DE10220811B4 - Method and device for monitoring the functioning of a system - Google Patents

Abstract

Method for monitoring the functioning of a system (1) by checking input signals, output signals and at least one functional unit of the system (1), the system (1) having at least one subordinate subsystem and / or being part of a higher-level system (6), and the system (1) comprises hardware-implemented components comprising sensors (4), actuators (5) and / or function computers (2), wherein a function of the system (1) as intended is hierarchically subdivided into at least one function of the complexity of the function Subsystem function and this in turn into at least one functional unit and the method is structured in: - a first monitoring layer (Ü0), in which one of the functional units of the system (1) is checked taking into account input signals and / or output signals of the functional unit; - One of the first monitoring layer (Ü0) superior second monitoring layer (Ü1), in which the functional unit is additionally checked in consideration of input signals and / or output signals of the functional unit associated subsystem; and - at least one of the second monitoring layer (Ü1) has a further, additional monitoring layer (Ü2 ... Ün), in which the functional unit is additionally checked in consideration of input signals and / or output signals of the system (1).

Description

State of the art

The present invention relates to a method for monitoring the operation of a system by checking input signals, output signals and at least one functional unit of the system. The system has at least one subordinate subsystem and / or is part of a higher-level system. The system has hardware-implemented components comprising sensors, actuators and / or function computers.

The invention also relates to a memory element for a device for monitoring the operation of a system. On the storage element, a computer program is stored, which is executable on a computing device, in particular on a microprocessor. The memory element is designed, for example, as a read-only memory as a random access memory or as a flash memory.

Furthermore, the present invention relates to a computer program executable on a computing device, in particular on a microprocessor.

Finally, the invention relates to a device for monitoring the operation of a system having at least one subordinate subsystem and / or is part of a higher-level system. The system has hardware-implemented components comprising sensors, actuators and / or function computers. The apparatus has means for checking input signals, output signals and at least one functional unit of the system.

The term system in the sense of the present invention, for example, any control device, in particular a motor vehicle control unit understood. The system is designed, for example, as a control unit for an electric battery management (EBM). It comprises subsystems that are designed, for example, as a computer unit, as an ASIC (Application Specific Integrated Circuit) or as a current sensor. In addition, the system includes units configured, for example, as an EBM algorithm or as a battery replica, and parts including, for example, calculating a generator setpoint voltage or any mathematical or trigonometric functions. The EBM control unit is part of a higher-level system in the form of the motor vehicle. In addition to the EBM control unit are in the motor vehicle a variety of other systems, eg. B. engine control unit and transmission control unit provided.

To ensure proper operation of a system, it is known in the art to resort to the monitoring of input signals, output signals, and functional units of the system. From the DE 41 14 999 A1 a method for monitoring the operation of a force control device is known. In a microcomputer of the controller, the intended function of the controller is performed. In parallel, the same intended function is carried out at least partially in a monitoring device. The output signals of the microcomputer and the monitoring device are compared with each other and determined depending on the result of the comparison, whether the controller is working properly or not. If a faulty functioning of the control unit is detected, corresponding replacement measures are carried out. The monitoring method proposed in this document is strongly oriented to the hardware of the system to be monitored and very inflexible. The monitoring method proposed in the document can not simply be carried out in another control unit with another intended function. On the contrary, the monitoring procedure running in the monitoring device must be completely revised and adapted to the changed function of the other control device. This may include a structural revision of the monitoring process

From the DE 44 38 714 A1 a method for monitoring the operation of a control device is known. A microcomputer of the controller is divided into a functional level, a monitoring level and a control level. In the functional level, the intended function of the control unit is executed. In the monitoring level, the executed function is checked, for example, by means of a threshold comparison or a plausibility check. In the monitoring level, the (entire) intended function of the control unit is not executed, but only targeted monitoring functions are performed. Nevertheless, in order to be able to detect a faulty functioning of the system with sufficient reliability, the additional control level is provided, in which a check of the hardware-implemented components (eg the memory elements or the microprocessor) of the system is tested and by means of a question-answer communication correct functioning of the microcomputer can be checked. Even with the monitoring method proposed in this document, it is disadvantageous that the structure of the method is based on the hardware of the system to be monitored and is very inflexible. In order to be able to transfer the monitoring procedure to another control unit with another intended function, Also, the monitoring procedure proposed in this document must first be completely revised and adapted to the new hardware and software conditions. This is however complicated and expensive.

The structure of the method of monitoring the operation of a system, which is known from these two publications, is based solely on the hardware of the system and is independent of the complexity of the function that is performed by the system to be monitored. If the monitoring method described in these documents is used to monitor functions with a high degree of complexity, the method would theoretically be structured in the same way as stated in the publications. However, due to the increasing complexity of the function intended by the system to be monitored, the structure of the monitoring method also becomes more complex and increasingly unclear. The monitoring concepts described in the publications are thus not suitable for complex functions. In particular, in the case of an error case, the error occurring in the known monitoring concepts can not be assigned to a specific function of the system. This significantly complicates both the fault diagnosis and the selection of a suitable replacement function.

From the WO 99/26820 A1 and the WO 97/33083 A1 For example, methods for monitoring control systems of a motor vehicle based on input and output signals are known.

The present invention is therefore based on the object to provide a generally valid concept for monitoring and diagnosis of systems that can be transferred to other systems without much effort.

To achieve this object, the present invention proposes, starting from the method of the type mentioned above, that a function of the system is subdivided hierarchically as a function of the complexity of the function into at least one subsystem function and this in turn into at least one functional unit and that structure the method is in:
a first monitoring layer in which one of the functional units of the system is checked in consideration of input signals and / or output signals of the functional unit;
a second monitoring layer which is superordinate to the first monitoring layer and in which the functional unit is additionally checked in consideration of input signals and / or output signals of the subsystem assigned to the functional unit; and
at least one further monitoring layer which is superordinate to the second monitoring layer and in which the functional unit is additionally checked in consideration of input signals and / or output signals of the system.

Advantages of the invention

The monitoring method proposed according to the invention has a modular structure and can thus be easily expanded and used to monitor a wide variety of different complex systems. The structure of the monitoring method according to the invention basically does not distinguish between hardware and software implementation of the functions of the system to be monitored and is therefore universally applicable. The structure of the monitoring method according to the invention is based purely on the functional units of the system and therefore also depends on the complexity of the function that is intended to be performed by the system to be monitored (eg control or regulation functions).

The modularity and the structuring of the monitoring method according to the invention overall result in a clear, understandable structure of the monitoring method and ultimately a greater customer acceptance. In addition, errors that occur can be assigned to specific monitoring layers more easily and unambiguously, and even to different functional units within the monitoring layers. This is achieved by decoupling errors from different functional units of the same monitoring layer. This can significantly simplify and speed up the search for the cause of a fault. It also improves the accuracy and reliability of debugging. The present invention thus relates to a particularly advantageous vertical structuring of a monitoring method for a system.

As the monitoring of the functions in the individual monitoring layers has to be made concrete, is limited in any way by the monitoring method according to the invention. The hardware-implemented components can be monitored, for example, via a watchdog, a core test or another monitoring module.

The intended function of the system to be monitored is subdivided into a plurality of functional layers as a function of the complexity of the function. At the top, the actual system function is provided. The system function is, for example, an electronic battery management (EBM) function. The system function is subdivided into at least one subsystem function, for example as the Function of a microcomputer or a current sensor is formed. In the selected examples, the system function and the subsystem function are implemented in hardware. However, it is quite conceivable to also choose software-implemented examples for these functions.

The subsystem function is in turn subdivided into at least one functional unit, which is designed as a software functionality (eg battery simulation, quiescent current management (RSM) or dynamic energy management (DYN)) or as hardware functionality (eg current measurement, voltage measurement) is. Depending on the complexity of the intended function of the system, this subdivision can be continued as desired by the insertion of further functional layers. Thus, a functional unit can still be subdivided into at least one partial function, which in the example of the dynamic energy management can be designed as a simple mathematical or trigonometric function or as a generator setpoint voltage calculation.

Starting from the first monitoring layer, the complexity of monitoring increases from layer to layer. In the first monitoring layer, a functional unit of the system is monitored on the basis of input signals and / or output signals of the viewing unit, ie on the basis of the functional unit under consideration. In the second monitoring layer, the functional unit is additionally monitored on the basis of input signals and / or output signals from further functional units within the subsystem to which the considered functional unit is assigned. In the third monitoring layer, the functional unit of the system is additionally monitored by means of input signals and / or output signals of further subsystems within the system.

If the system function has further functional layers below the first functional layer (eg sub-functions below the functional units), a partial function of the system is monitored in the first monitoring layer on the basis of input signals and / or output signals of the viewing unit, ie on the basis of the partial function under consideration. In the second monitoring layer, the subfunction of the system is additionally monitored on the basis of input signals and / or output signals of further subfunctions within the functional unit to which the subfunction under consideration is assigned. In the third monitoring layer, the subfunction is additionally monitored on the basis of input signals and / or output signals from further functional units within the subsystem to which the subfunction under consideration is assigned. In a further fourth monitoring layer, the subfunction is additionally monitored on the basis of input signals and / or output signals of further subsystems within the system. Thus, the more complex the structure of the function of the system, the more complex the structure of the monitoring method according to the invention.

According to an advantageous development of the present invention, it is proposed that the functional unit be checked by checking the input signals and / or output signals of the functional unit, the subsystem and / or the system for exceeding of a maximum value or below a minimum value and / or by the gradient of Input signals and / or output signals to exceeding a maximum value or below a minimum value is checked.

According to a preferred embodiment of the invention, it is proposed that the functional units of the system to be monitored be subdivided into safety-relevant functional networks whose faulty functioning constitutes a safety risk which is above a predefinable limit risk and is subdivided into further functional networks whose faulty functioning represents a safety risk which is smaller or equal to the limit risk.

For safety-related functional networks is a sufficiently fast and sufficiently safe response, eg. As the introduction of a replacement function or a suitable shutdown strategy, required to ensure the safety of the system. In the case of the other functional networks, there is sufficient time to react accordingly, or, if the replacement functions fail, there is no state threatening the safety of the system.

According to a further preferred embodiment of the invention, it is proposed that replacement measures be selected depending on whether a functional unit of a safety-relevant functional network or of a further functional network has an erroneous mode of operation in the event of a faulty functioning of a functional network.

The replacement measures preferably include an emergency operation and / or an emergency shutdown of an affected hardware-implemented component, an affected function and / or the affected system.

The method according to the invention is advantageously applied to all functional units of the system. That is, each functional unit of the system is checked by a monitoring method structured in the manner described. This way a can reliable statement about how the entire system works.

Preferably, proper functioning of the system is determined when all functional units of the system are functioning properly. Thus, as soon as one of the functional units checked does not function properly, the entire system is detected as being faulty. In the event of an error, a suitable replacement measure is selected and executed. The replacement action may be performed in addition to or instead of the function of the erroneous consideration unit (functional unit).

Of particular importance is the realization of the method according to the invention in the form of a memory element which is provided for a device for monitoring the functioning of a system. In this case, a computer program is stored on the memory element, which is executable on a computing device, in particular a microprocessor, and suitable for carrying out the method according to the invention. In this case, the invention is thus realized by a computer program stored on the memory element, so that this memory element provided with the computer program represents the invention in the same way as the method which the computer program is suitable for executing. In particular, an electrical storage medium can be used as the storage element, for example a read-only memory, a random access memory or a flash memory.

As yet another solution of the object of the present invention is proposed starting from the computer program of the type mentioned that the computer program is suitable for carrying out the method according to the invention, when it runs on the computing device. It is particularly preferred if the computer program is stored on a memory element, in particular on a read-only memory, a random access memory or a flash memory.

• – Mittel einer ersten Überwachungsschicht, welche eine der Funktionseinheiten des Systems unter Berücksichtigung von Eingangssignalen und/oder Ausgangssignalen der Funktionseinheit überprüfen;
• – Mittel einer der ersten Überwachungsschicht übergeordneten zweiten Überwachungsschicht, welche die Funktionseinheit zusätzlich unter Berücksichtigung von Eingangssignalen und/oder Ausgangssignalen des der Funktionseinheit zugeordneten Subsystems überprüfen; und
• – Mittel mindestens einer der zweiten Überwachungsschicht übergeordneten weiteren Überwachungsschicht, welche die Funktionseinheit zusätzlich unter Berücksichtigung von Eingangssignalen und/oder Ausgangssignalen des Systems überprüfen.

Finally, it is proposed as a still further solution of the object of the present invention proceeding from the device of the type mentioned above that a function of the system according to its intended function is subdivided hierarchically into at least one subsystem function and this in turn into at least one functional unit in that the device comprises:

• - means of a first monitoring layer, which check one of the functional units of the system taking into account input signals and / or output signals of the functional unit;
• - means of the first monitoring layer superordinate second monitoring layer, which additionally check the functional unit, taking into account input signals and / or output signals of the subsystem associated with the functional unit; and
• - means of at least one of the second monitoring layer superordinate further monitoring layer, which additionally check the functional unit, taking into account input signals and / or output signals of the system.

The means of the various layers can be realized in terms of hardware or software. They include, for example, a watchdog, a core test or another monitoring module. It would also be conceivable that the means comprise comparators in order to check the various input signals and / or the output signals for exceeding of a maximum value or below a minimum value. In addition, the means may comprise gradient-forming means, the comparators then checking the gradients of the input signals and / or output signals for exceeding of a maximum value or below a minimum value.

drawings

Other features, applications and advantages of the invention will become apparent from the following description of exemplary embodiments of the invention, which are illustrated in the drawing. All described or illustrated features, alone or in any combination form the subject matter of the invention, regardless of their summary in the claims or their dependency and regardless of their formulation or representation in the description or in the drawing. Show it:

1 a structure of a system that is monitored by means of the monitoring method according to the invention;

2 a structure of a monitoring method according to the invention according to a first preferred embodiment;

3 a structure of a monitoring method according to the invention according to a second preferred embodiment;

4 a functional diagram for a first monitoring level of the method according to the invention;

5 a functional diagram for a second monitoring level of the method according to the invention;

6 a functional diagram for a third monitoring level of the method according to the invention;

7 a functional diagram for a fourth monitoring level of the method according to the invention; and

8th a control device for carrying out the monitoring method according to the invention.

Description of the embodiments

The present invention relates to a monitoring method for monitoring the operation of any system, wherein the monitoring method is vertically structured depending on the complexity of the intended function of the system to be monitored. The intended function of the system is, for example, a control or regulating function. The structuring proposed according to the invention is independent of the hardware of the system and extremely flexible.

The intended function of the system to be monitored 1 is considered decomposed into its elements. As a functional element, the smallest unit becomes the function of the system 1 referred to, which - if necessary - is monitored by a monitoring function ÜF. However, the monitoring does not have to be done in the smallest units, but can also be done on modules that consist of several functional elements.

In 1 is a superordinate system in the form of a motor vehicle denoted by A. The superordinate system A comprises various systems, including an electric battery management (EBM) controller, which is designated AA. In addition to the EBM control unit AA is still another system AB component of the motor vehicle A. The other system AB is bpsw. designed as an engine or as a transmission control unit. The EBM control unit AA is subdivided into two subsystems AAA and AAB, for example as a computing device 2 (see. 8th ) or as a storage element 3 are formed. The further system AB is divided into subsystems ABA and ABB.

The subsystems AAA, AAB are in turn divided into several units AAAA, AAAB, AABA, AABB. The same applies to the subsystems ABA and ABB of the other system AB. The units AAAA, AAAB, AABA, AABB are designed, for example, as quiescent current management (RSM) or as dynamic energy management (DYN).

The units AAAA, AAAB, AABA, AABB are in turn divided into different parts. The unit AAAA is divided into the parts AAAAA, AAAAB and AAAAC and the unit AAAB into the parts AAABA, AAABB and AAABC. Likewise, the AABA unit is subdivided into parts AABAA, AABAB and AABAC and the unit AABB into Parts AABBA, AABBB and AABBC. The same applies to the units ABAA, ABAB, ABBA and ABBB of the subsystems ABA and ABB of the other system AB. The units include, for example, a generator voltage calculation.

The intended function of the system AA to be monitored is thus subdivided into a plurality of functional layers as a function of the complexity of the function. At the very top is the actual system function (in the system AA). The system function is, for example, an electronic battery management (EBM) function. The system function is subdivided into at least one subsystem function (in the subsystems AAA and AAB), which is embodied, for example, as the function of a microcomputer or of a current sensor. The subsystem functions are in turn subdivided into at least one functional unit (in the units AAAA, AAAB, AABA and AABB), which is embodied, for example, as a software functionality (battery simulation, closed-circuit power management or dynamic power management). Depending on the complexity of the function of the system, this subdivision can continue indefinitely. Thus, a functional unit may still be divided into at least one subfunction (in the parts AAAAA, AAAAB, AAAAC, AAABA, AAABB, AAABC, AABAA, AABAB, AABAC, AABBA, AABBB and AABBC) which in the example of dynamic power management is considered to be a simple one trigonometric function or is designed as a generator setpoint voltage calculation.

In this functional structuring of the intended function of the system AA, AB begins the inventive method. In 2 a layer model is shown with different monitoring layers of a monitoring method according to the invention according to a first preferred embodiment. Starting from a (lower) first monitoring layer U0, the complexity of the monitoring increases from layer to layer. The consideration of the method according to the invention is based on a specific unit of the system AA; in the present case this is the subfunction AAABA (cf. 4 ). In the first monitoring layer U0, the subfunction AAABA is determined based on input signals 6 and or output signals 8th This subfunction AAABA is checked by a monitoring function ÜF AAABA assigned to this subfunction AAABA.

In one of the first monitoring layer Ü0 superior second monitoring layer Ü1 (see. 5 ), the subfunction AAABA is additionally based on input signals 8th and / or output signals 9 is checked by a further subfunction AAABB that functional unit AAAB, which is associated with the considered subfunction AAABA. The further subfunction AAABB is part of the same functional unit AAAB as the considered subfunction AAABA.

In one of the second monitoring layer Ü1 parent third monitoring layer Ü2 (see. 6 ), the subfunction AAABA is additionally based on input signals 10 and / or output signals 11 is checked by another functional unit AAAA than that functional unit AAAB, which is assigned the considered subfunction AAABA. The functional unit AAAA is part of the subsystem AAA, to which the considered subfunction AAABA is also assigned.

In one of the third monitoring layer Ü2 superior fourth monitoring layer Ü3 (see. 7 ), the subfunction AAABA is additionally based on input signals 12 and / or output signals 13 is checked by a subsystem AAB other than subsystem AAA, to which the considered subfunction AAABA is assigned. The subsystem AAB is part of the system AA, to which the considered subfunction AAABA is also assigned.

Monitoring processes that are run through by a plurality of monitoring function ÜF can be provided centrally for these monitoring functions ÜF. As a result, these monitoring processes are for z. B. a fault memory entry all monitoring functions ÜF available. The individual monitoring functions ÜF check certain basic functionalities (eg operating overvoltage detection) of the functional units and can be reused without much effort for other monitoring functions ÜF. It would be conceivable, for example, that a communication protocol of a monitoring function ÜF, via which the various monitoring functions ÜF exchange data with each other, is reused for other monitoring functions ÜF.

The monitoring method according to the invention can be implemented on any system 1 be used. Any errors that occur are decoupled from the various functional units of the same monitoring layer. When looking for the causes of errors, the sources of error can be determined more easily. The monitoring method according to the invention enables an easier, unambiguous assignment of errors to the individual monitoring layers and thus to the functional units of the system 1 , Since only input signals and / or output signals are monitored in each monitoring layer, a total of fewer error sources are available due to the monitoring in comparison to the prior art, which ultimately can also be determined more simply and accurately.

The minimum requirement for monitoring a system 1 is that can be detected when the system 1 no longer specified. Ideally, it should also be able to ensure that the system 1 also specified when errors occur. This presupposes that there are redundancies which, for reasons of cost, are generally only realized in the case of systems classified as safety-relevant. For all other systems 1 Therefore, the monitoring is usually limited to recognizing when the system is 1 no longer behaves as specified.

Specification in this context means the sum of all requirements that are placed on a system. Requirements can z. "Fail-safe" (fault-tolerance), "functional safety" (functional safety) or "control unit fully functional for operating voltages between 6 volts and 20 volts" be. Since these requirements differ for each system, a generally valid monitoring concept is characterized by the fact that it is flexibly applicable to different systems with different requirements. This requires a corresponding functional structure that allows the monitoring components to be used for different systems, even if they meet different requirements (in terms of security).

The monitoring of the system 1 runs parallel to the intended function of the system 1 and may this, z. B. by consumption of computing capacity, not restrict in its execution. On the results of the monitoring (possibly error) the system can 1 react immediately. In addition, errors can be stored permanently and used immediately or later for error analysis.

The diagnosis is the part of the monitoring that is usually retrievable in a workshop via a corresponding diagnostic tester. Including z. B. the ability to perform stored errors analysis. This requires a suitable interface. This interface is based on a standardized protocol and allows to control a suitable diagnostic tester. Thus, a bidirectional data flow between the controller and the diagnostic tester is possible.

• a) einen Fehlerspeicher auszulesen und zu löschen,
• b) Ausgangssignale ausgewählter Funktionen auszulesen (z. B. Sensorgrößen),
• c) Eingangssignale ausgewählter Funktionen in ihrem Wert zu ändern (z. B. zur Ansteuerung eines Aktors) und
• d) steuergerätespezifische Daten zu speichern (z. B. eine Seriennummer).

The diagnosis offers the possibility:

• a) read out and clear a fault memory,
• b) read out output signals of selected functions (eg sensor sizes),
• c) to change the value of the input signals of selected functions (eg to control an actuator) and
• d) to store ECU-specific data (eg a serial number).

In addition, the diagnosis includes the computation of so-called history data, that is to say data series which are collected over longer periods of time and required for the analysis of the system behavior (development-supporting data). The history data is not required for the function of the system.

According to the invention, the components of the system 1 classified in a special way (cf. 1 ). There is no distinction between the way in which the component is realized (hardware or software). Rather, the components of the system 1 classified solely depending on their functionality.

In 3 a layer model with different monitoring layers of a monitoring method according to the invention according to a second preferred embodiment is shown. Starting from a (lower) first monitoring layer U0, the complexity of the monitoring increases from layer to layer. The consideration of the method according to the invention is based on a specific unit of the system AA; in the present case, this is one of the functional units AAAA, AAAB, AABA, AABB.

In the case of this layer model, the considered functional unit AAAA, AAAB, AABA or AABB is checked in the first monitoring layer U0 taking into account input signals and / or output signals of this functional unit by a monitoring function UF assigned to this functional unit. In one of the first monitoring layer Ü0 superior second monitoring layer Ü1 the considered functional unit AAAA, AAAB, AABA or AABB is additionally checked taking into account input signals and / or output signals of that subsystem AAA or AAB, which is associated with the considered functional unit. In a third monitoring layer Ü2, which is superordinate to the second monitoring layer Ü1, the considered functional unit AAAA, AAAB, AABA or AABB is additionally monitored taking into account input signals and / or output signals of the system AA to which the considered functional unit is assigned and whose functionality is to be checked. If all the monitored AAAA, AAAB, AABA and AABB functional units of the AA system have been found to function properly, it is inferred that the AA system as a whole is OK.

In 8th is a system designed as a control unit 1 illustrated, the operation of which can be monitored by the method according to the invention. The control unit 1 includes a memory element 3 , which is preferably designed as an electrical storage medium, in particular as an erasable and programmable read-only memory (EPROM). On the storage element 3 a computer program is stored, which is suitable for carrying out the monitoring method according to the invention, when it is on a computing device 2 of the control unit 1 expires. The computing device 2 is designed in particular as a microprocessor. To run the computer program on the computing device 2 the program is executed either as a whole or as a command from the memory element 3 to the computing device 2 transfer.

In the computer program, in particular, the vertical structuring of the monitoring method according to the invention is implemented in such a way that the method is dependent on the complexity of the system 1 is divided into several monitoring layers Ü0, Ü1, Ü2 ... Ün.

The control unit 1 receives input signals from sensors 4 and gives output signals to actuators 5 out. The output signals are in the context of the execution of a control and / or regulation program in the microprocessor 2 in fulfillment of the intended function of the control unit 1 generated. The control program may also be in the memory element 3 of the control unit 1 be stored and for processing as a whole or befehlsweise in the microprocessor 1 getting charged. The control and / or regulating program and the computer program for carrying out the monitoring method according to the invention can be combined to form a common program.

Claims (11)

Method for monitoring the functioning of a system ( 1 ), by input signals, output signals and at least one functional unit of the system ( 1 ), the System ( 1 ) has at least one subordinate subsystem and / or is part of a higher-level system ( 6 ), and the system ( 1 ) hardware implemented components comprising sensors ( 4 ), Actuators ( 5 ) and / or function computer ( 2 ), whereby an intended function of the system ( 1 ) is subdivided hierarchically into at least one subsystem function depending on the complexity of the function, and this in turn is structured into at least one functional unit and the method is structured in: a first monitoring layer (U0) in which one of the functional units of the system ( 1 ) is checked in consideration of input signals and / or output signals of the functional unit; - One of the first monitoring layer (Ü0) superior second monitoring layer (Ü1), in which the functional unit is additionally checked in consideration of input signals and / or output signals of the functional unit associated subsystem; and - at least one further monitoring layer (Ü2 ... Ün), at least one of the second monitoring layer (Ü1), in which the functional unit additionally takes into account the input signals and / or output signals of the system ( 1 ) is checked. A method according to claim 1, characterized in that the functional unit is checked by the input signals and / or output signals of the functional unit, the subsystem and / or the system are checked for exceeding of a maximum value or below a minimum value and / or by the gradient of the input signals and / or output signals to exceeding a maximum value or below a minimum value is checked. Method according to claim 1 or 2, characterized in that the functional units of the system to be monitored ( 1 ) in safety-relevant functional networks whose faulty functioning represents a security risk that is above a specifiable border risk and is subdivided into further functional networks whose incorrect functioning represents a security risk that is less than or equal to the border risk. A method according to claim 3, characterized in that are selected in a faulty functioning of a function network replacement measures depending on whether a functional unit of a safety-related function network or another functional network has a faulty operation. A method according to claim 4, characterized in that the replacement measures comprise an emergency operation and / or an emergency shutdown. Method according to one of claims 1 to 5, characterized in that the method is applied to all functional units of the system ( 1 ) is applied. Method according to claim 6, characterized in that a proper functioning of the system ( 1 ) is detected when all functional units of the system are functioning properly. Memory element ( 3 ) for a device for monitoring the functioning of a system ( 1 ), on which a computer program stored on a computing device ( 2 ) executable and suitable for carrying out a method according to one of claims 1 to 7. Computer program running on a computing device ( 2 ) is executable, wherein the computer program is suitable for carrying out a method according to one of claims 1 to 7 when it is stored on the computing device ( 2 ) expires. Computer program according to claim 9, characterized in that the computer program is stored on a memory element ( 3 ), in particular on a read-only memory, a random access memory or a flash memory is stored. Device for monitoring the functioning of a system ( 1 ), which has at least one subordinate subsystem and / or component of a higher-level system ( 6 ) and the hardware implemented components comprising sensors ( 4 ), Actuators ( 5 ) and / or function computer ( 2 ), and wherein the device comprises means for checking input signals, output signals and at least one functional unit of the system ( 1 ), whereby an intended function of the system ( 1 ) is subdivided hierarchically into at least one subsystem function depending on the complexity of the function and this in turn into at least one functional unit and the device comprises: - means of a first monitoring layer (Ü0), which is one of the functional units of the system ( 1 ), taking into account the input signals and / or output signals of the functional unit; - means of a first monitoring layer (Ü0) superordinate second monitoring layer (Ü1), which additionally check the functional unit taking into account input signals and / or output signals of the subsystem associated with the functional unit; and - means of at least one of the second monitoring layer (Ü1) superordinate further monitoring layer (Ü2 ... Ün), which the functional unit additionally taking into account Input signals and / or output signals of the system ( 1 ) to verify.

Images