Abstract: A computer-implemented method for verifying a software-based behavior planner of an automated driving function. The method includes: providing a verification environment model to limit the state space of the behavior planner according to a specifiable traffic scene; providing a formal requirement as a criterion for the correctness of decisions of the behavior planner; generating a model checker representation of the behavior planner taking into account the provided verification environment model; analyzing the model checker representation using a model checking procedure with respect to the formal requirement. The verification environment model is used to determine a physically meaningful parameter interval for at least one location parameter and/or movement parameter of the participants of the given traffic scene.

Abstract: A computer-implemented method for generating test data for computer-implemented automated driving functions. The method includes: provision of a computer-implemented automated driving function in the form of a software component; specification of an environment model with boundary conditions that limit the state space of the software component; provision of a model checker representation of the software component that is limited by the environment model; specification of a formal requirement as an input for a model checking method; and application of the model checking method to the model checker representation to analyze the software component with respect to compliance with the specified formal requirement. If the specified formal requirement is not complied with, the model checking method provides the states and state transitions of the software component that contribute to non-compliance as edge case parameters. Based on the edge case parameters, test data are then generated.

Abstract: A computer-implemented method for verifying at least one software component of an automated driving function. The method includes the following steps: providing an environment model that limits the state space of the software component to be verified by way of predefinable boundary conditions, wherein the environment model is provided in the form of a native environment model program code; translating the native program code of the software component to be verified and the environment model program code, wherein a model checker representation limited by the boundary conditions of the environment model and intended for the software component to be verified is generated; and verifying the model checker representation using a model checking method.

Abstract: A computer-implemented method for verifying a software component of an automated driving function. The native program code of the software component to be verified is limited to a set of authorized operations of the programming language used, and the following steps are performed: a) translating the native program code into a model checker representation of the software component to be verified, and b) analyzing the model checker representation of the software component to be verified using a model checking method. The native program code is converted into a finite-state machine, the states and state transitions of which are one-to-one assignable to the code structure of the native program code. The model checker representation is generated on the basis of this finite-state machine, such that the code structure of the native program code is largely retained when it is translated into the model checker representation.

Abstract: A computer-implemented method for verifying a software component of an automated driving function, The method includes: translating the native program code into a model checker representation of the software component to be verified and analyzing the model checker representation of the software component to be verified using a model checking method. The native program code of the software component to be verified is analyzed to identify independent sequences of commands, wherein an independent sequence of commands is a cohesive succession of program commands by which at least two variables are set, and the at least one result of an independent sequence of commands is independent of the order in which its program commands are processed. The variables of the at least one independent sequence of commands of the native program code are then simultaneously set in the model checker representation of the software component to be verified.

Abstract: A computer-implemented method for verifying a software component of an automated driving function. The method includes: translating the native program code into a model checker representation of the software component to be verified and analyzing the model checker representation of the software component to be verified using a model checking method. The native program code of the software component to be verified is limited to a set of operations of the programming language used that are defined as permissible. To do this, the native program code is converted into a finite automaton, the states and state transitions of which can be uniquely assigned to the code structure of the native program code. The model checker representation is generated based on the finite automaton such that the code structure of the native program code is substantially retained when the native program code is translated into the model checker representation.

Abstract: A computer-implemented system for monitoring the functionality of an automated driving function of a vehicle using sensor information from at least one sensor includes a software model of the automated driving function, a sensor performance model for the at least one sensor, a sensor monitoring module, which determines performance parameters and monitors the performance of the at least one sensor, an update module for updating the at least one sensor performance model based on the performance parameters determined, and a model checking module for analyzing an overall model comprising a combination of the software model and the at least one sensor performance model.

Abstract: A computer-implemented method for verifying at least one software component of an automated driving function. The software component to be verified includes at least one function which uses sensor information from at least one sensor. The method includes: a. providing a model for the software component to be verified, b. providing at least one sensor performance model for the at least one sensor, c. generating an overall model, in the process of which the at least one sensor performance model is combined with the model of the software component to be verified, d. analyzing the overall model using a model checking method.

Abstract: A method for controlling a plurality of driving functions in an automated or autonomous vehicle, a control unit designed to carry out the method, a computer program, and a machine-readable memory medium on which the computer program is stored are provided. In the method, the plurality of driving functions is described in each case by finite state machines. At least one finite state machine is of the Moore type, and includes a structure with a finite set of states. The states are linked to one another via edges. An edge defines from the finite set of states a transition from a starting state to a target state, in that an associated edge condition is true or false. The finite state machine is accessible during runtime based on the structure, so that an access to the states and the edges is made possible to change the states and/or the edges.