test results of a group of tests performed on the unit in which at least one test failed; and data representing a model that represents the scope of the tests performed on the device components and provides information describing the probabilistic dependencies between the tests; and the diagnostic device comprises: a means arranged to set or indicate a certain number N of components which are defective, and a calculation means for calculating the probability that each sub-group of components with a size smaller than or N contains the defective components.

From the WO 2016/183332 A1 a method for prognostic modeling is known. This includes obtaining probability values for possible health conditions of a system or a component part using one or more data-driven models and one or more physical failure models. A probabilistic network is built using a variety of observed and latent variables. The likely results from the one or more physical failure models and the one or more data-driven models are combined to create an integrated failure forecasting model. Health status of the system or system component is predicted using the integrated model and probabilistic network.

In particular, in applications in motor vehicles with increased reliability requirements in semi-automated or automated driving, the calculation of a performance indicator that characterizes the probability of failure is currently only unsatisfactorily solved.

The invention is based on the object of providing a method and a device for estimating at least one performance indicator of a system, in which a performance indicator of the system can be estimated in an improved manner.

The object is achieved according to the invention by a method with the features of claim 1 and a device with the features of claim 10. Advantageous embodiments of the invention result from the subclaims.

1. (a) Erzeugen eines mehrere Systemzustände umfassenden Zustandsdiagramms des Systems auf Grundlage der einzelnen Komponenten und deren struktureller Anordnung, wobei die Systemzustände des Systems auf Grundlage von Übergangswahrscheinlichkeitsinformationen zwischen Komponentenzuständen der einzelnen Komponenten miteinander verknüpft werden,
2. (b) Festlegen von Kategorien der mindestens einen Leistungskennzahl und Zuordnen der festgelegten Kategorien zu Systemzuständen des Zustandsdiagramms,
3. (c) Ermitteln von Aufenthaltswahrscheinlichkeitswerten des Systems in den einzelnen Systemzuständen auf Grundlage der Verknüpfungen zwischen den einzelnen Systemzuständen,
4. (d) Ermitteln der mindestens einen Leistungskennzahl für jede der festgelegten Kategorien auf Grundlage der ermittelten Aufenthaltswahrscheinlichkeitswerte, und

Ausgeben der ermittelten mindestens einen Leistungskennzahl für jede der festgelegten Kategorien als Leistungskennzahlsignal mittels einer Ausgabeeinrichtung.In particular, a method for estimating at least one performance indicator of a system is provided, comprising the following steps: receiving functional structural information of the system by means of an input device, the functional structural information comprising information on individual components of the system and their structural arrangement and by means of a computing device :

1. (a) generating a state diagram of the system comprising several system states based on the individual components and their structural arrangement, the system states of the system being based on transition probability information between component states of the individual components are linked together,
2. (b) defining categories of the at least one performance indicator and assigning the defined categories to system states of the state diagram,
3. (c) determining the probability of residence values of the system in the individual system states on the basis of the links between the individual system states,
4. (d) determining the at least one key performance indicator for each of the defined categories on the basis of the determined residence probability values, and

Output of the determined at least one key performance indicator for each of the defined categories as a key performance indicator signal by means of an output device.

1. (a) Erzeugen eines mehrere Systemzustände umfassenden Zustandsdiagramms des Systems auf Grundlage der einzelnen Komponenten und deren struktureller Anordnung, wobei die Systemzustände des Systems auf Grundlage von Übergangswahrscheinlichkeitsinformationen zwischen Komponentenzuständen der einzelnen Komponenten miteinander verknüpft werden,
2. (b) Festlegen von Kategorien der mindestens einen Leistungskennzahl und Zuordnen der festgelegten Kategorien zu Systemzuständen des Zustandsdiagramms,
3. (c) Ermitteln von Aufenthaltswahrscheinlichkeitswerten des Systems in den einzelnen Systemzuständen auf Grundlage der Verknüpfungen zwischen den einzelnen Systemzuständen,
4. (d) Ermitteln der mindestens einen Leistungskennzahl für jede der festgelegten Kategorien auf Grundlage der ermittelten Aufenthaltswahrscheinlichkeitswerte, und

eine Ausgabeeinrichtung, wobei die Ausgabeeinrichtung derart ausgebildet ist, die ermittelte mindestens eine Leistungskennzahl für jede der festgelegten Kategorien als Leistungskennzahlsignal auszugeben.Furthermore, a device for estimating at least one key performance indicator of a system is provided, comprising an input device, the input device being designed to receive functional structural information of the system, the functional structural information comprising information about individual components of the system and their structural arrangement, one Calculation device, wherein the calculation device is designed to carry out the following steps:

1. (a) generating a state diagram of the system comprising a plurality of system states on the basis of the individual components and their structural arrangement, the system states of the system being linked to one another on the basis of transition probability information between component states of the individual components,
2. (b) defining categories of the at least one performance indicator and assigning the defined categories to system states of the state diagram,
3. (c) determining the probability of residence values of the system in the individual system states on the basis of the links between the individual system states,
4. (d) determining the at least one key performance indicator for each of the defined categories on the basis of the determined residence probability values, and

an output device, the output device being designed to output the determined at least one performance indicator for each of the defined categories as a performance indicator signal.

A basic idea of the invention is to provide several categories of performance indicators, which system states are assigned to a system. In particular, it can be provided that several system categories are assigned to individual system states. It can also be provided that no category is assigned to one or more system states. This higher level enables improved statements to be made about the reliability behavior of the system. In particular in the case of systems in which there are high security requirements, the system can thereby be assessed in an improved manner, since different levels can be distinguished in the behavior of the system.

In particular, the system should consist of several components. According to the invention, the system is arranged in a motor vehicle. According to the invention, the system in the motor vehicle is a device for supporting a driver of the motor vehicle or for semi-or fully automated driving of the motor vehicle.

The functional structure information is in particular a technical system description in the form of a reliability block diagram. This reliability block diagram shows an arrangement of the individual components of the system with regard to reliability. A distinction is usually made between a series connection, a parallel connection, an mvn arrangement and a standby arrangement of the individual components. In the case of a series connection, the components are connected in series in a structure path and a failure of a component leads to the failure of the structure path. In a parallel connection of two components, both components perform the same tasks in parallel. In this case, both structure paths must fail for the function or the system to fail. An mvn arrangement is a parallel system structure in which m of n structure paths must always be functional. E.g. With a 2v3 arrangement, a maximum of one structure path should fail so that the system is still functional. This arrangement is used, among other things, in safety-critical systems in which an active structure path must be checked at least by a second active structure path. Standby arrangements are also parallel system structures, but the special feature of this is that there is only one active structure path, the remaining parallel structure paths are inactive with regard to reliability. If the active structure path fails, the next structure path is activated and takes over the function of the failed structure path.

The functional structure information is provided to the input device. This can take place, for example, in the form of a correspondingly designed data packet that is received by the input device and contains the functional structure information.

On the basis of the functional structure information, that is to say on the basis of the individual components described in the structure information and their structural arrangement, the calculation device generates a state diagram of the system comprising several system states. In particular, the component states "functional" and "failed" are differentiated for each of the individual components, whereby the individual system states result from combinations of the component states. The individual system states of the system are linked to one another in this state diagram on the basis of transition probability information. The transition probability information describes a probability that a component that is in a particular component state changes to another component state. In particular, the transition probability information is fixed with respect to a time. Alternatively, the transition probability information can also be defined in relation to a number of kilometers (e.g. a mileage) or a load. The transition probability information includes, for example, a transition probability or a transition probability distribution. The state diagram does not have to be designed as a (graphic) diagram, but can also be created abstractly as a corresponding definition of the individual system states with the associated links.

The transition probability information for each of the components is, for example, also received by the input device or generated in another way, for example it can be derived or estimated on the basis of a class or a manufacturer of the components.

Once the state diagram with the individual system states of the system and their links has been generated, the categories of the at least one performance indicator are assigned to the individual system states of the system. Several categories can be assigned to the individual system states.

When assigning the individual categories to the system states of the system, it can be provided that a state history is taken into account here. An assignment of individual categories to a system status can be different depending on the previous status history. For example, the assignment may differ depending on whether the system has already failed before or not.

The determination of the probability of residence of the system in the individual system states takes place on the basis of the connections between the individual system states. In particular, it is considered whether a single component has failed or not. In an initial state, all components are functional. Starting from the initial state, residence probabilities of the system in the individual system states of the state diagram are then determined as a function of the respective transition probability information between individual component states of the components. The probabilities of residence are determined under specified boundary conditions. In particular, such a boundary condition can be a predetermined period of time, for example a period of 10 years, for which the probabilities of residence are determined. A number of changes of state can also be predetermined. Such a boundary condition can also be a number of system status profiles used for determining. Here, however, the meaningfulness of the estimated at least one key performance indicator becomes better the more status trends have been run through for a predetermined period of time.

The residence probabilities are determined in particular by adding up residence times in the individual system states for each of the state courses over sections of the state course or the entire state course. For the sections or the entire course of the condition, these accumulated periods of stay are related to a duration of the section or the entire course. In this way, system probabilities of the system in the system states can be derived in relation to the periods under consideration. The at least one key performance indicator is determined on the basis of the residence probabilities determined.

If the defined categories are taken into account, the probabilities arise that the system is in one of the defined categories and the corresponding key performance indicator can be determined from this. The method thus makes it possible to determine a time profile of the performance indicators.

The determined at least one key performance indicator for each of the defined categories is then output as a key performance indicator signal by means of the output device. The performance indicator signal can be output in particular in digital form, for example as a data packet.

The at least one performance indicator should in particular represent a measure of the reliability of the system in relation to individual component states. Reliability indicates how reliably a system works. The behavior of the individual components is used to infer the entire system. With the help of the individual transition probability information for the individual component states, the behavior of the entire system can be estimated over time. The at least one key performance indicator is then derived from the estimated behavior of the entire system.

It can be provided that the at least one key performance indicator is determined and output for several points in time or periods. In this way, the development of the system can be observed over time. If, on the other hand, a dependency on a number of kilometers or a load is provided by corresponding dependencies of the transition probability information of the individual components, the development of the system can be determined and observed depending on the course of these variables.

In one embodiment it is provided that hardware and software of the components are taken into account individually when generating the state diagram. This has the advantage that the behavior of the hardware and software in the context of individual states can be taken into account in the state diagram. This allows, for example, separate statements about how likely a failure of the software or the hardware of the system is.

In one embodiment it is provided that the transition probability information of at least one of the components comprises failure probability information and repair probability information. This makes it possible to form a direction-dependent link between individual system states of the state diagram. A state of the system includes, for example, a component in a functional component state. With a certain probability, which can be derived from the failure probability information of this component, the functional component fails. The component state is then different and the system changes to a different system state in which the component has failed. The component can be repaired again with a probability that can be derived from the repair probability information. The component status then changes again accordingly and the system status of the system goes back to the system status in which the component was functional. The failure probability information can comprise, for example, a failure probability or a failure probability distribution. Correspondingly, the repair probability information can include a repair probability or a repair probability distribution.

In one embodiment it is provided that in step (d) categories for a reliability of the system and / or an availability of the system and / or for a security of the system are defined and assigned. These categories can describe the system in terms of reliability, security and availability in finer gradations and thereby improved. Reliability can in particular be assigned to system states in which individual components have not yet failed or in which individual components have failed but the complete system has not yet failed in the past. In this case, availability can in particular be assigned to system states in which the system is functional and therefore available regardless of a state history. For example, security can in particular be assigned to system states in which redundancy of individual structure paths is guaranteed.

In one embodiment it is provided that the probabilities of the system in the individual system states are determined by means of a Monte Carlo simulation, the transition probability information in each case comprising transition probability distributions between component states of the components. If the transition probability information includes failure probability information and repair probability information, then the transition probability distributions are direction-dependent and then include failure probability distributions and repair probability distributions depending on the component. The distributions should in particular be defined as a function of time. For example, the distributions can be designed as exponential distributions with a corresponding expected value for the time until the corresponding component fails. Alternatively, the distributions can also be made in Dependency on a mileage (e.g. kilometers) or a load (e.g. operating hours) can be defined. Accordingly, the at least one performance indicator results depending on the time, the mileage or the load.

In particular, the Monte Carlo simulation delivers a distribution of the probabilities of stay and / or a distribution of the at least one key performance indicator as a result of the individual simulation runs. It can be provided that these distributions are evaluated further and, for example, an average and a measure for the variance are determined. The mean and the variance are then also output. It can be provided that the mean value is output as a performance indicator signal instead of the performance indicator.

In a further embodiment it is provided that for at least one of the components of the system the associated transition probability information comprises at least two different transition probability distributions and these are taken into account when determining the probabilities of stay. For example, it can be provided that a component has two different default probabilities or default probability distributions, for example a short-term and a longer-term one. Since, for example, software does not follow a fixed failure behavior, but only shows patterns of different failure modes, this behavior can be taken into account and mapped over several transition probability distributions or failure probability distributions. The key performance indicators can therefore be estimated significantly improved. It can also be provided that several repair probabilities and / or repair probability distributions are also provided.

Provision can also be made to provide further rules for transitions between component states of the components or between system states of the system. This enables complex behavior and additional conditions to be taken into account when estimating the at least one performance indicator.

In one embodiment, it is provided that when the residence probabilities are determined, the state profiles generated using the Monte Carlo simulation are recorded. This makes it possible to analyze the recorded state profiles and to derive further information about the system behavior from this. A corresponding memory can be provided for recording.

In a further embodiment, it is provided that an average transition duration between system states of the system and / or a frequency of predetermined state profiles are determined on the basis of the recorded state profiles. For example, an average repair time of the system can be determined by adding up the times until which individual components or the system have been repaired for each individual status curve and then averaging the respective sums over all status profiles. With the help of the specific frequency of predefined state profiles, weak points in the system can be found and analyzed, for example. In this way, particularly critical state profiles can be examined and evaluated.

In an alternative embodiment it is provided that the determination of the residence probabilities of the system in the individual system states is carried out by means of a stochastic process, the transition probability information in each case comprising transition probabilities between component states of the individual components. If the transition probability information comprises failure probability information and repair probability information, the transition probabilities are directional and include a failure probability and a repair probability. Such a stochastic process can be, for example, a Markov process or a Semi-Markov process.

In the device, the calculation device is designed to carry out the individual embodiments of the method.

Parts of the device can be designed individually or in combination as a combination of hardware and software, for example as program code that is executed on a microcontroller or microprocessor.

• 1 eine schematische Darstellung einer Ausführungsform der Vorrichtung zum Schätzen von mindestens einer Leistungskennzahl eines Systems;
• 2 ein schematisches Ablaufdiagramm einer Ausführungsform des Verfahrens zum Schätzen von mindestens einer Leistungskennzahl eines Systems;
• 3 a eine schematische Darstellung einer funktionalen Strukturinformation eines Beispielsystems;
• 3b eine schematische Darstellung einer funktionalen Strukturinformation des in 3a gezeigten Beispielsystems mit einer Aufteilung in Hardwarekomponenten und Softwarekomponenten;
• 3c eine schematische Darstellung eines Zustandsdiagramms für das in 3b gezeigte Beispielsystem;
• 4 eine schematische Darstellung einer Abstufung der Funktionsfähigkeit des in 3b gezeigten Beispielsystems;
• 5 eine schematische Darstellung von Aufenthaltswahrscheinlichkeiten des in 3b gezeigten Systems in (gruppierten) Systemzuständen;
• 6a eine schematische Darstellung der Leistungskennzahl für die Zuverlässigkeit des in 3b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre berechnet mittels einer Monte-Carlo-Simulation;
• 6b eine schematische Darstellung der Leistungskennzahl für die Verfügbarkeit des in 3b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre berechnet mittels einer Monte-Carlo-Simulation;
• 6c eine schematische Darstellung der Leistungskennzahl für die Sicherheit des in 3b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre berechnet mittels einer Monte-Carlo-Simulation;
• 7a eine schematische Darstellung einer funktionalen Strukturinformation eines weiteren Beispielsystems;
• 7b eine schematische Darstellung einer funktionalen Strukturinformation des in 7a gezeigten Beispielsystems mit einer Aufteilung in Hardwarekomponenten und Softwarekomponenten;
• 8 eine schematische Darstellung eines Zustandsdiagramms für das in 7b gezeigte Beispielsystem;
• 9 eine schematische Darstellung einer Abstufung der Funktionsfähigkeit des in 7b gezeigten Beispielsystems;
• 10 eine schematische Darstellung der Leistungskennzahl für die Zuverlässigkeit des in 7b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Monte-Carlo-Simulation;
• 11 eine schematische Darstellung der Leistungskennzahl für die Verfügbarkeit des in 3b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Monte-Carlo-Simulation;
• 12 eine schematische Darstellung der Leistungskennzahl für die Sicherheit des in 7b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Monte-Carlo-Simulation;
• 13 eine Tabelle mit sämtlichen Systemzuständen des in 7b gezeigten Beispielsystems zur Verdeutlichung der Ermittlung der Aufenthaltswahrscheinlichkeiten mittels einer Markov-Kette;
• 14 eine schematische Darstellung eines Zustandsdiagramms des in 7b gezeigten Beispielsystems zur Verdeutlichung der Ermittlung der Aufenthaltswahrscheinlichkeiten mittels einer Markov-Kette;
• 15 eine schematische Darstellung der Leistungskennzahl für die Zuverlässigkeit des in 7b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Markov-Kette;
• 16 eine schematische Darstellung der Leistungskennzahl für die Verfügbarkeit des in 7b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Markov-Kette;
• 17 eine schematische Darstellung der Leistungskennzahl für die Sicherheit des in 7b gezeigten Beispielsystems im Zeitverlauf über 10 Jahre, berechnet mittels einer Markov-Kette.

The invention is explained in more detail below on the basis of preferred exemplary embodiments with reference to the figures. Here show:

• 1 a schematic representation of an embodiment of the device for estimating at least one performance indicator of a system;
• 2nd a schematic flow diagram of an embodiment of the method for estimating at least one key performance indicator of a system;
• 3 a a schematic representation of a functional structural information of an example system;
• 3b a schematic representation of a functional structural information of the in 3a shown example system with a division into hardware components and software components;
• 3c is a schematic representation of a state diagram for the in 3b shown example system;
• 4th a schematic representation of a gradation of the functionality of the in 3b shown example system;
• 5 a schematic representation of probabilities of residence of the in 3b shown system in (grouped) system states;
• 6a is a schematic representation of the key performance indicator for the reliability of the in 3b Example system shown over time over 10 years calculated using a Monte Carlo simulation;
• 6b is a schematic representation of the key performance indicator for the availability of the in 3b Example system shown over time over 10 years calculated using a Monte Carlo simulation;
• 6c is a schematic representation of the key performance indicator for the security of the 3b Example system shown over time over 10 years calculated using a Monte Carlo simulation;
• 7a a schematic representation of functional structural information of a further example system;
• 7b a schematic representation of a functional structural information of the in 7a shown example system with a division into hardware components and software components;
• 8th is a schematic representation of a state diagram for the in 7b shown example system;
• 9 a schematic representation of a gradation of the functionality of the in 7b shown example system;
• 10th is a schematic representation of the key performance indicator for the reliability of the in 7b Example system shown over time over 10 years, calculated using a Monte Carlo simulation;
• 11 is a schematic representation of the key performance indicator for the availability of the in 3b Example system shown over time over 10 years, calculated using a Monte Carlo simulation;
• 12th is a schematic representation of the key performance indicator for the security of the 7b Example system shown over time over 10 years, calculated using a Monte Carlo simulation;
• 13 a table with all system states of the in 7b Example system shown to clarify the determination of the probabilities of residence using a Markov chain;
• 14 is a schematic representation of a state diagram of the in 7b Example system shown to clarify the determination of the probabilities of residence using a Markov chain;
• 15 is a schematic representation of the key performance indicator for the reliability of the in 7b Example system shown over time over 10 years, calculated using a Markov chain;
• 16 is a schematic representation of the key performance indicator for the availability of the in 7b Example system shown over time over 10 years, calculated using a Markov chain;
• 17th is a schematic representation of the key performance indicator for the security of the 7b Example system shown over time over 10 years, calculated using a Markov chain.

In 1 is a schematic representation of an embodiment of the device 1 shown to estimate at least one system performance metric. The device 1 comprises an input device 2nd , a calculation device 3rd and an output device 4th .

The entrance facility 2nd receives functional structure information 20 the system, for example in the form of a digitally provided data packet. The functional structure information 20 includes information about individual components of the system and their structural arrangement. The entrance facility 2nd transmits the received functional structure information 20 to the calculation device 3rd .

1. (a) Erzeugen eines mehrere Systemzustände umfassenden Zustandsdiagramms des Systems auf Grundlage der einzelnen Komponenten und deren struktureller Anordnung, wobei die Systemzustände des Systems auf Grundlage von Übergangswahrscheinlichkeitsinformationen zwischen Komponentenzuständen der einzelnen Komponenten miteinander verknüpft werden,
2. (b) Festlegen von Kategorien der mindestens einen Leistungskennzahl und Zuordnen der festgelegten Kategorien zu Systemzuständen des Zustandsdiagramms,
3. (c) Ermitteln von Aufenthaltswahrscheinlichkeitswerten des Systems in den einzelnen Systemzuständen auf Grundlage der Verknüpfungen zwischen den einzelnen Systemzuständen,
4. (d) Ermitteln der mindestens einen Leistungskennzahl für jede der festgelegten Kategorien auf Grundlage der ermittelten Aufenthaltswahrscheinlichkeitswerte.

The calculation device 3rd then does the following:

1. (a) Generating a state diagram of the system comprising a plurality of system states on the basis of the individual components and their structural arrangement, the system states of the system being based on Basis of transition probability information between component states of the individual components are linked to one another,
2. (b) defining categories of the at least one performance indicator and assigning the defined categories to system states of the state diagram,
3. (c) determining the probability of residence values of the system in the individual system states on the basis of the links between the individual system states,
4. (d) determining the at least one key performance indicator for each of the defined categories on the basis of the ascertained probability of residence values.

It can be provided that the transition probability information is also included in the received functional structure information. The functional structure information then contains, for example, transition probabilities or transition probability distributions for transitions between component states of the components. However, it can also be provided that the transition probability information is provided in a different way. For example, provision can also be made for the transition probability information to be queried by a central server or to be provided by a manufacturer of the individual components of the system. Furthermore, it can also be provided that the transition probability information is estimated on the basis of certain types or classes of the components.

The transition probability information can be, for example, transition probabilities or transition probability distributions.

It can be provided that the calculation device 3rd is designed to take into account hardware and software of the components individually when generating the state diagram.

Furthermore, it can be provided that the transition probability information comprises at least one of the components, failure probability information and repair probability information. Accordingly, the state diagram with respect to this component is then direction-dependent, i.e. the affected component can then fail and be repaired again.

In particular, it is provided that the calculation device 3rd is designed to determine and assign categories in step (d) for reliability of the system and / or availability of the system and / or for security of the system.

It can further be provided that the calculation device 3rd is designed to determine the residence probabilities of the system in the individual system states by means of a stochastic process, the transition probability information in each case comprising transition probabilities between component states of the individual components.

Alternatively, it can be provided that the calculation device 3rd is designed to simulate the determination of the residence probabilities of the system in the individual system states by means of a Monte Carlo simulation, the transition probability information in each case comprising transition probability distributions for transitions between component states of the components.

By means of the calculation device 3rd Monte Carlo simulation carried out provides a distribution of the probabilities of stay and / or the at least one key performance indicator as a result of the individual simulation runs. It can be provided that these distributions are evaluated further and, for example, an average and a measure for the variance are determined. The determined mean and the variance are then output accordingly.

It can be provided that the calculation device 3rd is designed in such a way to record state profiles generated by the Monte Carlo simulation when determining the probabilities of residence. For this purpose, the calculation device comprises 3rd or the device 3rd for example an additional memory (not shown) or it becomes a memory area in a memory of the device 1 or the calculation device 3rd reserved for this (not shown).

In a further development it can be provided that the calculation device 3rd is designed to determine an average transition period between system states of the system and / or a frequency of predetermined state profiles on the basis of the recorded status profiles. In particular, the calculation device 3rd determine an average system repair time.

It can be provided that for at least one of the components of the system the associated transition probability information comprises at least two different transition probability distributions and these are taken into account when determining the probabilities of residence.

It can further be provided that the calculation device 3rd is designed to take further conditions into account when determining the probability of residence.

The output device 4th is designed in such a way that the ascertained at least one performance indicator (or the mean value of a corresponding distribution) for each of the defined categories as a performance indicator signal 11 to spend. The performance indicator signal 11 can in particular be output in the form of a digital data packet in which the performance indicators for the defined categories are encoded. Additionally or alternatively, the distributions of the residence probabilities and / or the at least one key performance indicator can also be output.

It can be provided that the key performance indicators are determined and output for several points in time or periods.

In 2nd A schematic flow diagram of an embodiment of the method for estimating at least one key performance indicator of a system is shown. In one step 100 functional structural information of the system is received by means of an input device. In 3a is a schematic representation of such functional structural information 20 shown. The functional structure information 20 forms two structure paths 21 of the system. On these structural paths 21 is a component 22 of the system arranged the components 22 are connected to each other in parallel with a view to reliability.

In the procedural step 101 a state diagram of the system comprising a plurality of system states is generated by means of a calculation device on the basis of the individual components and their structural arrangement, the system states of the system being linked to one another on the basis of transition probability information for transitions between component states of the individual components.

This is shown schematically in the 3b and 3c shown. First the components 22 of the system ( 3a) further broken down into their hardware components 22-1 and their software components 22-2 , so that their behavior can be viewed separately. This then becomes the state diagram 23 generated, which is shown schematically in 3c is shown. Here designate the system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 the individual states that the system can assume. The individual system states are according to the functional structure information 20 ( 3a , 3b) linked with each other via transition probability information.

In the embodiment shown, the link is direction-dependent. The transition probability information thus includes default probability distributions for a failure 24th for each of the hardware components 22-1 and each of the software components 22-2 (see. 3b) and repair probability distributions for a repair 25th for each of the software components 22-2 ( 3b) , since in this embodiment it is assumed that the software components 22-2 yourself in the event of a failure 24th repair yourself.

• Z1: beide Hardwarekomponenten 22-1 und beide Softwarekomponenten 22-2 sind funktionsfähig;
• Z1-1 beide Hardwarekomponenten 22-1 und eine Softwarekomponenten 22-2 sind funktionsfähig, die andere Softwarekomponente 22-1 ist ausgefallen;
• Z1-2: beide Hardwarekomponenten 22-1 sind funktionsfähig, beide Softwarekomponenten 22-1 sind ausgefallen;
• Z2: eine Hardwarekomponente 22-1 ist funktionsfähig, die andere Hardwarekomponente 22-1 ist ausgefallen, sowie automatisch die der ausgefallenen Hardware-Komponente 22-1 zugeordnete Software-Komponente 22-2; somit ist nur noch eine Software-Komponente 22-2 funktionsfähig;
• Z2-1 eine Hardwarekomponente 22-1 ist funktionsfähig, die andere Hardwarekomponente 22-1 und beide Softwarekomponenten 22-2 sind ausgefallen;
• Z3: beide Hardwarekomponenten 22-1 sind ausgefallen.

In particular, the individual system states include Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 the following component states:

• Z1: both hardware components 22-1 and both software components 22-2 are functional;
• Z1-1 both hardware components 22-1 and a software component 22-2 are functional, the other software component 22-1 has failed;
• Z1-2: both hardware components 22-1 are functional, both software components 22-1 were cancelled;
• Z2: a hardware component 22-1 is functional, the other hardware component 22-1 has failed, as well as automatically that of the failed hardware component 22-1 assigned software component 22-2 ; thus it is only a software component 22-2 functioning;
• Z2-1 a hardware component 22-1 is functional, the other hardware component 22-1 and both software components 22-2 were cancelled;
• Z3: both hardware components 22-1 were cancelled.

The system can look within this state diagram 23 move, the failure probability distributions for the failures 24th of the individual components 22-1 , 22-2 and the repair probability distributions for the repairs 25th of the software components 22-2 the transitions between the system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 determine as a function of time, whereby a hierarchical representation has been chosen for the sake of clarity. This means that if a hardware component fails, the system goes to the next lower hierarchical level (e.g. from Z1-1 to Z2-1 ).

In the procedural step 102 categories of the at least one performance indicator are then determined by means of the calculation device. The defined categories are then the individual system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 , Z3 of the state diagram 23 assigned. The categories of reliability, availability and security are provided for the key performance indicators.

The following assignments are provided in the example shown:

The system state Z1 All three categories are assigned, i.e. in this system state Z1 the system is judged to be reliable, available and safe, since all components are functional and there are two parallel structure paths that can solve a given task independently. There is always a possibility of relapse if components fail.

The system states Z1-1 , Z2 the categories reliability and availability are assigned, i.e. in these system states Z1-1 , Z2 the system is assessed as reliable and available (indicated in the 4th with a dotted background). The system is no longer secure because at least one of the components has failed, so that one of the structure paths can no longer solve a given task.

The system states Z1-2 , Z2-1 , Z3 For example, a category "total failure" is assigned because the system is in these system states Z1-2 , Z2-1 , Z3 is no longer functional (indicated in the 4th with a black background).

Since additional consideration is given to whether the system has already failed or not, it is no longer possible to repair the software components after a total system failure in terms of the performance indicator for reliability, that is to say transitions from a system state Z1-2 to a system state Z1-1 or a system state Z2-1 to a system state Z2 are not possible in the "Reliability" category (indicated in 4th with a * symbol). However, this only affects reliability.

In the procedural step 103 become probability of residence values of the system in the individual system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 based on the links between the individual system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 determined.

For this purpose, a Monte Carlo simulation is carried out based on the individual failure probability distributions and repair probability distributions of the components. This takes place under predefined boundary conditions, for example a predefined simulation period that is to be considered. For example, this can be 10 years for which the system is to be simulated.

Alternatively, a predetermined number of kilometers or a predetermined total load can also be provided as a boundary or termination condition for the simulation. In this case, the transition probability distributions of the individual components must be provided in an appropriate form.

In the procedural step 104 For this purpose, starting with a start state of the system, individual drawings are made from the probability of failure distributions and repair probability distributions of the individual components in order to determine when these components fail or have been repaired according to the respective distribution. Depending on the component status of the individual components (functional or failed), the corresponding system status then results Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 and Z3 at any time of simulation. If a specified simulation duration has been reached, the simulation run is ended.

In process step 105 it is checked whether a predetermined number (e.g. 1,000 or 10,000) of simulation runs (iterations) has already been completed or not. If this is not the case, a further simulation run is carried out by repeating the process step 104 . If, on the other hand, the specified number of simulation runs has been reached, the method step is used 106 continued.

Based on the summed times the system was in one of the system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 , Z3 spends, and a respective observation period (e.g. 1, 2, ..., 10 year (s)) can be used for each of the system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 , Z3 a probability of residence 30th of the system in this system state Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 , Z3 be determined.

These probabilities of residence 30th are averaged over all simulated state profiles. The result is schematic and grouped by states in 5 over time 31 shown, whereby cumulative periods are considered in 1-year increments over a total duration of 10 years. You can clearly see that with As time progresses, it is more likely that components of the system will fail. This reduces the system's probability of being in the system state Z1 in this example after 10 years from an original value of 1 to a value of 0.5. A system failure becomes more and more likely over time.

It can also be provided that the distributions generated by means of the Monte Carlo simulation are provided for the probabilities of stay and / or the at least one performance indicator.

It can be in process step 103 be provided for at least one of the components 22-1 , 22-2 of the system, the associated transition probability information comprises at least two different transition probability distributions and these when determining the residence probabilities 30th be taken into account. In this way it is possible, for example, a complex failure behavior of software components 22-2 to reproduce over more than one probability of failure distribution and repair behavior over more than one probability of repair distribution.

In process step 106 become the key performance indicators 32 , 33 , 34 for each of the defined categories based on the determined probability of residence 30th or probability of residence distributions determined. For this purpose, a probability for the existence of the respective category is determined in accordance with the assignment made above. In this example there is a key performance indicator 32 for reliability, a key performance indicator for availability and a key performance indicator 34 security. The course of the individual key performance indicators 32 , 33 , 34 is in the 6a , 6b and 6c over time 31 shown.

In the last step 107 become the key performance indicators 32 , 33 , 34 output for each of the defined categories as a performance indicator signal by means of an output device. This takes place in particular for several points in time or periods (cf. 6a-6c ). The process is then ended. It should be noted that when the initial value is t = 0 years, the reliability, security and availability are the initial values 1 to have.

It can be provided that when determining the probabilities of residence 30th State profiles generated using the Monte Carlo simulation are recorded. These can then be analyzed.

Furthermore, it can be provided that an average transition period between system states Z1 , Z1-1 , Z1-2 , Z2 , Z2-1 , Z3 of the system and / or a frequency of predefined state profiles can be determined on the basis of the recorded state profiles. In particular, for example, an average repair time of the system can be determined using this.

In the 7a and 7b is exemplary functional structural information 20 of another example system. The system comprises two components 22 on two structure paths 21 . However, in contrast to that shown in FIGS 3a and 3b shown embodiment, two parallel software components each 22-2 for each of the structure paths 21 .

Through the software components connected in parallel 22-2 in contrast to that in 3b example shown more system states Z1 , Z1-1 , Z1-2 , Z1-3 , Z1-4 , Z2 , Z2-1 , Z2-2 , Z3 in which the system can be located. The corresponding state diagram 23 is in 8th shown.

• Z1: beide Hardwarekomponenten 22-1 und alle vier Softwarekomponenten 22-2 sind funktionsfähig;
• Z1-1 beide Hardwarekomponenten 22-1 und drei der Softwarekomponenten 22-2 sind funktionsfähig, die vierte Softwarekomponente 22-1 ist ausgefallen;
• Z1-2: beide Hardwarekomponenten 22-1 sind funktionsfähig, zwei Softwarekomponenten 22-1 sind funktionsfähig, zwei Softwarekomponenten 22-1 sind ausgefallen;
• Z1-3: beide Hardwarekomponenten 22-1 sind funktionsfähig, eine Softwarekomponente 22-1 ist funktionsfähig, drei Softwarekomponenten 22-1 sind ausgefallen;
• Z1-4: beide Hardwarekomponenten 22-1 sind funktionsfähig, alle vier Softwarekomponenten 22-1 sind ausgefallen
• Z2: eine Hardwarekomponente 22-1 ist funktionsfähig, die andere Hardwarekomponente 22-1 ist ausgefallen, beide noch relevanten Softwarekomponenten 22-2 sind funktionsfähig;
• Z2-1 eine Hardwarekomponente 22-1 ist funktionsfähig, die andere Hardwarekomponente 22-1 ist ausgefallen, eine Softwarekomponente 22-2 ist funktionsfähig, eine Softwarekomponente 22-2 ist ausgefallen;
• Z2-2: eine Hardwarekomponente 22-1 ist funktionsfähig, die andere Hardwarekomponente 22-1 ist ausgefallen, beide noch relevanten Softwarekomponenten 22-2 sind ausgefallen;
• Z3: beide Hardwarekomponenten 22-1 sind ausgefallen.

In particular, the individual system states include Z1 , Z1-1 , Z1-2 , Z1-3 , Z1-4 , Z2 , Z2-1 , Z2-2 , Z3 the following component states:

• Z1: both hardware components 22-1 and all four software components 22-2 are functional;
• Z1-1 both hardware components 22-1 and three of the software components 22-2 are functional, the fourth software component 22-1 has failed;
• Z1-2: both hardware components 22-1 are functional, two software components 22-1 are functional, two software components 22-1 were cancelled;
• Z1-3: both hardware components 22-1 are functional, a software component 22-1 is functional, three software components 22-1 were cancelled;
• Z1-4: both hardware components 22-1 are functional, all four software components 22-1 were cancelled
• Z2: a hardware component 22-1 is functional, the other hardware component 22-1 has failed, both still relevant software components 22-2 are functional;
• Z2-1 a hardware component 22-1 is functional, the other hardware component 22-1 has failed, a software component 22-2 is functional, a software component 22-2 has failed;
• Z2-2: a hardware component 22-1 is functional, the other hardware component 22-1 has failed, both still relevant software components 22-2 were cancelled;
• Z3: both hardware components 22-1 were cancelled.

The individual system states Z1 , Z1-1 , Z1-2 , Z1-3 , Z1-4 , Z2 , Z2-1 , Z2-2 , Z3 are like the previous example about default probability distributions for failures 24th and repair probability distributions for repairs 25th individual components linked together. The states are again shown hierarchically.

In this example, three categories are again provided for the key performance indicators: reliability, availability and security. This is shown schematically in 9 shown.

If the system has not yet failed, then the system states Z1 , Z1-1 , Z1-2 , Z2 assigned to all three categories, i.e. in these system states Z1 , Z1-1 , Z1-2 , 2nd the system is assessed as reliable, available and safe (indicated in 9 with a white background). If the system has previously failed, these system states are Z1 , Z1-1 , Z1-2 , 2nd only assigned to the categories availability and security.

If the system has not yet failed, the system states Z1-3 and Z2-1 assigned to the categories reliability and availability, that is, in these system states Z1-3 , Z2-1 the system is assessed as reliable and available (indicated in 9 with a dotted background). The system is no longer secure, since only one of the software components is still functional and the system will fail as soon as this software component also fails. If the system has previously failed, this will change to system states Z1-3 , Z2-1 only assigned to the category availability.

The system states Z1-4 , Z2-2 , Z3 is not assigned to any of the categories because the system is in these system states Z1-4 , Z2-4 , Z3 is no longer functional (indicated in 9 with a black background).

Since it is additionally considered whether the system has already failed or not, it is no longer possible to repair the software components after a total failure of the system in terms of the performance indicator for reliability, that is to say transitions from a system state Z1-4 to a system state Z1-3 or a system state Z2-2 to a system state Z2-1 are not possible in the "Reliability" category (indicated in 4th with a * symbol). However, this only affects reliability.

After executing the procedure, the results in the 10th , 11 and 12th curves of the key performance indicator shown 32 for reliability, the key performance indicator 33 for availability and the key performance indicator 34 for security in which it can be seen how the system degrades over time.

In a further embodiment, the probabilities of residence are calculated using a Markov chain by adopting a Markov process. For this all possible error combinations of the in 7b shown system determined and one state defined for each of the error combinations. The result is as a table in 13 shown. In total, this results in a number of 25th different system states, each of the individual hardware components 22-1 and software components 22-2 the component states are functional (= 1) or failed (= 0).

These system states are then examined with regard to possible transitions to other system states. Once all transitions have been defined, a state diagram can be created 23 are formed, which is shown schematically in 14 is shown, the individual transition lines indicating the individual transition probabilities, which are designed as failure probabilities of the components and, in the case of the software components, additionally as repair probabilities of the individual software components.

Based on the state diagram 23 a large number of time profiles of the individual system states are then determined. On the basis of these courses, the system's probabilities of residence in the individual system states are determined and the key performance indicators for the defined categories are determined, which in this example also depict the reliability, availability and security of the system and, as in the example above, the individual system states of the system assigned. The process is repeated several times, so that a large number of status changes (iterations) are generated and distributions for the probabilities of stay or the at least one key performance indicator can be determined from this. Subsequently, mean values etc. can be determined from these distributions.

The key performance indicators 32 , 33 , 34 for the individual categories are in the 15 , 16 and 17th over time 31 represented in hours for a period of 10 years, whereby 15 the key performance indicator 32 for reliability, 16 the key performance indicator 33 for availability and 17th the key performance indicator 34 show for security.

Reference list

1

contraption

2nd

Entrance facility

3rd

Calculation device

4th

Output device

10th

functional structural information

11

Performance indicator signal

20

functional structural information

21st

Structure path

22

component

22-1

Hardware component

22-2

Software component

23

State diagram

24th

failure

25th

repair

30th

(Average) probability of residence

31

time

32

Key performance indicator (reliability)

33

Key performance indicator (availability)

34

Key performance indicator (security)

100-107

Procedural steps

Zx

System state

Claims (10)

Method for estimating at least one performance indicator (32, 33, 34) of a system in a motor vehicle, the system being a device for assisting a driver of the motor vehicle or for semi or fully automated driving of the motor vehicle, comprising the following steps: Receiving functional structural information (20) of the system by means of an input device (2), the functional structural information (20) comprising information on individual components (22) of the system and their structural arrangement and by means of a calculation device (3): (a) generating a state diagram (23) of the system comprising a plurality of system states (Zx) on the basis of the individual components (22) and their structural arrangement, the system states (Zx) of the system being based on transition probability information between component states of the individual components (22) be linked together (b) defining categories of the at least one performance indicator (32, 33, 34) and assigning the defined categories to system states (Zx) of the state diagram (23), (c) determining residence probability values (30) of the system in the individual system states (Zx) on the basis of the links between the individual system states (Zx), (d) determining the at least one performance indicator (32, 33, 34) for each of the defined categories on the basis of the ascertained probability of residence values (30), and Output of the determined at least one performance indicator (32, 33, 34) for each of the defined categories as a performance indicator signal (11) by means of an output device (4). Procedure according to Claim 1 , characterized in that hardware and software of the components (22) are each taken into account individually when generating the state diagram (23). Procedure according to Claim 1 or 2nd , characterized in that the transition probability information comprises at least one of the components (22) failure probability information and repair probability information. Procedure according to one of the Claims 1 to 3rd , characterized in that in step (d) categories for a reliability of the system and / or an availability of the system and / or for a security of the system are defined and assigned. Procedure according to one of the Claims 1 to 4th , characterized in that the determination of the residence probabilities (30) of the system in the individual system states (Zx) is carried out by means of a Monte Carlo simulation, the transition probability information in each case comprising transition probability distributions between component states of the components (22). Procedure according to Claim 5 , characterized in that for at least one of the components (22) of the system, the associated transition probability information comprises at least two different transition probability distributions and these are taken into account when determining the probabilities of stay (30). Procedure according to Claim 5 or 6 , characterized in that when the probabilities of stay (30) are ascertained, state profiles generated using the Monte Carlo simulation are recorded. Procedure according to Claim 7 , characterized in that an average transition period between system states (Zx) of the system and / or a frequency of predetermined state profiles are determined on the basis of the recorded state profiles. Procedure according to one of the Claims 1 - 4th , characterized in that the determination of the residence probabilities (30) of the system in the individual system states (Zx) is carried out by means of a stochastic process, the transition probability information in each case comprising transition probabilities between component states of the individual components (Zx). Device (1) for estimating at least one performance indicator (32, 33, 34) of a system in a motor vehicle, the system being a device for assisting a driver of the motor vehicle or for semi or fully automated driving of the motor vehicle, comprising: an input device (2), the input device (2) being designed in such a way receive functional structural information (20) of the system, the functional structural information (20) comprising information about individual components (22) of the system and their structural arrangement, a calculation device (3), the calculation device (3) being designed to carry out the following steps: (a) generating a state diagram (23) of the system comprising a plurality of system states (Zx) on the basis of the individual components (22) and their structural arrangement, the system states (Zx) of the system being based on transition probability information between component states of the individual components (22) be linked together (b) defining categories of the at least one performance indicator (32, 33, 34) and assigning the defined categories to system states (Zx) of the state diagram (23), (c) determining residence probability values (30) of the system in the individual system states (Zx) on the basis of the links between the individual system states (Zx), (d) determining the at least one performance indicator (32, 33, 34) for each of the defined categories on the basis of the ascertained probability of residence values (30), and an output device (4), the output device (4) being designed in such a way to output the determined at least one performance indicator (32, 33, 34) as a performance indicator signal (11) for each of the defined categories.

Images