FAULT TREE ANALYSIS FOR TECHNICAL SYSTEMS

Abstract

A method for fault tree analysis of a technical system, which includes a plurality of functional units, the technical system being modeled as a tree-like logical linkage of causative events, which may culminate in an undesirable event, and the causative events including malfunctions of individual functional units, a tree-like logical linkage having a self-similar structure being selected. An associated computer program is described. A surroundings detection system and/or a control system for an at least partially automated driving vehicle, including a plurality of functional units having mutual dependencies, which link the functional units in a tree-like structure in such a way that an undesirable event occurs if a logical linkage of causative events is true, the causative events including malfunctions of individual functional units, the tree-like structure being self-similar.

Claims

1. A method for performing a fault tree analysis of a technical system that includes a plurality of functional units, the method comprising: modeling the technical system as a tree-like logical linkage of causative events that may culminate in an undesirable event, the causative events including malfunctions of individual ones of the functional units; and selecting a tree-like logical linkage having a self-similar structure.

2. The method as recited in claim 1, further comprising: ascertaining, from at least one of a predefined catalog and a parameterized approach, a self-similar tree-like logical linkage that has a greatest possible similarity to a predefined, non-self-similar tree-like logical linkage.

3. The method as recited in claim 1, further comprising: combining states of all the functional units to form a state vector x, wherein a change over time of the state vector x is given by application of a Laplace matrix L associated with the self-similar tree-like logical linkage and by an additive noise term w.

4. The method as recited in claim 3, further comprising: ascertaining a mean variance of fluctuations of components of the state vector x in a stationary state of the technical system as a measure of a probability of the undesirable event.

5. The method as recited in claim 1, wherein the technical system includes at least one of a surroundings detection system and a control system of an at least partially automated driving vehicle, and wherein the functional units include at least one of sensors, actuators, software components, and algorithms.

6. The method as recited in claim 5, further comprising: modifying, in response to a malfunction having been established in at least one of the functional units by an onboard diagnosis unit of the vehicle, a probability of a malfunction of the malfunctioning functional unit in the self-similar tree-like linkage; and reanalyzing a probability of the undesirable event.

7. The method as recited in claim 5, further comprising: incrementing at least one probability of a malfunction of at least one functional unit with an increase in at least one of an age and use of the functional unit in the self-similar tree-like linkage; and reanalyzing a probability of the undesirable event.

8. The method as recited in claim 6, wherein, in response to the reanalyzed probability meeting a predefined criterion, the method further comprises at least one of: activating at least one of an acoustic warning unit and a visual warning unit perceptible by a driver of the vehicle, one of entirely deactivating and partially deactivating the system, prompting the driver of the vehicle to take over a manual control, and removing the vehicle from a public traffic area and taking the vehicle out of operation.

9. A computer program containing machine-readable instructions which, when executed on at least one of a computer and a control unit, prompt the at least one of the computer and the control unit to carry out a method for performing a fault tree analysis of a technical system that includes a plurality of functional units, the method comprising: modeling the technical system as a tree-like logical linkage of causative events that may culminate in an undesirable event, the causative events including malfunctions of individual ones of the functional units; and selecting a tree-like logical linkage having a self-similar structure.

10. An apparatus including at least one of a surroundings detection system and a control system for an at least partially automated driving vehicle, comprising: a plurality of functional units having mutual dependencies that link the functional units in a tree-like structure in such a way that an undesirable event occurs if a logical linkage of causative events is true, wherein the causative events include malfunctions of individual ones of the functional units, and wherein the tree-like structure is self-similar.

11. The method as recited in claim 1, wherein a length scale and a number of nodes each change from one generation to a next in the self-similar tree-like structure by factors which are selected from a predefined catalog.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0039] FIG. 1 shows an exemplary tree-like logical linkage 2 of events 21 through 27, which are carried out by an exemplary technical system 1, to a possible undesirable event 28.

[0040] FIG. 2 shows a self-similar version 2a of tree-like logical linkage 2 shown in FIG. 1.

[0041] FIG. 3 shows an exemplary embodiment of method 100.

[0042] FIG. 4 shows a chaotic dependence diagram of an exemplary, non-self-similar tree-like logical linkage.

DETAILED DESCRIPTION

[0043] According to FIG. 1, technical system 1 shown by way of example, which may be in particular a surroundings detection system 1a or a control system 1b of an at least partially automated driving vehicle, includes five functional units 11 through 15. The probability is sought that an undesirable event 28 will occur, and/or an effort is made to keep this probability below a predefined level. All probabilities are identified with letter p in FIG. 1.

[0044] As indicated by the symbol of the AND gate at undesirable event 28, the scenario assumed in FIG. 1 may only occur if two conditions are met simultaneously: on the one hand, a fault state 26 has to exist, and, on the other hand, the vehicle has to be in an operating state 27, in which fault state 26 also has an effect.

[0045] As indicated by the symbol of the OR gate at fault state 26, fault state 26 may go back through one or multiple of events 21 through 25, which are in turn triggered by malfunctions 11a through 15a of functional units 11 through 15 of system 1. Each of these events 21 through 25 has a probability of 10.sup.4, i.e., fault state 26 has a probability of 4.999*10.sup.4.

[0046] Operating state 27, which is also contingent on system 1, does not represent a fault in itself, but decides whether fault state 26 has an effect up to undesirable event 28. If fault state 26 occurs in a situation in which operating state 27 does not directly exist, the fault is thus quasi intercepted.

[0047] Operating state 27 exists on average during 42.5% of the operating time; its probability is thus 0.425. A probability of 2.124*10.sup.4 for undesirable event 28 results therefrom and from the probability of fault state 26.

[0048] If this probability is excessively high for the requirements of the customer, measures have to be taken to make certain causative events 21 through 27 more improbable. The probability of operating state 27 may be adapted with the most difficulty, since this operating state 27 is part of the intended normal use of the vehicle. Reducing the probabilities for malfunctions 11a through 15a of functional units 11 through 15 by replacing functional units 11 through 15 with higher-quality models thus comes into consideration. It is also possible to modify the interaction of functional units 11 through 15 in such a way that a fault state 26 only results in the event of a simultaneous malfunction of at least two of functional units 11 through 15. The probability of fault state 26 thus already drops to 5*10.sup.4*4*10.sup.4=2*10.sup.7.

[0049] The simple example shown in FIG. 1 may also be intuitively analyzed. In real systems having an extremely large number of possible events, a very high processing effort arises. To make this effort manageable at all, tree-like logical linkage 2 generally has to be transformed (for example, using the Kohda-Henley-Inous comprehensive method or the Yllera method), to decompose linkage 2 into modules and to find minimal cut sets in which redundancies are eliminated.

[0050] FIG. 2 shows an exemplary self-similar version 2a of tree-like logical linkage 2 shown in FIG. 1. Self-similar tree-like logical linkage 2a was generated by copying the unit shown by dashed lines in FIG. 2 from generation to generation in smaller scale on every connecting line between nodes. Causative events 21 through 27 and undesirable event 28 are shown by way of example in FIG. 2 and only occupy a small part of the available nodes therein. In a real system, significantly more nodes are occupied.

[0051] The conversion of non-self-similar tree-like logical linkage 2 into self-similar version 2a is not unique. Another self-similar structure could thus instead also be used, as long as there is an area which accurately depicts the cascading interactions between causative events 21 through 27 and undesirable event 28.

[0052] FIG. 3 shows an exemplary embodiment of method 100. According to step 105, a surroundings detection system 1a or control system 1b is selected as technical system 1 to be analyzed.

[0053] To be able to model system 1 for the purposes of fault tree analysis, in step 110, a self-similar tree-like logical linkage suitable for this purpose is ascertained for those events 21 through 27, which may result in an undesirable event 28.

[0054] An exemplary way of doing this is shown in FIG. 3. According to this way, in block 115, the self-similar tree-like logical linkage 2a is selected from a catalog or from a parameterized approach, which has the greatest possible similarity to non-self-similar original 2.

[0055] In step 120, system 1 is modeled with the aid of self-similar tree-like logical linkage 2a. For this purpose, according to block 121, the states of all functional units 11 through 15 are combined to form a state vector x. In block 123, the mean variance of the fluctuations of components of this state vector x is ascertained as a measure of the probability of undesirable event 28.

[0056] In the example shown in FIG. 3, especially for application in an at least partially automated driving vehicle, the correct function of functional units 11 through 15 in system 1 is progressively monitored by an onboard diagnosis unit of the vehicle according to block 130. If a malfunction 11a through 15a is established, according to block 135, the probability of malfunction 11a through 15a is accordingly modified in self-similar tree-like logical linkage 2a. Alternatively or also in combination therewith, according to block 140, the probability of malfunction 11a through 15a is incremented with increasing age and/or with increasing use of particular functional unit 11 through 15.

[0057] After the probabilities for malfunctions 11a through 15a of functional units 11 through 15 have been modified in self-similar tree-like logical linkage 2a, in step 150, the probability of undesirable event 28 is reanalyzed on the basis of updated linkage 2a. It is subsequently checked in block 160 whether the reanalyzed probability meets a predefined criterion.

[0058] If the criterion is not met (logical value 0 in block 160), no action is required.

[0059] If the criterion is met (logical value 1 in block 160), individually or in combination, according to block 162, the driver may be warned using a warning unit, according to block 164, the system may be deactivated, according to block 166, the driver may be prompted to take over control, or, according to block 168, the vehicle may be removed from the public traffic area and taken out of operation.

[0060] FIG. 4 illustrates once again the advantage which a self-similar tree-like logical linkage 2a offers. In FIG. 4, the dependencies between events shown as points a through j, which result from an exemplary non-similar structure of logical linkage 2 between events a through j, are outlined. Events a through j may represent, for example, the failure of software components or algorithms. The chaotic structure of the dependencies has the result that a change at an arbitrary point in the system triggers an unforeseeable cascade of consequences. In order to determine the effect of the change on the overall probability of an undesirable event 28, all these consequences have to be taken into consideration, which requires a correspondingly large amount of data and large amount of processing capacity. Such chaotic relationships are avoided using a self-similar tree-like logical linkage 2a.