WO2016162624A1

WO2016162624A1 - Method for implementing a motor vehicle function in accordance with standard asil levels, corresponding system, and motor vehicle including such a system

Info

Publication number: WO2016162624A1
Application number: PCT/FR2016/050768
Authority: WO
Inventors: Paul Degoul; Michel LEEMAN
Original assignee: Valeo Equipements Electriques Moteur
Priority date: 2015-04-07
Filing date: 2016-04-05
Publication date: 2016-10-13
Also published as: FR3034882B1; FR3034882A1

Abstract

The invention relates to a method which makes it possible to implement a motor vehicle function in accordance with standard ASIL levels corresponding to increasing safety requirement levels QM, A, B, C, and D, such as those defined by the ISO 26262 standard. The method implements said function using a first safety requirement level by at least means (12, 13, 14) having a second safety requirement level that is lower than said first safety requirement level. In accordance with the invention, for a design variant with less than four means (12, 13, 14), the first safety requirement level is rated D or C and the second safety requirement level is rated B, A or QM.

Description

METHOD FOR IMPLEMENTING A FUNCTION OF A MOTOR VEHICLE IN ACCORDANCE WITH STANDARD ASIL LEVELS, CORRESPONDING SYSTEM AND MOTOR VEHICLE COMPRISING SUCH AS

SYSTEM

TECHNICAL FIELD OF THE INVENTION

The present invention relates to a method for implementing a function of a motor vehicle conforming to standard ASIL levels ("Automotive Security Integrity Level" in English terminology, ie "Level of requirement in terms of Automotive Safety ").

The invention also relates to a system capable of implementing this method, as well as the motor vehicle comprising this system.

BACKGROUND ART OF THE INVENTION.

The recent development of autonomous vehicles (levels of automation 4 and 5 as defined by the Society of Automotive Engineers (SAE)) requires fail operational systems ("fail operational") instead of conventional systems in automotive safety critical applications that require only passive fail-safe systems.

A fail-safe system maintains its functionality or at least reduced functionality in the event of any simple failure.

A fail-operational system requires a redundant data bus and power supplies as well as a redundant electronic computing unit (ECU or "Electronic Computing Unit" in English terminology).

A possible hardware architecture for realizing a fail-safe electronic computing unit is known as Duplex - Double architecture, and its use is common in avionics.

A Duplex-Dual architecture may be two classic passive after-failure ECUs in a car and a switch, as shown in Figure 1.

The two ECUs can be based for example on the use of a synchronous double-core microcontroller said LSDC (acronym for "Lock Step Dual Core" in English terminology). When a status of the first electronic computing unit is functional, the output data is that provided by the first electronic computing unit. When the status of the first electronic computing unit is non-functional, i.e., it fails, the output data is that provided by the second electronic computing unit. The status of the second electronic computing unit is used to report the hidden errors, when it is not operational, and is no longer able to take over the failure of the first electronic computing unit. . In the case of multiple output data, the switch is a switch network.

With regard to software, the ISO 26262 standard establishes a formal framework for the functional safety of modules in the automotive industry. The ISO 26262 standard states that the software's "safety" must be systematically taken into account throughout the software development cycle.

An ASIL is assigned on the basis of the risk of the occurrence of a hazardous event taking into account the periodicity of the situation, the impact of any damage, and to what extent this situation can be controlled and managed.

The ISO 26262 standard defines four ASILs indicated by letters from A to D, the latter corresponding to the lowest risk and the highest security requirement level. A level of security requirement indicated by QM ("Quality Management" ie "Quality Management") is assigned to non-critical functions.

Many autonomous vehicle functions will have at least two contradictory ASIL D security constraints. On the one hand, an erroneous decision will be ASIL D, and, on the other hand, the loss of the function will also ASIL D.

To satisfy a correct decision at the ASIL D level, the implementation of the function in both ECUs will require either that the software be developed at the ASIL D level, or will require an ASIL decomposition, as defined in the ISO 26262 standard. of an ASIL decomposition, two redundant modules developed at a lower level of criticality can be implemented in both ECUs. Developing a complex application software at the ASIL D level is not the strategy generally adopted in an automotive industrial development, for reasons of cost and development time. Therefore, an ASIL decomposition leading to lower ASILs will be preferred at least for application software. However, an ASIL decomposition requires a redundant and diverse implementation. In these conditions, whatever the hardware architecture chosen to realize the passive electronic computing units after failure, two different algorithms will be necessary in order to ensure the independence between the two redundant modules implemented in each ECU, otherwise the ASIL decomposition to reduce the ASIL is not allowed by ISO 26262.

Furthermore, to satisfy the availability constraint in the event of a simple failure, the software modules implemented in each of the electronic computing units of a Duplex-Double architecture must also have diversity.

If this were not the case, a systematic error affecting one of the two redundant algorithms in one of the two passive ECUs after failure would also affect the other ECU. If this error was activated on one of the ECUs, it would be activated simultaneously on the other, because the input data of the two ECUs are the same, and therefore, the two ECUs would fail simultaneously, not satisfying this fact. the availability constraint. Since the fundamental reason for the failure is an error of a weaker ASIL software, this is not acceptable.

This means that for a function subject to two conflicting ASIL D (or C) security constraints, one relating to the validity of the output data, and the other to the availability of this output data, when a Duplex- Double is used, four different software modules will be needed as shown in Figure 2. But in many cases, it is not possible to satisfy the software diversity requirement, that is, it does not It is not possible to find four different algorithms for the same function.

It is obviously easier to develop a system, or subsystem, qualified as ASIL B rather than ASIL D.

As a result, cost and pragmatic incentives lead to placing all or part of a project at the lowest possible level in the ASIL scale, while aiming for the highest possible global qualification.

For example, the patent application US20150057908 discloses an engine control unit performing qualified safety functions at an ASIL B level by means of a microcontroller qualified at a level ASIL B and a qualified integrated circuit at a level QM.

The ASIL decomposition disclosed in this application does not seem to be able to be transposed to a Duplex-Double architecture, as described above, to be qualified at a level ASIL D or ASIL C.

There is therefore a need for a technical solution to qualify this architecture at these high ASIL levels using a qualified implementation at a lower level, while limiting the design diversity.

GENERAL DESCRIPTION OF THE INVENTION

The present invention therefore aims to satisfy this need.

It relates specifically to a method of implementing a function of a motor vehicle conforming to standard ASIL levels corresponding to increasing security requirements levels QM, A, B, C, D such as those defined. by the ISO 26262 standard.

The method in question is of the type of those implementing this function with a first level of requirement in terms of security by at least means having a second level of security requirement lower than the first requirement level. security terms for a design diversity of these means less than four.

According to the invention, this first level of requirement in terms of security is rated D or C and the second level of requirement in terms of security is rated B, A or QM,

This function is performed, according to the invention, in parallel from at least one input data by first and second passive passive calculation electronic units respectively generating at least first and second output data constituting alternatively at least a nominal output data of the function according to a state of the first and second electronic calculation units.

In a first embodiment of the invention, the first and second electronic calculation units each execute an identical set of three different software modules performing this function and generating the first and second output data via first and second voters. majority, the second level of security requirement of at least one of the three modules being two degrees lower than the first level of security requirement.

In a second embodiment of the invention, the first and second electronic calculation units respectively perform, on the one hand, a first and a second module, and, on the other hand, the second and third modules among a set of three different modules performing this function and generating the first and second output data via first and second majority voters taking into account the first, second and third intermediate outputs respectively generated by the first, second and third modules, the second level of security requirement of at least one of the first, second and third modules being two degrees lower than the first level of security requirement.

In a third embodiment of the invention, first and second electronic calculation units each execute a first identical module having an ASIL D rating and, respectively, second and third different modules having another ASIL QM rating.

The invention also relates to a system for implementing a function of a motor vehicle conforming to standard ASIL levels corresponding to increasing security requirements levels QM, A, B, C, D such as those defined by the ISO 26262 standard, suitable for implementing the process described above.

This system is of the type of those implementing this function with a first level of requirement in terms of security and comprising at least a first electronic computing unit, means for acquiring an input data of the function and means generating at least a first output of the function having a second level of security requirement lower than the first level of security requirement.

In the system according to the invention, the first level of requirement in terms of security is rated D or C and the second level of requirement in terms of security is rated B, A or QM for a diversity of design of these means of security. generation less than four.

According to the invention, this system further comprises a second electronic computing unit generating at least a second output data of the function, and switching means for generating at least one nominal output data by switching the first output data or the second output data according to a state of the first and second electronic computing units, said first and second electronic computing units being passive after failure.

In the first embodiment of the invention, the system for implementing a function of a motor vehicle conforming to standard ASIL levels also comprises an identical set of three modules. different performing this function performed by each of the first and second electronic computing units, and first and second majority voters generating the first and second output data, the second level of security requirement of at least one of these three modules being two degrees lower than the first level of security requirement.

In the second embodiment of the invention, the system further comprises, on the one hand, a first and a second one of a set of three different modules implementing the function executed by the first electronic computing unit, and, secondly, the second and third modules among this set of three different modules executed by the second electronic computing unit, and first and second majority voters taking into account the first, second and third intermediate outputs respectively generated by the first, second and second and third modules, the second level of security requirement of at least one of the first, second and third modules being two degrees lower than the first security requirement level.

In the third embodiment of the invention, the system further comprises a first identical module having an ASIL D rating executed by each of the first and second computing units and second and third different modules having another ASIL QM rating executed. respectively by these first and second electronic calculation units.

In these three embodiments of the system for implementing a function of a motor vehicle conforming to standard ASIL levels according to the invention, this function is preferably a detection of an object, the input data is derived a LIDAR, or a radar, or a camera, and at least one nominal output data advantageously generates a control of a group comprising a steering control, a motor control and a brake control.

According to the invention, at least one output data preferably generates the command by means of a path planning module ASIL D.

The invention also relates to a motor vehicle of the type of those comprising an advanced driving assistance system authorizing an automatic motorway driving comprising a system for implementing a function of a motor vehicle conforming to standard ASIL levels such as as previously described. These few essential specifications will have made obvious to the skilled person the advantages provided by the method of implementing a function of a motor vehicle conforming to standard ASIL levels according to the invention, as well as by the corresponding system, and by the motor vehicle comprising such a system, compared to the state of the prior art.

The detailed specifications of the invention are given in the following description in conjunction with the accompanying drawings. It should be noted that these drawings have no other purpose than to illustrate the text of the description and do not constitute in any way a limitation of the scope of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

Figure 1 is a block diagram of an operational duplex-dual hardware architecture after a known state of the art failure.

Figure 2 is a block diagram of a system for implementing a function of a motor vehicle conforming to standard ASIL levels, based on the architecture shown in Figure 1, known from the state of the art.

FIG. 3 is a block diagram of a system for implementing a function of a motor vehicle conforming to standard ASIL levels, based on the architecture shown in FIG. 1, according to the first embodiment of FIG. invention.

FIG. 4 is a block diagram of a system for implementing a function of a motor vehicle conforming to standard ASIL levels, based on the architecture shown in FIG. 1, according to the second embodiment of FIG. invention.

Figure 5 is a block diagram of an advanced driver assistance system for automatic highway driving known from the state of the art.

Figure 6 is a block diagram of an advanced driver assistance system that allows automatic highway driving based on the implementation of a motor vehicle function conforming to standard ASIL levels shown in Figure 3. DESCRIPTION OF THE PREFERRED EMBODIMENTS OF THE INVENTION

As already mentioned in the preamble, a possible architecture 1 for the implementation of the critical functions of an autonomous vehicle is that already widely used in avionics shown in FIG.

An input data 2 of the function to be produced is processed simultaneously by two electronic calculation units 3, 4 which generate output data 5, 6. It will be noted here that the terms "output data (s)" used in FIG. This application must not be interpreted strictly and also cover one or more exit orders.

A nominal output data item 7 is formed either by a first output data item 5 generated by a first 3 of the electronic calculation units 3, 4 when the latter is operating normally, or by a second output data item 6 generated by a second 4 of the electronic computing units 3, 4 when the first 3 is in failure.

The transition from one to the other of the output data 5, 6 is ensured by a switch 8 as a function of the state 9 of the first electronic computing unit 3.

An indication of the state, or status 10, of the second electronic computing unit 4 makes it possible to highlight the hidden errors.

In order to implement a qualified function at a first ASIL level C or D, it is known from the state of the art to implement, divided two by two in the electronic calculation units 3, 4, four different modules 12, 13, 14, 15 qualified at a second level ASIL A or B, respectively, as shown in Figure 2.

This method consisting in implementing, for performing a function of a qualified motor vehicle at a first level of security requirement, qualified modules at a second level lower than the first, is well known from the state of the art. technical.

However, such a known method most often requires being able to develop several modules 12, 13, 14, 15 different, which is not always possible for some functions.

On the contrary, in the method of implementing a function of a motor vehicle conforming to standard ASIL levels corresponding to the increasing safety requirement levels QM, A, B, C, D of ISO 26262, according to the invention, the diversity of the modules 12, 13, 14, 15 is limited. In a first embodiment, the method according to the invention is implemented in a system 16 shown in FIG. 3.

The design diversity is reduced to three by implementing three algorithms 12, 13, 14 in the two electronic computing units 17, 18 which include voters 19, 20 making a majority vote between intermediate outputs 21, 22, 23 generated by the algorithms 12, 13, 14.

In the case of the production of a fault in one of the three algorithms 12, 13, 14, the two electronic computing units 17, 18 will be impacted but will remain operational since the other two algorithms 12, 13, 14 will continue. to provide consistent outputs.

To perform an ASIL D function, the three modules 12, 13, 14 must be developed in ASIL B. To perform an ASIL function C, one of the redundant modules 12, 13, 14 can be developed in ASIL A, the other two modules being developed in ASIL B.

In this first embodiment, FIG. 3 is an exemplary implementation of a function in ASIL D by three modules 12, 13, 14 in ASIL B.

An advantage of this first embodiment of the invention is that the two electronic calculation units 17, 18 are identical and can therefore have the same stock reference. However, a disadvantage is that three redundant modules 12, 13, 14 are executed on each ECUs 17, 18. This increases the computing power to implement and the size of the memory required.

A possible variant of this first embodiment is to permanently run first and second modules 12, 13, but to start the execution of a third module 14 only in case of disagreement between the first and second intermediate outputs. 21, 22 of the first and second modules 12, 13. This reduces the calculation load of the ECUs. However, this is only applicable if the fault tolerance time interval is relatively long.

In a second embodiment, the method according to the invention is implemented in a system 24 shown in FIG. 4.

The design diversity is also reduced to three, only two 12, 13 of the three diversified algorithms 12, 13, 14 are executed on the first electronic computing unit 25 and two others 13, 14 of these three are executed on the second unit of electronic calculation 26. The intermediate output 21, 23 of the module 12, 14 which is not executed on one of the electronic calculation units 25, 26 is sent to it by the other module 12, 14, so that the majority voters 19, 20 generate the output data 5, 6 of the function.

In this second embodiment, FIG. 4 is an example of implementation of a function in ASIL D by three modules 12, 13, 14 in ASIL B.

The advantage of this second embodiment of the invention compared to the first embodiment is that less computing power and less memory are needed. The disadvantage is the need for cross-communication between the two ECUs and two diversified ECUs.

In a third embodiment of the invention, the first module implementing the function that is executed on each electronic computing unit is qualified ASIL D, and the second and third different qualified modules ASIL QM are each executed on each of the calculation units. electronic 3, 4.

A diversity of design for the first module is not necessary, since it is qualified to the same level of ASIL D security requirement as the function to be implemented. In this way the design diversity remains less than four.

A typical example of application of the invention is an advanced driver assistance system (ADAS) at level four, such as a system. authorizing automatic motorway driving (or MDS, that is to say "Motorway Driver System" in English terminology). The human driver can rest on the MDS to control the vehicle while driving on a highway, which allows him to answer his emails, watch TV, etc.

The MDS has a complete picture of the driving environment of the vehicle thanks to its redundant sensors. It can track other vehicles, it can also make decisions, such as braking or steer to avoid collisions with other vehicles, or even overtake to maintain a given speed.

FIG. 5 shows an overview of a simplified MDS 27 known from the state of the art, taking only the front sensors 28, 29, 30 into account. A complete system also requires rear sensors and lateral sensors, for among other things to allow a lane change. Three front sensors 28, 29, 30 of various technologies (LIDAR 28, radar 29, camera 30) are used to maintain sufficient detection performance (detection of objects and their tracking 31, 32, by the LIDAR 28 and the radar 29, or simple detection of the objects 33 by the camera 30) under any environmental conditions after a first failure.

A fusion of the complementary information 34 from the front sensors 28, 29, 30 makes it possible to identify the road, the other vehicles, the obstacles, etc.

A planning of the trajectory 35 determines the trajectory of the vehicle. Lateral and longitudinal control 36 calculates the steering controls 37, motor 38 and braking 39 so that the vehicle follows the planned path.

Regarding the level of requirement in terms of security, for the MDS, make a bad decision or not to detect an obstacle is rated ASIL D. Each sensor before 28, 29, 30 is qualified only ASIL B thanks to the redundancy of these front sensors 28, 29, 30.

In this state of the art, the fusion of the information 34 of the front sensors 28, 29, 30, the trajectory planning 35, and the lateral and longitudinal control 36 must be qualified to ASIL D.

In addition, the MDS 27 must remain operational after a first failure, as it may take more than ten seconds for the driver to regain control. The sudden complete loss of the availability of the system 27 must therefore be qualified ASIL D.

The method for implementing a function of a motor vehicle conforming to standard ASIL levels according to the invention makes it possible to reduce the ASIL D security requirement levels of information fusion functions 34 and trajectory planning. 35, and also lateral and longitudinal control 36.

Figure 6 is an example of an MDS system 40 based on the invention, where only the reduction of the security requirement level is applied to the information merging function 24, while the trajectory planning function and the lateral and longitudinal control 41 remain qualified ASIL D, in order to simplify the scheme.

Three different modules 12, 13, 14 implementing the "information merging" function 34 are executed by the two electronic calculation units 17, 18 according to the first embodiment of the invention shown in FIG. 3. This implementation avoids the use of four different modules if only two modules were executed in each ECU 17, 18, as known from the state of the art (Figure 2).

The output data 5 of the first electronic computing unit 17 form the steering controls 37, motor 38 and braking 39 unless this first electronic computing unit 17 is no longer operational. In this case, the switch 8 supplies the commands 37, 38, 39 coming from the second electronic unit 18.

A possible variant of this example is the implementation of the "information fusion" function 34 in application of the second embodiment of the invention shown in FIG. 4. The only difference is that the first module 12 implementing the "merge" function information "is not implemented in the second electronic computing unit 26 and that the third module 14 implementing this function is not implemented in the first electronic computing unit 25. In addition, the intermediate output 21 of the first module 12 is sent to the second electronic computing unit 26, and the intermediate output 23 of the third module 14 is sent to the first electronic computing unit 25.

It goes without saying that the invention is not limited to the only preferred embodiments described above.

A similar description could include automotive after-failure operational systems different from an MDS, such as electric power steering (or EPS) or braking systems.

These other embodiments are not outside the scope of the present invention insofar as they result from the claims below.

Claims

1) A method for implementing a function of a motor vehicle conforming to standard ASIL levels corresponding to increasing levels of safety requirements, denoted QM, A, B, C, D, the method being of the type those implementing said function with a first level of security requirement by at least means (12, 13, 14, 15) having a second level of security requirement lower than said first requirement level in terms of security. characterized in that said function is carried out in parallel from at least one input data (2) by first and second passive computing units (3, 4, 17, 18, 25, 26) after failure respectively generating at least first and second output data (5, 6) alternately constituting at least one nominal output data (7) of said function in accordance with a state of said first and second electronic computing units (3, 4, 1 7, 18, 25, 26), said first security requirement level being rated D or C and said second security requirement level being rated B, A or QM, for a variety of said means (12). , 13, 14) less than four.

2) A method of implementing a function of a motor vehicle conforming to standard ASIL levels according to the preceding claim 1, characterized in that said first and second electronic calculation units (17, 18) each execute an identical set of three different modules (12, 13, 14) performing said function and generating said first and second output data (5, 6) through first and second majority voters (19, 20), said second level of requirement security terms of at least one of said three modules being two degrees lower than said first level of security requirement.

3) A method of implementing a function of a motor vehicle conforming to standard ASIL levels according to the preceding claim 1, characterized in that said first and second electronic calculation units (25, 26) execute respectively, a first and second modules (12, 13), and secondly and third modules (13, 14) among a set of three different modules (12, 13, 14) carrying out said function and generating said first and second output data (5, 6) through first and second majority voters (19, 20) taking into account first, second and third outputs intermediates (21, 22, 23) respectively generated by said first, second and third modules (12, 13, 14), said second level of security requirement of at least one of said first, second and third modules (12). , 13, 14) being two degrees lower than said first level of security requirement.

4) A method of implementing a function of a motor vehicle conforming to standard ASIL levels according to claim 1, characterized in that said first and second electronic calculation units (3, 4) each execute a first identical module having an ASIL D rating and, respectively, second and third different modules having another ASIL QM rating.

5) System for implementing (1, 16, 24, 27, 40) a function of a motor vehicle conforming to standard ASIL levels corresponding to increasing safety requirements, denoted by QM, A, B, C, D, suitable for implementing the method according to any one of the preceding claims 1 to 4 of the type of those implementing said function with a first level of requirement in terms of security and comprising at least a first unit of electronic calculation (3, 17, 25), means for acquiring an input data item (2) of said function and means for generating (12, 13, 14) at least one first output data item ( 5) of said function having a second level of security requirement lower than said first level of security requirement, characterized in that it further comprises a second electronic computing unit (18, 26) generating at minus a second output datum (6) of said function, and a switch (8) producing at least one nominal output data (7) by switching said first output data (5) or said second output data (6) according to a state of said first and second electronic computing units (16, 17 , 25, 26), said first and second electronic computing units being passive after failure, and said first security requirement level being rated D or C and said second security requirement level being rated B, A or QM, for a diversity of said means (12, 13, 14) less than four.

6) Implementation system (16, 40) of a motor vehicle function according to standard ASIL levels according to the preceding claim 5, characterized in that it further comprises an identical set of three different modules (12, 13, 14) realizing said function executed by each of said first and second electronic calculation units (17, 18), and first and second majority voters (19, 20) generating said first and second output data (5, 6), said second level of security requirement of at least one of said three modules being two degrees lower than said first requirement level in terms of of security.

7) System for implementing (24) a function of a motor vehicle conforming to standard ASIL levels according to the preceding claim 5, characterized in that it furthermore comprises on the one hand a first and a second module One of a plurality of three different modules (12, 13, 14) carrying out said function executed by said first electronic computing unit (25), and secondly and third modules (13, 13). 14) among said set of three different modules (12, 13, 14) executed by said second electronic computing unit (26), and first and second majority voters (19, 20) taking into account first, second and third outputs intermediates (21, 22, 23) respectively generated by said first, second and third modules (12, 13, 14), said second level of security requirement of at least one of said first, second and third modules (12). , 13, 14) being lower two degrees to the first level of security requirement.

8) System for implementing a function of a motor vehicle conforming to standard ASIL levels according to the preceding claim 5, characterized in that it further comprises a first identical module having a rating ASIL D executed by each of said first and second electronic computing units (3, 4) and second and third different modules having another ASIL QM rating executed respectively by said first and second electronic computing units (3, 4).

9) System for implementing (40) a function of a motor vehicle conforming to standard ASIL levels according to any one of the preceding claims 5 to 8, characterized in that said function is a detection of an object, said input data (2) is derived from a LIDAR (28), or a radar (29), or a camera (30), and said at least one nominal output data (7) generates a command a group comprising a steering control (37), an engine control (38) and a brake control (39).

10) System for implementing (40) a function of a motor vehicle conforming to standard ASIL levels according to the preceding claim 9, characterized in that said at least one output data item (5, 6) generates said command (37). , 38, 39) by means of a trajectory planning module (41) ASIL D side. 11) Motor vehicle of the type of those comprising an advanced driving assistance system allowing automatic driving on the motorway, characterized in that it comprises an implementation system (16, 24, 40) of a motor vehicle function according to standard ASIL levels according to any one of the preceding claims 5 to 10.