DE102019006719A1 - Method and system for monitoring the functional safety of a drive component - Google Patents

Abstract

The invention relates to a computer-aided method and a corresponding system for monitoring the functional safety of a drive component of a vehicle, using a model based on an artificial neural network, based on at least one input parameter of the drive component, at least one setpoint value of an output parameter of the drive component is determined at a point in time, the model for determining the at least one setpoint furthermore being provided with information about a course of the at least one input parameter in a defined period of time before this point in time, in particular up to this point in time, and wherein the at least one setpoint is provided with a the value of the output parameter generated by the drive component at the point in time is compared and the value is only confirmed and / or released if it lies within a defined tolerance range in relation to the setpoint or with the S setpoint matches.

Description

The invention relates to a method for monitoring the functional safety of a drive component of a vehicle, a corresponding system and a vehicle with such a system.

Drive-by-wire systems are now state of the art for controlling gasoline and diesel engines. The high demands placed on the systems and their integration into networked vehicle systems require careful monitoring of their functionality. Monitoring concepts for such systems are therefore known from the prior art, for example from a report by the E-Gas working group, “Standardized E-Gas Monitoring Concept for Petrol and Diesel Engine Controls”, as of July 05, 2013, version 5.5. A technical safety concept for the so-called e-gas with three levels is described there.

Level 1 contains engine control functions, including for implementing the requested engine torques, component monitoring, diagnosis of the input and output parameters as well as the control of the system reactions in the event of a detected error.

Level 2 is referred to as the function monitoring level. It detects the faulty process of monitoring-relevant scopes of the functional software in level 1, e.g. by monitoring the calculated torques or the vehicle acceleration. In the event of an error, system reactions are triggered.

Level 3 is referred to as the computer monitoring level. A component is a monitoring module that is independent of the function computer (e.g. an ASIC or computer), which uses a question-and-answer procedure to test the proper processing of the program commands of the function computer. In the event of an error, system reactions are triggered independently of the function computer.

Based on this prior art, it is an object of the invention to provide improved function monitoring, in particular an improved method for monitoring the functional safety of a drive component.

This problem is solved by the teaching of the independent claims. Advantageous refinements are defined in the subclaims.

A first aspect of the invention relates to a computer-aided method for monitoring the functional safety of a drive component of a vehicle, using a model based on an artificial neural network, based on at least one input parameter of the drive component, at least one setpoint value of an output parameter of the drive component in a point in time is determined, wherein the model for determining the at least one setpoint is also provided information about a course of the at least one input parameter in a defined period before this point in time, in particular up to this point in time, and wherein the at least one setpoint with a the drive component is compared in the time generated value of the output parameter and the value is only confirmed and / or released if it is within a defined tolerance range with respect to the setpoint or above the setpoint agrees.

A drive component within the meaning of the invention is preferably a system which contributes to increasing, maintaining and / or reducing the vehicle speed. A drive component is preferably designed as a control device, hardware, software, actuator, operating part or several of these elements. The drive component is preferably a drive train component. Examples of drive components are in particular a speed control device, a motor, an energy storage device, a battery management system, an engine control (ECU), a vehicle control (VCU), a transmission, a transmission control, a clutch, a clutch control, a braking device, a brake control , etc. or their components.

A value within the meaning of the invention is preferably an element of a set. A value is preferably an electrical signal which in particular represents a number or a symbol.

Functional safety within the meaning of the invention is that part of the safety of a system that depends on the correct functioning of the safety-related system and other risk-reducing measures.

A tolerance range within the meaning of the invention is that value range around a target value in which a safety goal is still met, i.e. functional safety can be guaranteed. Such safety goals are, for example, “unintentional acceleration of the vehicle” or “unintentional braking of the vehicle”. The size of the respective tolerance range is preferably determined on the basis of the ISO26262 standard for each drive component and type of use.

An artificial neural network within the meaning of the invention preferably has a neural network function (NNF, English: neural network function) or several of these functions.

A second aspect of the invention relates to a method for training an artificial neural network for use in a method for monitoring functional safety of a drive component of a vehicle, values of output parameters of the drive component being verified at a point in time and, if they are correct, together with a or a plurality of values of at least one input parameter of the drive component at the point in time and information about a course of the at least one input parameter in a defined time period before this point in time are read into the artificial neural network.

• Mittel zum Speichern für Informationen über einen Verlauf wenigstens eines Eingangsparameters in einem definierten Zeitraum;
• Mittel zum Bestimmen eines Sollwerts eines Ausgangsparameters der Antriebskomponente mittels eines Modells, welches auf einem künstlichen neuronalen Netz beruht, auf der Grundlage wenigstens eines Eingangsparameters der Antriebskomponente in wenigstens einem Zeitpunkt, welcher nach dem definierten Zeitraum liegt, vorzugsweise den definierten Zeitraum abschließt, wobei die Information über den Verlauf beim Bestimmen des Sollwerts berücksichtigt wird;
• Mittel zum Vergleichen des wenigstens einen Sollwerts mit einem durch die Antriebskomponente in dem Zeitpunkt erzeugten Wert des Ausgangsparameters; und
• Mittel zum Bestätigen und/oder Freigeben des Werts, wenn er innerhalb eines definierten Toleranzbereichs in Bezug auf den Sollwert liegt, insbesondere mit dem Sollwert übereinstimmt.

A third aspect of the invention relates to a system for monitoring a functional safety of a drive component of a vehicle, set up to carry out a method for monitoring a functional safety of a drive component of a vehicle, and / or having:

• Means for storing information about a course of at least one input parameter in a defined time period;
• Means for determining a setpoint value of an output parameter of the drive component by means of a model which is based on an artificial neural network, on the basis of at least one input parameter of the drive component in at least one point in time which is after the defined period, preferably terminating the defined period, the information is taken into account over the course when determining the target value;
• Means for comparing the at least one setpoint value with a value of the output parameter generated by the drive component at the point in time; and
• Means for confirming and / or releasing the value when it lies within a defined tolerance range with respect to the target value, in particular if it corresponds to the target value.

Further aspects of the invention relate to a drive component and / or a vehicle with such a system.

The invention is based on the approach of using a model that is based on an artificial neural network in order to implement a method for monitoring the functional safety of a drive component of a vehicle.

In particular, compared to numerical methods for monitoring functional safety, no physical calculation models based on physical laws are used. With the solution according to the invention, there is no need to set up equations, comparisons and parameters which are based on the actual function of the drive component.

The artificial neural network is trained exclusively on the basis of training data. In this training phase, the parameters of the artificial neural network, such as so-called weights and biases, are optimized in order to achieve the best possible prediction of the output parameters of the drive component. A developer does not need any or at least no deeper understanding of the respective monitored function. Using the method according to the invention, there is therefore no need to numerically map a physical reality. Rather, by means of the method according to the invention, only values of output parameters are predicted on the basis of input parameters and the learned artificial neural network.

By using the artificial neural network, in particular a reduction in development time and an increase in monitoring accuracy are achieved. Furthermore, in the case of many drive components, the trained neural network is not limited to the precise execution of a drive component in each case. Finally, the method according to the invention requires significantly less computer power than physical calculation models, since the calculation steps carried out are comparatively simple.

In addition, the method according to the invention has a memory function outside the artificial neural network. In particular, this memory function is used to provide the artificial neural network with information about a history of the at least one input parameter in the past, i.e. before the respective point in time considered. As a result, the performance of the model with regard to functions of a drive component, which are time-discrete, can be improved. In this way, the model can learn gradients and therefore predict a value of the at least one output parameter with greater accuracy.

Another advantage of realizing such a memory function outside of the artificial neural network is that the model or the artificial neural network can be kept relatively simple. As a result, the computing capacity required for calculating the artificial neural network can in turn be reduced.

When training the artificial neural network, a large number, if not almost all types of driving situations preferably arise Use, ie the neural network is trained in all of these driving situations. Furthermore, the artificial neural network is preferably trained in such a way that it checks sensor information of the monitored function for plausibility. By providing information about a course of the at least one input parameter before the point in time at which a value of an output parameter is verified, the neural network is provided with additional information for assessing the current driving situation. In this way, a more precise resolution can be achieved when assessing the driving situation.

In an advantageous embodiment of the method, the model is provided with the information about a course of the at least one input parameter as a gradient of the at least one input parameter or as a value series of the at least one input parameter, the values preferably being provided with a time stamp.

According to the invention, the value of the output parameter at the point in time is preferably that of the present sample time or the current time step. The values of the course, which form a series of values, on the other hand, are the values from previous points in time, which are a certain number x of calculation cycles before the current point in time. In this way, the model itself can derive gradients of the input parameters and predict the output parameters with greater accuracy. As an alternative to this, the gradient can be calculated outside the model, in particular by means of the implemented memory function. In this way, too, the neural network can then establish relationships between a momentary input parameter and the gradient.

In a further advantageous embodiment, the artificial neural network itself is composed exclusively of layers which are not suitable for long and short-term memory (LSTM). A layer is part of the topology of an artificial neural network. The artificial neurons of the artificial neural network are in turn arranged on these layers. This results in a particularly simple model which manages with low computing capacities or which enables short computing times.

In a further advantageous embodiment of the method, the at least one input parameter of the drive component runs through a standardization function before the at least one setpoint value of the output parameter is determined by means of the model. The inputs are standardized using the standardization function. The standardization function is preferably derived from an activation function of the artificial neural network.

In a further advantageous embodiment of the method according to the invention, the drive component has an actuator which is controlled by the output parameter. The actuator is preferably only actuated when a value of the output parameter is confirmed and / or released. In this case, in particular a control method or a control device of the drive component is monitored by means of the method.

In a further advantageous embodiment of the method, operation of the drive component and / or the vehicle is restricted or interrupted if one or more values of the output parameter is / are not confirmed and / or not released. In this case, for example, an entire drive component including the actuator is monitored. If a faulty behavior of the drive component is determined, it is initially not known whether the faulty behavior is due to a faulty control and / or a faulty function of the actuator. The operation of the drive component or of the entire vehicle is therefore preferably restricted in a manner that does not endanger the safety objectives, or if this does not yet lead to the safety objective being achieved, it is completely interrupted.

In a further advantageous embodiment of the method, a warning message is output if one or more values of the output parameter is / are not confirmed and / or not released. The aim of this refinement is to warn an occupant of the vehicle, in particular the driver, about a lack of functional safety of the vehicle and / or one of its drive components. The driver can then shut down the vehicle or take appropriate measures to achieve the safety goal.

Such a warning message can preferably be provided in connection with a so-called on-board diagnostic function (OBD). The warning message is also preferably sent to a central server, which can initiate appropriate measures to achieve the safety goal, for example can inform the vehicle that it has to drive to a service workshop.

In a further advantageous embodiment, the method is part of a monitoring concept for the drive component, the monitoring concept having three levels, with level 1 defining the function of the drive component, level 2 monitoring the functional safety of the drive component, and level 3 Functions of a control unit that executes and checks the method and ensures the security of integrated hardware and safe method execution. In this advantageous refinement, the method is part of a monitoring concept in three levels, such as is used for e-gas, for example, as described at the beginning. In this context, the method is particularly advantageous since computing and storage capacity in a control device of drive components, for example the engine control device, are particularly tight.

The advantages and features described above in relation to the first aspect of the invention also apply accordingly to the further aspects of the invention and vice versa.

• 1 ein erstes Ausführungsbeispiel einer Antriebskomponente mit einem System zum Überwachen einer funktionalen Sicherheit einer Antriebskomponente eines Fahrzeugs;
• 2 ein zweites Ausführungsbeispiel einer Antriebskomponente mit einem System zum Überwachen einer funktionalen Sicherheit einer Antriebskomponente eines Fahrzeugs;
• 3 ein Ausführungsbeispiel eines computer-gestützten Verfahrens zum Überwachen einer funktionalen Sicherheit einer Antriebskomponente;
• 4 ein Verfahren zum Trainieren eines künstlichen neuronalen Netzes; und
• 5 ein Ausführungsbeispiel eines Fahrzeugs mit einem System zum Überwachen einer funktionalen Sicherheit einer Antriebskomponente.

Further advantages and features emerge from the following description in connection with the figures. Show it:

• 1 a first embodiment of a drive component with a system for monitoring a functional safety of a drive component of a vehicle;
• 2 a second exemplary embodiment of a drive component with a system for monitoring a functional safety of a drive component of a vehicle;
• 3rd an embodiment of a computer-aided method for monitoring a functional safety of a drive component;
• 4th a method of training an artificial neural network; and
• 5 an embodiment of a vehicle with a system for monitoring a functional safety of a drive component.

1 shows a drive component 1 of a vehicle 10 (not shown) with a system 20th for monitoring the functional safety of the drive component 1 .

In the following, exemplary embodiments are described in relation to what is known as e-gas, in which a speed request by the driver on the accelerator pedal 3rd via drive-by-wire to the corresponding actuator 2 , for example that actuator 2 which operates the throttle valve. However, the invention is in no way restricted to e-gas systems and can also be used with other drive components 1 come into use.

One functional level Level 1 of the e-gas system 1 represents the functional level, which the actual control function of the means of the e-gas system 1 Has requested engine torques.

To realize the control function, the e-gas system 1 a gas pedal 3rd which can be operated by a driver, a control device 4th and an actuator 2 on.

Input parameters IN the control device 4th are preferably a signal which is triggered by the accelerator pedal 3rd is generated, as well as other data that are available, for example, on the CAN network of the vehicle. An example of such data is sensor data from one or more sensors.

The control device 4th generated from the information given by the input parameters IN receives, output parameter OUT which in turn is the actuator 2 drive. The actuator 2 preferably in turn adjusts an actuator, for example the throttle valve.

The system 20th for monitoring the functional safety of the drive component 1 preferably monitors the operation of the e-gas system 1 . This monitoring system also preferably has 20th two monitoring levels, Level 2, Level 3.

Level 2 a function monitoring level is preferably referred to, which is a faulty sequence of monitoring-relevant functions of the e-gas system 1 supervised.

The function monitoring level Level 2 uses a model to form the function of the e-gas on the functional level Level 1 using an artificial neural network. The function monitoring level Level 2 medium 21 , set up to store information about a course of at least one input parameter IN over a defined period of time.

Furthermore, the function monitoring level Level 2 medium 22nd , set up to determine a setpoint value of an output parameter OUT of the e-gas. A model M based on an artificial neural network is preferably used here.

Furthermore, the function monitoring level has means 23 , set up to compare at least one setpoint value OUT _SP with a value generated by the e-gas OUT of the output parameter. medium 24 the function monitoring level are used to confirm and / or enable the value OUT if it lies within a defined tolerance range in relation to the setpoint OUT _SP , in particular if it corresponds to the setpoint OUT _SP. The means are accordingly 24 set up.

The function monitoring level Level 2 in addition, funds 25th , set up to standardize the input parameters IN on. By means of these means 25th can be systematic differences between input parameters IN different sources can be eliminated. Furthermore, the function monitoring level Level 2 medium 25th , set up to carry out an integrity check, to detect any incorrect data in the input parameters IN to discover.

The standardization and the integrity check can also be part of the model M and therefore according to the means 21 be arranged.

Means within the meaning of the invention can be designed in terms of hardware and / or software and in particular a processing unit (CPU) and / or one or more programs that are data or signal-connected, preferably with a memory and / or bus system, in particular digital, processing, in particular microprocessor unit (CPU) or have program modules. The CPU can be designed to process commands which are implemented as a program stored in a memory system, to acquire input signals from a data bus and / or to output output signals to a data bus. A storage system can have one or more, in particular different, storage media, in particular optical, magnetic, solid-state and / or other non-volatile media. The program can be designed in such a way that it embodies or is able to carry out the methods described here, so that the CPU can carry out the steps of such methods.

Accordingly, all or some of the means can 21 to 25th be contained in a microprocessor. Preferably the agent is 21 executed here as a memory block.

More preferably, the system 20th overall part of the control device 4th be.

The monitoring level Level 3 of the system 20th for monitoring the functional safety of the e-gas 1 is preferably a computer monitoring level. This preferably has a from the control device 4th independent monitoring module (not shown), which is designed in particular as an ASIC or an independent computer. In this monitoring module, in particular, the correct processing of the program commands by the control device 4th or the microprocessor unit, which is the function monitoring level Level 2 contains, tested.

In the in 1 The embodiment shown can include the means 24 the function monitoring level Level 2 or a corresponding means of the computer monitoring level Level 3 the output parameter that controls the actuator 2 controls, release or confirm so that the actuator 2 according to the value OUT is operated. However, if the functional safety of the e-gas system is not guaranteed, ie the value lies OUT outside a defined tolerance range in relation to the setpoint OUT _SP , the actuation of the actuator 2 restricted or prevented.

The artificial neural network of the model M can be used together with other safety-related or non-safety-related functionalities on the control device 4th or a separate microcontroller unit. The artificial neural network is preferably a comparatively simple and short calculation chain with so-called weights and biases. The artificial neural network of the model M preferably has only so-called dens layers. In particular, the artificial neural network of model M does not have any LSTM layers, ie layers which implement long and / or short-term memory. As a result, the neural network of the model M is kept comparatively simple. It is known to the person skilled in the art, however, that the number of parameters depends on the number of input parameters, layers, neurons per layer, output parameters and the type of layer.

• Ungewollte Beschleunigung, ungewolltes Abbremsen: Gaspedalinformation, Bremspedalinformation, Gangschaltungsinformation, Fahrzeugbewegungsinformation, elektrische Motorinformation, Rekuperationsdrehmoment-Anforderungsinformation, angeforderte Drehmomentinformation.
• Drehmomentüberwachung: Phasenströme, Rotorwinkel, Statortemperatur, Gleichstromspannung, gegenelektromotrische Kraft, Motorinduktivitäten, Rotorfluss, Statorwiderstand, Polpaaranzahl, Rotortemperatur, Rotorgeschwindigkeit, Statorgeschwindigkeit, thermische und elektrische Eigenschaften des Rotormaterials.
• Batterieausgasung: Batterieströme, Zellpackspannung und/oder Gesamtbatteriespannung, Batterietemperatur, Timing-Information, Status des Trennungsrelais der Hardwarebatterie, Anzahl von Batteriezellen, Umgebungstemperatur.
• Hochspannung: Batterieströme, Zellpackspannung und/oder Spannung der Gesamtbatterie, Batterietemperatur, Anzahl von Batteriezellen, Status des Trennungsrelais der Hardwarebatterie, Isolationswiderstand.
• Batterietemperatur: Batterieströme, Zellpackspannung und/oder Spannung der Gesamtbatterie, Batterietemperatur, Timing-Information, Status des Trennungsrelais der Hardwarebatterie, Umwelttemperatur, Anzahl an Batteriezellen.

Possible safety goals with the e-gas system 1 are listed below. Possible input parameters are used for this IN specified which in the model M to monitor the function of the drive component 1 can be considered:

• Unintentional acceleration, unintentional braking: accelerator pedal information, brake pedal information, gear shift information, vehicle movement information, electrical engine information, recuperation torque request information, requested torque information.
• Torque monitoring: phase currents, rotor angle, stator temperature, direct current voltage, counter-electromotive force, motor inductances, rotor flux, stator resistance, number of pole pairs, rotor temperature, rotor speed, stator speed, thermal and electrical properties of the rotor material.
• Battery outgassing: battery currents, cell pack voltage and / or total battery voltage, battery temperature, timing information, Hardware battery disconnection relay status, number of battery cells, ambient temperature.
• High voltage: battery currents, cell pack voltage and / or voltage of the entire battery, battery temperature, number of battery cells, status of the disconnection relay of the hardware battery, insulation resistance.
• Battery temperature: battery currents, cell pack voltage and / or voltage of the entire battery, battery temperature, timing information, status of the hardware battery disconnection relay, ambient temperature, number of battery cells.

2 shows a second embodiment of an e-gas system 1 with one system 20th for monitoring the functional safety of the e-gas.

The e-gas system 1 is essentially the same as the e-gas system in 1 . The second embodiment differs, however, in that the means 23 to compare the value OUT is supplied to which the actuator 2 generated as an output parameter. _{This is compared with a setpoint value OUT SP of} the output parameter which is now determined by the model M.

In contrast to 1 , a function of the actuator 2 can no longer be prevented in the current time step, but this system can be used to enable the entire function of the e-gas system, consisting of the accelerator pedal 3rd , Control device 4th and actuator 2 , be monitored. If a functional disorder is detected, the operation of the e-gas system is preferred 1 or the entire vehicle 10 restricted or interrupted. However, this can only happen in the next time step.

3rd FIG. 10 shows an exemplary embodiment of a method 100 for monitoring the functional safety of an e-gas system 1 of a vehicle.

In a first work step 101 of method 100, a model M based on an artificial neural network is used on the basis of at least one input parameter IN of the e-gas system 1 at least one setpoint OUT _{SP of} an output parameter of the e-gas system 1 determined at a time.

The input parameters are preferably available on the CAN network. Further input parameters result from the control of the e-gas system 1 , like the accelerator 3rd . Further preferably input parameters are sensor data.

Furthermore, the model M receives information about a course of the at least one input parameter IN provided in a defined period of time before the time of the determination, in particular up to this time. This information is also included in the determination of the setpoint OUT _SP .

The information about the course is provided either as a data series with at least two data entries or as a gradient of the respective input parameters IN provided. In a second work step 102, the at least one specific setpoint value OUT _{SP is} activated by the e-gas system 1 self-generated value OUT of the output parameter compared.

The consideration of information about a course of the at least one input parameter IN ensures that the driving situation prevailing at the point in time or the current time step can be correctly determined by the model M. For example, an accelerator pedal position of 50% means when a vehicle is at a standstill 10 a requirement other than an accelerator pedal position of 50% at a speed of 100 km / h. However, this driving situation can only be correctly recognized by the model M if information about previous driving situations is available.

In a further work step 103, the value OUT only confirmed and / or released if it is within a defined tolerance range in relation to the setpoint OUT _SP or if it corresponds to the setpoint OUT _SP.

• Zum einen kann eine Betätigung eines Aktors 2 davon abhängig gemacht werden, ob ein Wert OUT des Ausgangsparameters bestätigt und/oder freigegeben wird.

Will the value OUT of the output parameter is confirmed, the function of the e-gas system 1 continued normally. Will this value OUT not confirmed, depending on the severity of the malfunction in relation to the functional safety of the e-gas system 1 various measures can be taken by the method 100:

• On the one hand, an actuation of an actuator 2 be made dependent on whether a value OUT of the output parameter is confirmed and / or released.

Alternatively or additionally, the e-gas system can be operated 1 and / or the vehicle 10 restricted or interrupted when one or more values OUT of the output parameter is / are not confirmed and / or not released.

Finally, a message, in particular a warning message, can be output if one or more values OUT of the output parameter is / are not confirmed and / or not released.

4th FIG. 10 shows an embodiment of a method 200 for training an artificial neural network, as it is in a method 100 according to FIG 3rd is used.

In a first step, the values of output parameters OUT of e-gas 1 verified at a time. This can be done by means of so-called monitored learning or also by means of automated learning. In a second step 202, if the values of output parameters OUT in relation to values of at least one input parameter IN are applicable, together with the values of the at least one input parameter IN in the point in time or current time step as well as information about a course of the at least one input parameter IN read into the artificial neural network in a defined period of time before this point in time.

The training of the artificial neural network is carried out with any type of computer machine suitable for this purpose, using software that is not yet safety-related. The training or optimization of the artificial neural network or its parameters is preferably carried out using measured values and / or simulation data from a target vehicle 10 with the functional level Level 1 executed. The training data preferably cover data from a wide range of driving situations. The range of the training data is preferably defined in such a way that transitions from and to all extreme or borderline driving situations are carried out. This ensures that all driving situations between extreme or borderline driving situations are covered. For example, at least n driving cycles from minimum vehicle speed to maximum speed, n driving situations with an accelerator pedal actuation of 0 to 100%, n driving situations with an incline of 45 ° to -45 °, etc. should be run through. This ensures that the artificial neural network cannot be confronted with driving situations which essentially do not match the training data used to train the artificial neural network.

The training data preferably only contain safe driving situations that were generated in a vehicle in real operation or by simulation. The artificial neural network uses standard safety input parameters from actuators and other control units. In order to carry out an integrity check of all input parameters of the training data, the training data should have data records in which the information provided by the input parameters is confirmed.

The parameters of the artificial neural network are preferably not stored on the target hardware, that is to say on the drive component that is actually monitored 1 trained.

5 shows an embodiment of a vehicle 10 with an e-gas system 1 and a system 20th for monitoring the functional safety of the e-gas system 1 .

It should be noted that the exemplary embodiments described are merely examples that are not intended to restrict the scope of protection, the application and the structure in any way. Rather, the preceding description provides a person skilled in the art with guidelines for implementing at least one exemplary embodiment, with various changes, in particular with regard to the function and arrangement of the described components, being able to be made without departing from the scope of protection as defined in the claims and yields these equivalent combinations of features.

List of reference symbols

1

Drive component

2

Actuator

3

accelerator

4th

Control device

10

vehicle

20th

System for monitoring functional safety

21st

Means for storing information

22nd

Means for determining a target value

23

Means of comparison

24

Means of confirmation

25th

Means of integrity checking

26th

Means of standardization

Level 1

Functional level

Level 2

Function monitoring level

Level 3

Computer monitoring level

IN

Input parameters

OUT

Output parameters

Claims (12)

Computer-aided method (100) for monitoring the functional safety of a drive component (1) of a vehicle (10), using a model (M) based on an artificial neural network on the basis of at least one input parameter (IN) of the drive component (1) at least one setpoint value of an output parameter (OUT _SP ) of the drive component (1) is determined (101) at a point in time, the model (M) for determining the at least a setpoint (OUT _SP ) further information about a course of the at least one input parameter (IN) is provided in a defined period before this point in time, in particular up to this point in time (T), and the at least one setpoint (OUT _SP ) with a value of the output parameter (OUT) generated by the drive component (1) at the point in time is compared (102) and the value (OUT) is only confirmed and / or released (103) if it is within a defined tolerance range with respect to the target value (OUT _SP ) or corresponds to the setpoint (OUT _SP ). Method (100) according to Claim 1 , the model (M) being provided with the information about a course of the at least one input parameter (IN) as a gradient of the at least one input parameter (IN) or as a series of values of the at least one input parameter (IN), the values preferably being provided with a time stamp becomes. Method (100) according to Claim 1 or 2 , the artificial neural network itself being made up exclusively of layers that are not suitable for long and short-term memory. Method (100) according to one of the preceding claims, wherein the at least one input parameter (IN) of the drive component (1) _{runs through a standardization function before the at least one setpoint value (OUT SP} ) of the output parameter is determined by means of the model (M). Method (100) according to one of the preceding claims, wherein the drive component (1) has an actuator (2) which is controlled by the output parameter (OUT), the actuator (2) only being actuated when a value of the output parameter ( OUT) is confirmed and / or released. The method (100) according to any one of the preceding claims, wherein an operation of the drive component (1) and / or the vehicle (10) is restricted or interrupted if one or more values of the output parameter (OUT) is not confirmed and / or not released /will. Method (100) according to one of the preceding claims, wherein a warning message is output if one or more values of the output parameter (OUT) is / are not confirmed and / or not released. Method (100) according to one of the preceding claims, which is part of a monitoring concept for the drive component (1), the monitoring concept having three levels (level 1, level 2, level 3), with level 1 (level 1) the function of the drive component (1) defines, level 2 (level 2) monitors the functional safety of the drive component (1) and level 3 (level 3) checks the functions of a control unit that executes the process (100) and ensures the safety integrity of the hardware and safe process execution . Method (200) for training an artificial neural network for use in a method (100) for monitoring the functional safety of a drive component (1) of a vehicle (10) according to one of the Claims 1 to 8th , whereby values of output parameters (OUT) of the drive component (1) are verified (201) at a point in time and, if these are correct, together with one or more values of at least one input parameter IN of the drive component at the point in time and information about a course of the at least an input parameter IN can be read into the artificial neural network in a defined period of time before this point in time (202). System (20) for monitoring the functional safety of a drive component (1) of a vehicle (10), set up to carry out a method (100) according to one of the Claims 1 to 8th and / or comprising: means (21) for storing information about a course of at least one input parameter (IN) in a defined time period; Means (22) for determining a setpoint value of an output parameter (OUT _SP ) of the drive component (1) by means of a model (M) which is based on an artificial neural network on the basis of at least one input parameter (IN) of the drive component (1) in at least at a point in time (T) which lies after the defined period, preferably terminates the defined period, the information about the course being taken into account _{when determining the desired value (OUT SP);} Means (23) for comparing the at least one setpoint value (OUT _SP ) with a value (OUT) of the output parameter generated by the drive component (1) at the point in time; and means (24) for confirming and / or releasing the value (OUT) if it is within a defined tolerance range with respect to the target value (OUT _SP ), in particular if it corresponds to the target value (OUT _SP ). Drive component (1) with a system (20) according to Claim 10 . Vehicle (10) with a system (20) according to Claim 10 and / or a drive component (1) Claim 11 .

Images