Method and control system for dynamically distributing software in a vehicle control system

Abstract

The invention relates to a method and a control system for dynamically distributing software in a control system of a vehicle. The invention relates to a method for dynamically distributing program code (20, 22, 24, 26, 28, 30) in a control system (10) of a vehicle (1) based on a background. In this case, the control system has a plurality of control devices (12, 14, 16, 18) for executing the program code. It is provided that the program code is associated with the corresponding control devices of the control system via a global layout diagram (62). In this case, the global layout diagram is calculated on a computing unit (64, 66, 68) outside the control system. The data of the global layout diagram are transmitted to the control system (10). The invention also relates to an at least semi-autonomous motor vehicle (1), which has a control system for implementing the method.

Description

Technical Field

[0001] The invention relates to a method for context-dependent dynamic distribution of software in a control system of a motor vehicle, a control system for carrying out the method, a motor vehicle with the control system, and a computer program product. Background Art

[0002] Modern vehicles have, in particular, a large number of assistance systems that provide computer-based support to the driver in a wide variety of driving situations. These assistance systems can detect a large amount of measurement data using sensors that far exceed the perception capabilities of humans. In addition, the speed of these assistance systems also significantly exceeds human reaction times. Known driver assistance systems are, for example, lane keeping assistance systems, brake assistance systems for the detection of pedestrians, and distance-controlled cruise control systems, in particular for use in traffic jams.

[0003] Through the use of such assistance systems, the driver's autonomy in terms of his driving decisions is increasingly transferred to the vehicle or to the correspondingly operated control unit. This development ultimately leads to autonomous vehicles that can be driven completely without human intervention. With such autonomous vehicles, fully automated passenger transport is possible.

[0004] The driving operation of a motor vehicle, in particular an autonomously driven motor vehicle, is controlled by a driving system, which in the context of the present application is to be understood in the broadest sense as a control unit that is specially designed and configured for this task. The control unit is designed to automatically guide the vehicle in the lateral and longitudinal directions using a plurality of input signals, in particular sensor data detected by the vehicle itself and received communication data. This control of the automated lateral and longitudinal guidance places complex computational demands on the driver assistance system, which for this purpose usually has algorithms, models and control functions that are at least partially based on machine learning (artificial intelligence).

[0005] In order to operate an automated car safely, a large number of software applications that are integrated with each other are required. However, the problem is that errors within a software application or a computing node can result in some applications no longer being able to execute. Depending on the importance of the application in question, this can have serious consequences for the safety of the driver and other traffic participants.

[0006] In order to avoid serious consequences caused by errors that occur, software applications can be executed redundantly on different computing nodes. The idea here is to execute redundant instances in passive mode. This means that the redundant instances execute the same processes as the active instance, but do not interact with the executing system.

[0007] Depending on the functional importance of the respective function, this may lead to uncontrolled driving states, reduced comfort or even danger to the occupants of the autonomously driven motor vehicle. It is known to implement safety-related systems redundantly in order to safely avoid dangerous driving situations.

[0008] The task of determining the association between application instances and computing nodes is not an easy one. The decision is related to a variety of different parameters. For example, computing nodes have only a limited amount of computing and storage resources. On the other hand, each application requires a specific amount of resources to work as planned. In order to ensure that all applications can be executed on the computing nodes installed in the vehicle, a multi-dimensional and complex application layout problem must be solved.

[0009] As mentioned above, dangerous situations caused by software or hardware errors can be (partially) avoided by redundant software design. However, the introduction of redundant application instances exacerbates the complexity of the application layout problem, because additional parameters must be taken into account. For example, a minimum number of redundant instances can be given for each application. In addition, a minimum degree of hardware isolation can also be defined for each application. This parameter specifies at least how many different computing nodes an instance of the application must be executed on. Here, the number of control units that can be used and the requirements for minimum hardware isolation in terms of the program lead to distribution problems.

[0010] Since the number of software applications required to run an autonomous vehicle is quite large (involving about hundreds of applications), there are usually a large number of valid associations between computing nodes and application instances. However, not all valid associations are equally "good". In order to select the best possible mapping, an optimization goal must be formulated. For example, an optimization goal can be formulated so that a mapping that turns off as many computing nodes as possible is better than a mapping that uses all computing nodes with which the vehicle is equipped. In addition to this optimization goal, a variety of other target functions that take into account other criteria can also be envisioned.

[0011] When a fault in a sensor or control unit disrupts the functionality of the control system, or when there is an error in the program code, it may be necessary to reconfigure the software on different control units of the control system in order to be able to safely execute the functions of the control system again.

[0012] A cloud computer system and a method for operating the system are known from document US 2016 / 0 142 253 A1. Here, the cloud computer system can exchange data with an external computing unit, such as a workstation computer, a smart phone, a laptop, or a control unit in a motor vehicle.

[0013] Such technical solutions are known, for example, for navigation systems of motor vehicles, wherein real-time navigation can be achieved by means of a large number of external data acquisition modules and the analysis of these data using cloud computer systems, taking into account current traffic density and current traffic disturbances. Summary of the invention

[0014] The object of the present invention is to improve the reconfiguration process when software needs to be reconfigured on a control system for autonomous driving operation of a motor vehicle and thereby minimize the required computing power and energy consumption in the motor vehicle.

[0015] According to the present invention, the above technical problem is solved by a method for dynamically distributing program code in a control system of a vehicle based on background, wherein the control system has a plurality of control devices for executing program code. It is set to associate the program code with the corresponding control device of the control system through a global layout diagram, wherein the global layout diagram is calculated on the following computing unit, which is outside the control system and transmits the data of the global layout diagram to the control system. Thus, when the control unit fails or an error occurs in the execution of the program code of the control system, a technical solution for dynamically distributing the active program code on the remaining control devices can be provided, so that the control system of the motor vehicle does not need to perform complex and energy-intensive solutions to optimization problems, but provides solutions to optimization problems through a computing center outside the vehicle. Thus, the computing power in the motor vehicle can be limited, thereby improving the energy efficiency of the motor vehicle. In addition, when similar problems occur in motor vehicles of the same type, solutions can be provided before the problems actually occur in the corresponding motor vehicles, so that the control system can be quickly reconfigured, thereby improving the safety of the motor vehicle.

[0016] The technical features described below can advantageously improve and significantly expand the specified method for context-based dynamic distribution of software in a control system of a motor vehicle.

[0017] In a preferred embodiment of the invention, it is provided that, in the event of a control device failure or an error in the execution of the program code, a check is made as to whether an association plan for associating the remaining active program code with the available control units already exists in the control system. This makes it possible to dispense with complex and energy-intensive recalculations for optimal distribution of the active program code on the control devices. This makes it possible to fully utilize the computing power of the control system for the autonomous driving operation, thereby providing a higher degree of target achievement and thus a greater safety reserve.

[0018] In a preferred embodiment of the method, it is provided that, in the event of a control failure or an error in the execution of the program code, a check is made as to whether an association plan for associating the remaining active program code with the available control units already exists in the control system. In this way, in the case of an emergency plan in the central layout, a reconfiguration of the control system can be achieved quickly. In the case that the current global layout does not yet provide an emergency plan, a corresponding solution can be calculated locally, which can then be shared with motor vehicles of the same type by uploading it to a computing center. In this way, the central layout can be further optimized based on the fault event.

[0019] In this case, the program code is particularly preferably associated with the control unit accordingly when an association plan is present. This ensures that even after a control unit failure or an error in the execution of the program code, the highest possible degree of target achievement can be achieved for the autonomous driving operation.

[0020] As an alternative, it is advantageously provided that, without associated planning, a check is performed to determine whether the minimum number of redundantly executed program codes required for autonomous driving operation exists. This allows calculation of the risk of a hazardous traffic situation arising from a control unit failure or an error in the execution of program codes, and measures are initiated as quickly as possible in order to minimize the consequences of an error or a malfunction.

[0021] In a further development of the method, it is provided that the fail-safe system stops the motor vehicle and / or drives it to the next safe parking point when a minimum number of redundantly executed program codes is fallen below. Normally, braking the motor vehicle until it stops results in a solution to the situation. However, in certain driving situations, for example in dark tunnels, on highways, in particular on highway construction sites, stopping the motor vehicle can lead to dangerous traffic situations. In this case, it is preferred that the fail-safe system at least enables the motor vehicle to continue driving autonomously until a parking place that is safe for the motor vehicle is reached and a traffic-endangering situation is avoided.

[0022] Furthermore, it is advantageously provided that, when a sufficient number of redundant program codes are executed to implement the autonomous driving operation, the control system is operated in an emergency mode and a dependent plan is established. In particular, the driving speed can be limited and other vehicle functions, in particular comfort functions of the motor vehicle, can be limited in order to prioritize and safeguard safety-related functions.

[0023] In an advantageous embodiment of the method, it is provided that the control system is checked and free or only slightly used control units are determined, and that a linkage plan is produced based on the free control units determined.

[0024] It is particularly preferred that the program code for fulfilling the autonomous driving function is divided into at least two weighting levels, wherein the program code with a lower weight is stopped in order to provide additional computing power for executing the program code with a higher weight. By multiple redundancies of the functions of the higher and highest weighting levels, it can be achieved that the failure of a control device does not lead to a traffic-threatening operating state and is not noticeable to the occupants of the motor vehicle or is only noticeable as a restriction of driving comfort.

[0025] In a preferred embodiment of the invention, it is provided that an optimization routine is carried out, which optimizes the program code to be executed for the remaining control units, wherein the result of the optimization is transmitted to the computing unit. As a result, an automatic learning network can be implemented in the computing center, so that the global layout diagram can be optimized based on the data collected in the motor vehicle.

[0026] In an advantageous embodiment of the method, it is provided that the global topology is determined based on different control systems of motor vehicles of the same type. Since similar errors and failure mechanisms are expected in motor vehicles of the same type with the same or similar hardware and software configuration, it is advantageous to calculate the global topology for a specific vehicle model or a corresponding model series in order to provide correspondingly optimized emergency solutions for vehicles of the same type before errors occur in the execution of the program code or before a control unit fails.

[0027] In a further development of the method, it is provided that the global layout is transmitted to the motor vehicle when the motor vehicle is at a charging station. The load on the control system of the motor vehicle is reduced as much as possible during the charging process. In addition, unlimited energy is provided so that data transmission does not sacrifice the range of the motor vehicle. It is therefore advantageous that the solution of the global layout is transmitted to the control system of the motor vehicle during the charging process. In addition, the motor vehicle can also transmit the locally calculated solution map to the computing center after a control unit failure or an error in the execution of the program code, so that the solution can be shared and used by other motor vehicles.

[0028] Another aspect of the invention relates to a control system comprising a plurality of control devices, wherein the control system is configured to carry out such a method for operating a motor vehicle at least semi-autonomously when a plurality of machine-readable program codes are executed by at least two control devices of the control system.

[0029] In addition, the vehicle implementing the method according to the present invention also has a driving system configured for automatic driving operation of the vehicle. The driving system is particularly configured for fully automatic longitudinal and / or lateral guidance of the vehicle. For this purpose, the driving system preferably uses a large amount of sensor data measured by the vehicle and communication data received by the vehicle. The driving system is particularly configured to implement driving assistance functions until fully automatic driving is achieved. For this purpose, the driving system has a control algorithm, which is at least partially based on machine learning and has, for example, a target function and / or a neural network. Therefore, in order to operate the driving system, functional data, such as parameters of a neural network or optimized functional parameters, are required. The functional data is stored in the driving system of the vehicle as a functional data set. At the beginning of the method according to the present invention, the (relative) first functional data set is always stored in the driving system of the vehicle.

[0030] The vehicle implementing the method according to the invention also has a control unit. The control unit is preferably designed to communicate with other components of the vehicle, in particular with the first communication module and with the driving system and, if necessary, with sensors, and coordinate their functions. In addition, the control unit also preferably has a memory or controls the memory.

[0031] In a particularly preferred embodiment, the functional scope of the driving system increases with increasing authorization level of the vehicle. In other words, the degree of automation of the driving operation increases with increasing authorization level of the vehicle. Particularly preferably, the authorization level of the vehicle is associated with different levels of autonomous driving. Particularly preferably, the vehicle has authorization level 0 in the factory state. Furthermore, authorization level 0 preferably corresponds to automation level 0 ("driver only"), according to which the longitudinal and lateral guidance is continuously carried out by the driver and the driving system does not actively intervene in the driving operation.

[0032] In a preferred embodiment of the method according to the invention, authorization level 1 corresponds to automation level 1 ("assisted"), according to which the driver is constantly responsible for longitudinal and lateral guidance, while the driving system assumes the corresponding other functions. In addition, authorization level 2 preferably corresponds to automation level 2 ("semi-automated"), according to which the driver must constantly monitor the vehicle, and the driving system assumes longitudinal and lateral guidance in special application cases.

[0033] Furthermore, preferably authorization level 3 corresponds to automation level 3 ("high automation"), according to which the driver does not need to constantly monitor the vehicle, but must potentially be able to assume control of the vehicle. According to automation level 3, the driving system also assumes longitudinal and lateral guidance in special application cases, also independently recognizes the limits of the driving system, and requires the driver to have sufficient time reserves to assume control. Authorization level 4 preferably corresponds to automation level 4 ("full automation"), according to which the driver is not required in special application cases and the driving system responds to the situation completely autonomously in the special application case.

[0034] Likewise, preferred authorization level 5 corresponds to automation level 5 ("without driver"), according to which driving is never performed without a driver and the driving system assumes full responsibility for driving in all application cases. The above definition corresponds to the "five levels of automated driving" defined by the German Association of the Automotive Industry (Verband der Deutschen Automobilindustrie, VDA). The corresponding application cases include street type, speed range and environment or environmental conditions.

[0035] Another aspect of the invention relates to a vehicle, in particular a passenger car, which is configured to carry out the steps of the vehicle in the method according to the invention, and which has an internal combustion engine, an electric engine or a hybrid engine. For this purpose, the vehicle has at least one sensor for detecting environmental data, via which data for autonomous driving operation are provided to a control device of a control system.

[0036] Another aspect of the invention relates to a computer program comprising a program code for carrying out the steps of such a method for operating a motor vehicle at least partially autonomously when the program code of the computer program is executed in a computer.

[0037] The method steps of the method according to the present invention can be implemented by electrical or electronic components or parts (hardware), by firmware (ASIC), or by implementing a suitable program (software). It is also preferred that the method according to the present invention is implemented or executed by a combination of hardware, firmware and / or software. For example, the various components for implementing the various method steps are constructed as independent integrated circuits, or are arranged on a common integrated circuit. In addition, the various components for implementing the various method steps are preferably arranged on a (flexible) printed circuit carrier (FPCB / PCB), a tape carrier package (Tape Carrier Package, TCP) or other substrates.

[0038] The individual method steps of the method according to the invention are also preferably configured as one or more processes, which are run on one or more processors in one or more electronic computing devices and are generated by one or more computer programs during execution. The computing device is preferably configured to work with other components, such as a communication module and one or more sensors or cameras, in order to realize the functions described herein. The instructions of the computer program are preferably stored in a memory, such as a RAM element. However, the computer program can also be stored in a non-volatile storage medium, such as a CD-ROM, a flash memory, etc.

[0039] Furthermore, it is obvious to a person skilled in the art that the functions of a plurality of computers (data processing devices) can be combined or can be combined in a single device, or that the functions of a particular data processing device can be distributed over a plurality of devices in order to implement a plurality of steps of the method according to the invention without deviation from the method according to the invention.

[0040] The various embodiments of the invention mentioned in this application can advantageously be combined with one another, unless otherwise stated individually. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The present invention is described below in the following embodiments according to the accompanying drawings. In the accompanying drawings:

[0042] Figure 1 A schematic diagram of a system according to the invention is shown, which consists of a motor vehicle according to the invention with sensors and a control device for carrying out an at least semi-autonomous driving operation of the motor vehicle.

[0043] Figure 2 A control system according to the invention is shown with a plurality of control units which execute a plurality of program codes for controlling an at least semi-autonomous driving operation.

[0044] Figure 3 The control system according to the invention with a plurality of control units is shown in the event of a control unit failure or a program code corruption, wherein the failed functions are assumed by redundant program codes on other control units.

[0045] Figure 4 A global layout diagram is shown which is used to determine the best association of the executed program code with the available control units.

[0046] Figure 5 A flow chart is shown for monitoring a control system and reconfiguring the control system in the event of a control unit failure and / or an error in program code execution.

[0047] Figure 6The figures show different views of the communication between a motor vehicle and a central processing unit, wherein a reconfiguration carried out in the motor vehicle is communicated to the central processing unit and / or the central processing unit communicates an optimal reconfiguration to the motor vehicle.

[0048] Figure 7 The diagram shows a communication between a central processing unit and a motor vehicle, wherein the central processing unit exchanges additional information with other data sources. DETAILED DESCRIPTION

[0049] Figure 1 A schematic diagram, in particular a block diagram, of an exemplary motor vehicle 1, in particular a two-track vehicle, with an internal combustion engine, an electric engine or a hybrid engine is shown. The motor vehicle 1 comprises a plurality of first-class sensors, in particular a first sensor 32, a second sensor 34 and a third sensor 36. The first-class sensors 32, 34, 36 are designed to detect environmental data of the motor vehicle 1 and include, for example, cameras for detecting images of the environment in the immediate vicinity of the motor vehicle 1, distance sensors, such as ultrasonic sensors or LIDAR, for detecting the distance to objects around the motor vehicle 1. The first-class sensors 32, 34, 36 transmit the environmental signals detected thereby to the control units 12, 14, 16, 18 of the control system 10 of the motor vehicle 1.

[0050] Furthermore, the motor vehicle 1 comprises a plurality of second-class sensors, in particular a fourth sensor 38, a fifth sensor 40 and a sixth sensor 42. The second-class sensors 38, 40, 42 are sensors for determining state data related to the motor vehicle 1 itself, for example, the current position and movement information of the motor vehicle 1. The second-class sensors are therefore, for example, speed sensors, acceleration sensors, inclination sensors, sensors for measuring the immersion depth of shock absorbers, wheel speed sensors, etc. The second-class sensors 38, 40, 42 transmit the state signals measured by them to the control unit of the motor vehicle 1. The second-class sensors 38, 40, 42 transmit their measurement results, in particular, directly to the control units 12, 14, 16, 18 of the control system 10 of the motor vehicle 1.

[0051] The motor vehicle 1 also has a control system 10, which is configured for fully automatic driving operation of the motor vehicle 1, in particular for autonomous longitudinal and transverse guidance of the motor vehicle 1. The control system 10 has a navigation module 64, which is configured for calculating a route between a starting point and an end point and for determining the maneuvers to be performed by the motor vehicle 1 along the route. The navigation module 44 is also preferably designed to perform special maneuvers of the motor vehicle 1, such as driving into and out of a parking space. In addition, the control system 10 also includes an internal memory 66, which communicates with the navigation module 44, for example, via a suitable data bus. In particular, models, neural networks and / or target functions based on machine learning, at least in part, are stored in the internal memory 46. In addition, functional data for the models, neural networks and / or target functions are stored in the internal memory 46 as functional data sets. The functions of the control system 10 are preferably controlled by a control unit and are unlocked in particular according to the authorization level of the motor vehicle 1.

[0052] The control system 10 is configured to implement the steps of the motor vehicle 1 in the method according to the invention. In this case, the control system 10 implements the steps of the method by means of control units 12, 14, 16, 18 or controls other components of the motor vehicle 1 accordingly. For this purpose, the control units 12, 14, 16, 18 each have an internal memory 46 and a CPU 48, which communicate with each other, for example, via a suitable data bus. In addition, the control units 12, 14, 16, 18 of the control system 10 are connected in communication with at least one type of sensor 32, 34, 36 and a second type of sensor 38, 40, 42 and, if necessary, other control devices of the motor vehicle 1, for example, control devices for controlling a heating or air conditioning system, a radio, a navigation system or other information or entertainment systems of the motor vehicle. The communication is realized, for example, via one or more corresponding CAN connections, one or more corresponding SPI connections or other suitable data connections. A communication interface with an external computing center 64 is formed on the motor vehicle 1 for sending and receiving data.

[0053] Figure 2The schematic configuration of a control system 10 for controlling an at least semi-autonomous, preferably fully autonomous motor vehicle 1 is shown. The control system 10 comprises four control units 12, 14, 16, 18, which respectively execute at least one program code 20, 22, 24, 26, 28, 30 for implementing a semi-autonomous or fully autonomous driving operation of the motor vehicle 1. In this case, each program code 20, 22, 24, 26, 28, 30 is redundantly installed on two different control units 12, 14, 16, 18. Here, the corresponding program code 20a, 22a, 24a, 26a, 28a, 30a is actively executed by the control unit 12, 14, 16, 18 and the corresponding program code 20a, 22a, 24a, 26a, 28a, 30a is analyzed to control the motor vehicle 1, while the corresponding redundant program 20p, 22p, 24p, 26p, 28p, 30p remains passive and is only integrated into the control of the motor vehicle 1 when the previously active program 20a, 22a, 24a, 26a, 28a, 30a can no longer be analyzed to control the motor vehicle 1 due to an error or failure of the corresponding control unit 12, 14, 16, 18.

[0054] The layout of the program code 20, 22, 24, 26, 28, 30 can be changed several times during the operation of the motor vehicle 1. For example, a change to a new application layout may be necessary after an event such as an error in a control unit 12, 14, 16, 18 or an error in an application instance. In addition to the above-mentioned events, the identification of a possible optimization possibility can also trigger a switch to a new control unit 12, 14, 16, 18. Figure 3 1 shows this situation by taking the failure of the second control unit 14 as an example. The third program code 24a is executed by the second control unit 14 in the initial state. After the failure of the second control unit 14 or the program crash of the third program code 24a that was previously actively executed on the second control device 14, the third program code 24p on the third control unit 16 is activated and the third program code 24p is analyzed to continue to control the motor vehicle 1. This can avoid serious driving situations caused by lack of control of the motor vehicle 1.

[0055] In order to optimize the active program code 20a, 22a, 24a, 26a, 28a, 30a, it is necessary to know the current driving situation and the current performance of the control system 10. Here, under system conditions, reference is made to the performance of all software applications 20, 22, 24, 26, 28, 30, all control devices 12, 14, 16, 18 and other hardware, in particular to the sensors 52, 54, 56, 58, 60, 62.

[0056] The following example illustrates this dependency:

[0057] Assume that the motor vehicle 1 is an electric car that takes its passengers to an important meeting, and the battery of the motor vehicle 1 is almost empty. In this case, the goal of arriving at the desired destination on time is more important than the entertainment of the passengers. Therefore, in order to increase the cruising range of the motor vehicle 1, all applications used for entertainment purposes can be stopped. Therefore, some control devices 12, 14, 16, 18 can be turned off, which saves energy.

[0058] Assume that the motor vehicle 1 is in a traffic jam. Since the motor vehicle 1 is hardly moving, redundant instances of the driving function can be stopped. Thus, resources are freed up that could be used to execute applications that help improve traffic flow, for example.

[0059] Due to the system crash, half of the control devices 12, 14, 16, 18 installed in the motor vehicle are no longer functional. Since the resources provided by the remaining control devices 12, 14, 16, 18 are not sufficient to execute all the program codes 20, 22, 24, 26, 28, 30 of the applications executed before the crash, a new application layout plan must be calculated. The goal of the layout optimization is to map all the applications required to park the motor vehicle 1 safely in order to ensure the safety of the occupants and other traffic participants.

[0060] exist Figure 4 , a global layout diagram 62 is shown, which can also be referred to as an association diagram 62. In the present invention, a dynamic, context-dependent optimization is performed by abstracting the local computing problem of associating the program code 20, 22, 24, 26, 28, 30 with the corresponding control units 12, 14, 16, 18 in the control system 10 of the motor vehicle 1, 80, 82, 84 into a global computing problem. The computing problem is solved by a computing center 64, in particular by a cloud computer system 66. As a result, different participants can help to jointly calculate the global layout diagram 62 and partially transfer computing and cost-intensive tasks from the control system 10 of the motor vehicle to the computing center 64. This has the advantage that the motor vehicle 1, 80, 82, 84 can react to errors more quickly and can quickly work according to the desired ASIL level after the problems that have occurred are solved.

[0061] The dynamic, context-dependent arrangement of the software in the motor vehicle also offers the advantage that an optimization of the energy consumption is conceivable, thereby making it possible to increase the cruising range of electrically driven motor vehicle 1 .

[0062] exist Figure 5, a flowchart for monitoring a control system and reconfiguring a control system when an error occurs during control unit failure and / or program code execution is shown. In the first method step I, the execution of program code 20, 22, 24, 26, 28, 30 on the control unit 12, 14, 16, 18 of the control system 10 is monitored by a monitoring element 52. Here, if an error is identified, then in the second method step II, it is checked whether there is a pre-calculated emergency plan or whether such a plan must be established. For the situation where there is no emergency plan (the emergency plan provides a pre-calculated dynamic association of the executed program code 20, 22, 24, 26, 28, 30 with the control unit 12, 14, 16, 18), in the third method step III, it is checked whether enough redundant programs can be executed to ensure the autonomous driving operation of operational safety. If this precondition is met, then in the fourth method step IV, the corresponding redundantly executed program code is selected and executed on other control units 12, 14, 16, 18 by a switching element 54. In this case, in method step V, this new configuration is selected as new active program code 20 , 22 , 24 , 26 , 28 , 30 .

[0063] If, after a failure of control units 12, 14, 16, 18, there is no longer enough computing power available to ensure safe autonomous driving of motor vehicle 1, in method step VI an emergency operation module 56 is activated which assumes system control of control system 10. In this case, in method step VII motor vehicle 1 is safely parked.

[0064] If sufficient redundancy is available, a recovery module 58 is activated, which seeks to restore the software configuration with the highest possible degree of target achievement. To this end, in method step VIII, a search is conducted for a control unit 12, 14, 16, 18 that has sufficient resources for additionally executing the redundant program code 20, 22, 24, 26, 28, 30. If such a control unit is found, in method step IX, the new redundant program code 20, 22, 24, 26, 28, 30 is executed on the control unit 12, 14, 16, 18. If there are currently no sufficient free resources on the control unit 12, 14, 16, 18, in method step X, the program code with a lower priority is stopped in order to provide additional computing power for the safety-related program code.

[0065] If, after the check in method step II, a pre-calculated contingency plan exists, then in method step XI, the contingency plan is implemented by the layout optimizer 60, and the implementation of the contingency plan is fed back to the computing center 64 via the communication interface 50. If no contingency plan exists, then in method step XII, the objectives for implementing the contingency plan are defined by the layout optimizer 60, an optimized plan is calculated therefrom in method step XIII, and the optimized plan is implemented in method step XIV.

[0066] exist Figure 6 , the data exchange between the global layout map 62 calculated in the computing center 64 and the different motor vehicles 1, 80, 82, 84 is shown. In this case, a solution map is calculated in the first motor vehicle 1. The second motor vehicle 80 downloads the global layout map 62 and transmits it to the control system 10 of the second motor vehicle 80. In the third motor vehicle, another solution map is calculated and transmitted to the computing center 64. This solution map for the partial problem is uploaded to the computing center 64 by the fourth motor vehicle 84.

[0067] exist Figure 7 , the communication between a computing center 64 with a central layout 62, a motor vehicle 1 and further data sources 66, 70, 76 is shown. Here, information provided in particular by a mobile phone 70, particularly preferably by a smartphone, a cloud computer system 66 or a server 68 can be considered as further data sources. In addition, the global layout 62 can also be further improved by a road-side unit (Road-Site-Unit, RSU) 76. The transmission of the concept of the central layout to the control system 10 of the motor vehicle preferably takes place during the charging process of the electrically driven motor vehicle 1 at the charging station 74. This process can be triggered by the control unit 72 of the charging station 74 or by the control system 10 of the motor vehicle 1. In this case, during the charging process, both sufficient energy and computing power are provided so that the optimization map can be transmitted to the control system 10 of the motor vehicle 1 and implemented there.

[0068] Reference numerals list

[0069] 1 Motor Vehicle

[0070] 10 Control System

[0071] 12. First control unit

[0072] 14 Second control unit

[0073] 16 Third control unit

[0074] 18 Fourth control unit

[0075] 20 First Program Code

[0076] 22 Second program code

[0077] 24 Third Program Code

[0078] 26 Fourth Program Code

[0079] 28 Fifth Program Code

[0080] 30 Sixth Program Code

[0081] 32 First Sensor

[0082] 34 Second sensor

[0083] 36 Third sensor

[0084] 38 Fourth sensor

[0085] 40 Fifth Sensor

[0086] 42 Sixth Sensor

[0087] 44 Navigation module

[0088] 46 Internal Memory

[0089] 48 CPU

[0090] 50 Communication interface

[0091] 52 Monitoring components

[0092] 54 Switching elements

[0093] 56 Emergency operation module

[0094] 58 Recovery Module

[0095] 60 Layout Optimizer

[0096] 62 Global Layout

[0097] 64 Computing Center

[0098] 66 Cloud Computer System

[0099] 68 Servers

[0100] 70 Mobile Phone

[0101] 72 Fifth control unit

[0102] 74 Charging Stations

[0103] 76 Roadside Unit

[0104] 78 Transceiver Unit

[0105] 80 Second Motor Vehicle

[0106] 82 Third Motor Vehicle

[0107] 84 Fourth Motor Vehicle

[0108] 100 Computer Programs

Claims

1. A method for dynamically distributing program code in a control system of a vehicle based on context, wherein: The control system has a plurality of control devices, wherein the method comprises: receiving a global map in the control system from an external computing unit, wherein the global map includes a current configuration and one or more pre-computed reconfigurations for performing vehicle functions based on the plurality of control devices of the control system; The program code that satisfies the functions for the autonomous driving operation is associated with the corresponding control devices of the control system by means of the current configuration of the global layout; Monitoring at least one of the program code and / or the control device by a monitoring element to determine whether at least one of the program code and / or the control device has an error; and If the monitoring determines that at least one of the program code and / or the control device is faulty, a redistribution of the program code to the control devices is performed based on one or more precalculated reconfigurations of the global topology.

2. The method according to claim 1, characterized in that In the event of a control unit failure or an error in the execution of the program code, a check is performed to determine whether a linkage plan is already present in the control system for linking the remaining active program code to the available control units.

3. The method according to claim 2, characterized in that If a linkage map exists, the remaining active program code is respectively linked to the available control devices by means of the linkage map.

4. The method according to claim 2, characterized in that: Check whether there is a minimum amount of redundantly executed program code required for autonomous driving operation without associated planning.

5. The method according to claim 4, characterized in that When a minimum number of redundantly executed program codes is fallen below, the motor vehicle is stopped by the fail-safe system and / or is driven to the next safe parking point.

6. The method according to claim 5, characterized in that When a sufficient number of redundant program codes required to implement autonomous driving operation are executed, the control system is operated in emergency operation and an associated plan is established.

7. The method according to claim 1, characterized in that The control system is checked and idle or only slightly used control devices are determined, and a linkage plan is created based on the idle control devices determined.

8. The method according to claim 7, characterized in that Program code that meets the functions for autonomous driving operation is divided into at least two weight levels, wherein program code with a lower weight is stopped in order to provide additional computing power for the execution of program code with a higher weight.

9. The method according to claim 1, characterized in that: An optimization routine is executed which optimizes the program code to be executed for the remaining control devices, wherein the result of the optimization is transmitted to the computing unit.

10. The method according to any one of claims 1 to 9, characterized in that The global layout diagram is determined based on different control systems of motor vehicles of the same type, information from a server, information from a mobile phone, information from a roadside unit and / or other traffic information systems.

11. The method according to any one of claims 1 to 9, characterized in that When the motor vehicle stops at the charging station, the global layout map is transmitted to the motor vehicle.

12. A control system comprising a plurality of control devices, wherein: The control system is configured to carry out the method according to any one of claims 1 to 11 when a plurality of machine-readable program codes are executed by at least two control devices of the control system. 13 . A motor vehicle having a control system which is configured to carry out the method according to claim 1 .

14. A computer program with a program code for carrying out the steps of the method according to any one of claims 1 to 11 when the program code is executed on a computer.

Images