Method for dynamically distributing software based on context in control system and control system

Abstract

The invention relates to a method for dynamically and context-basedly distributing program code in a control system of a vehicle. The control system has a plurality of control devices for executing the program code. The program code is distributed to the corresponding control devices of the control system via a global placement map. The global placement map is calculated on a computing unit located outside the control system. The data of the global placement map are transmitted to the control system. It is provided that the global placement map is calculated based on the current configuration and a known reconfiguration, wherein the selection of the next node to be calculated in the global placement map is calculated based on the probability of occurrence of an error and the influence of the error. The invention also relates to an at least partially autonomous motor vehicle having a control system for carrying out such a method.

Description

Technical Field

[0001] The invention relates to a method for dynamically and context-basedly distributing software in a control system of a motor vehicle, wherein the control system has a plurality of control devices, wherein the program code is distributed to the corresponding control devices of the control system via a global placement map, wherein the global placement map is calculated on a computing unit located outside the control system, and wherein the data of the global placement map are transmitted to the control system. The invention also relates to a control system for carrying out such a method, a motor vehicle having such a control system, and a computer program product. Background Art

[0002] Today's vehicles already have a large number of assistance systems that support the driver in a computer-based manner in a large number of driving situations. Such assistance systems can use sensors for detecting a large amount of measurement data that far exceeds the perceptual capacity of humans. In addition, the speed of these assistance systems significantly exceeds the reaction time of humans. Known driver assistance systems are, for example, lane keeping assistants, brake assistants when pedestrians are detected, and distance control cruise control, which is used in particular in traffic jams.

[0003] By using such assistance systems, the driver's autonomy regarding his driving decisions is increasingly transferred to the vehicle or to the correspondingly operated control devices. At the end of these developments, self-propelled vehicles have emerged that can be fully maneuvered without human intervention. With the help of such self-propelled vehicles, fully automated personnel transportation is possible.

[0004] The driving operation of a motor vehicle, in particular a self-propelled vehicle, is controlled by a driving system, which in the context of the present application is to be understood in the broadest sense as a control device that is specially designed and configured for this task. The control device is designed to automatically guide the vehicle in the transverse and longitudinal directions using a large number of input signals, in particular sensor data detected by the vehicle itself and received communication data. Such control of the automatic transverse and longitudinal guidance places complex computational demands on the driving assistance system, which for this purpose usually has algorithms, models and control functions that are at least partially based on machine learning (artificial intelligence).

[0005] In order to operate an autonomous car safely, a large number of software applications that interact with each other are required. The problem, however, is that errors within the scope of the software applications or computing nodes, for example, can result in some applications no longer being able to be executed. Depending on the importance of the application, this can have dramatic consequences for the safety of passengers and other traffic participants.

[0006] In order to avoid the dramatic consequences of errors that occur, the software application can be executed redundantly on different computing nodes. The idea here is to execute the redundant instance in passive mode. This means that the redundant instance executes the same process as the active instance, but does not interact with the execution system.

[0007] Depending on the functional relevance of the respective functions, this may lead to uncontrolled driving states, loss of comfort or even danger to the passengers of the autonomously driven motor vehicle. It is known to redundantly execute safety-related systems in order to avoid dangerous driving situations in an operationally safe manner.

[0008] The task of determining the distribution between application instances and computing nodes is not an easy one. The decision depends on many different parameters. For example, computing nodes have only a limited amount of computing and storage resources. On the other hand, each application requires a specific amount of resources in order to work as planned. In order to ensure that all applications can be executed on the computing nodes installed in the vehicle, the multidimensional and complex application placement problem (Anwendungs-Platzierungs-Problem) must be solved.

[0009] As already mentioned, dangerous situations due to software or hardware errors can be (partially) prevented by redundant software design. However, the introduction of redundant application instances increases the complexity of the application placement problem, because additional parameters must be taken into account. For example, a minimum number of redundant instances can be given for each application. In addition, a minimum degree of hardware separation can be defined for each application. This parameter specifies how many different computing nodes the instances of the application must be executed on at least. In this case, the number of available control devices and the requirements for minimum hardware separation in terms of the program lead to distribution problems.

[0010] Due to the high number of software applications required to run an autonomous vehicle (in the order of hundreds of applications), there is generally a large number of valid allocations between computing nodes and application instances. However, not all valid allocations are equally "good". In order to select the best possible mapping, an optimization goal must be formulated. This optimization goal can be formulated, for example, so that a mapping that shuts down as many computing nodes as possible is preferred over a mapping that uses all computing nodes with which the vehicle is equipped. In addition to this optimization goal, various other objective functions that take into account other criteria can also be envisaged.

[0011] In the event of disturbances in the functionality of a control system due to failures of sensors, control devices or errors in the program code, it may be necessary to reconfigure the software on the various control devices of the control system in order to be able to perform the functions of the control system in an operationally reliable manner again.

[0012] A cloud computer system and a method for operating such a system are known from US 2016 / 0142253 A1, wherein the cloud computer system can exchange data with an external computing unit, such as a workstation computer, a smartphone, a laptop or a control device in a motor vehicle.

[0013] Such solutions are known, for example, for navigation systems of motor vehicles, in which, by means of a large number of external data acquisition modules and the evaluation of these data by a cloud computer system, real-time navigation is possible, taking into account current traffic density and current traffic disturbances. Summary of the invention

[0014] The present invention is now based on the object of improving the process of reconfiguring the software on a control system if this is necessary and thereby minimizing the required computing power and energy consumption in the motor vehicle.

[0015] According to the invention, this task is solved by a method for dynamically and contextually distributing program code in a control system of a vehicle. In this case, the control system has a plurality of control devices for executing the program code. The program code is distributed to the corresponding control devices of the control system by a global placement graph. In this case, the global placement graph is calculated on a computing unit located outside the control system. The data of the global placement graph are transmitted to the control system. According to the invention, the global placement graph is calculated based on the current configuration and a known reconfiguration, wherein the selection of the next node to be calculated of the global placement graph is calculated based on the probability of occurrence of an error and the influence of the error. From this, a relocation plan (Re-Lokationsplan) for distributing the executed program code to the control devices can be calculated, which provides pre-calculated alternative distribution graphs for the most severe interferences and failures, respectively, so that relocation can be performed when safety-related control devices and / or safety-related program codes fail. In this case, dynamic optimization can be performed outside the motor vehicle in a computing center, in particular a cloud computer system, thereby alleviating the burden on the control devices of the motor vehicle.

[0016] The features listed here enable advantageous improvements and meaningful extensions of the method described according to the invention for the dynamic, context-based distribution of software in a control system of a motor vehicle.

[0017] In a preferred embodiment of the method, it is provided that a plurality of categories are formed for the probability of occurrence and the influence of errors, wherein the errors are assigned to the probability of occurrence and the influence categories. By dividing the probability of occurrence and the influence of errors into different categories, possible system disturbances can be weighted in a simple manner. Thus, a corresponding alternative distribution plan can be calculated first for the failure of critical functions, while the relocation of errors with non-safety-related error consequences can be set with a correspondingly lower priority. Thus, the safety level of the system can be further increased in the event of a failure of a control device and / or in the event of an error when executing a program code.

[0018] Preferably, the probability of occurrence and the influence of the error are weighted and specified, wherein the node of the global placement graph with the highest weighting factor is calculated based on the weighting. Here, a weighting factor that can be easily quantified can be determined by the weighting, wherein the node of the global placement graph with the highest weighting factor is calculated first.

[0019] In this case, the weighting factor is particularly preferably determined as the product of the occurrence probability and the influence of the error. Thus, when selecting the next node to be calculated, both the occurrence of the error and the influence of the error can be taken into account.

[0020] In an advantageous extension of the method, it is provided that four different categories are set for the error effects. This ensures that unimportant errors or errors that are not safety-related are weighted accordingly weakly, while life-threatening errors are weighted relatively highly. Here, sufficient grading between the various error types can be performed by means of the four categories.

[0021] In this case, a first error class describes errors with no risk of injury, a second error class describes errors with a lower risk of injury, a third error class describes errors with a serious risk of injury, and a fourth error class describes errors that may lead to life-threatening injury.

[0022] Furthermore, in a further development of the method it is provided that the occurrence probabilities are divided into at least four different categories, wherein the division of the occurrence probabilities with regard to error influences allows for an improved weighting of potential errors.

[0023] Furthermore, at least four categories for probability of occurrence and at least four categories for error impact can form a corresponding matrix which enables errors and error consequences to be quantified and weighted in a simple manner, thereby respectively calculating the nodes of the global placement diagram covering the potentially greatest risk.

[0024] In a preferred embodiment of the invention, it is provided that in the event of a failure of a control device or an error in the execution of a program code, a check is performed to determine whether a distribution plan for distributing the remaining active program code to the available control devices already exists for the control system. This makes it possible to dispense with the complex and energy-intensive recalculations for optimally distributing the active program code to the control devices. The computing power of the control system can thus be fully utilized for autonomous driving operations, thereby providing a higher level of target achievement and thus a greater safety reserve.

[0025] In a preferred embodiment of the method, it is provided that, in the event of failure of a control device or an error in the execution of a program code, a check is performed to determine whether a distribution plan for distributing the remaining active program code to the available control devices already exists for the control system. Thus, in the presence of an emergency plan from a central placement diagram, a reconfiguration of the control system can be quickly implemented. In the event that an emergency plan is not currently available from the global placement diagram, a corresponding solution can be calculated locally, which can then be shared with motor vehicles of the same type by uploading it to a data center. The central placement diagram can thus be further optimized based on failure events.

[0026] Furthermore, it is advantageously provided that, if a sufficient number of redundant program codes required for carrying out the autonomous driving operation have been executed, the control system is operated in an emergency mode and an allocation plan is created. In this case, in particular, the driving speed can be limited and other vehicle functions, in particular comfort functions of the motor vehicle, can be limited in order to prioritize and ensure safety-related functions.

[0027] In another development of the method, it is provided that if a minimum number of redundantly executed program codes is fallen below, the motor vehicle is stopped by a fail-safe system and / or the motor vehicle is controlled to the nearest safe stopping point. Usually, braking the motor vehicle to a standstill can lead to a mitigation. However, in certain driving situations, such as in unlit tunnels, on highways, in particular at highway construction sites, the stopping of a motor vehicle may lead to dangerous traffic situations. In this case, it is preferred that the fail-safe system can at least autonomously continue to drive the motor vehicle until a safe stopping position of the motor vehicle is reached and a traffic-threatening situation is avoided.

[0028] According to an advantageous embodiment of the method, the global placement diagram is determined based on different control systems of motor vehicles of the same type, information from servers, information from mobile phones, information from roadside units and / or other traffic information systems. In this case, the computing power can be provided by a computing element external to the vehicle and the burden on the control system of the motor vehicle can be relieved. As a result, the energy demand of the motor vehicle can be reduced and the cruising range can be increased. In addition, solutions can be pre-calculated by calculations external to the vehicle before a corresponding error occurs in the motor vehicle, so that when the error occurs, a corresponding plan can be provided for dynamically deploying the executed program code to the remaining control devices.

[0029] Another aspect of the invention relates to a control system comprising a plurality of control devices, wherein the control system is designed to carry out such a method for operating a motor vehicle at least partially autonomously when a plurality of machine-readable program codes are executed by at least two control devices of the control system.

[0030] The vehicle that performs the method according to the invention also has a driving system that is set up for the automatic driving operation of the vehicle. The driving system is particularly set up for the fully automatic longitudinal and / or transverse guidance of the vehicle. For this purpose, the driving system preferably accesses a large amount of sensor data detected by the vehicle and communication data received by the vehicle. The driving system is particularly configured to perform driving assistance functions up to fully automatic driving. For this purpose, the driving system has the following control algorithm, which is at least partially based on machine learning and has, for example, an objective function and / or a neural network. Therefore, in order to operate the driving system, the following functional data are required, which, for example, have parameters of a neural network or optimized functional parameters (Funktionsparameter). These functional data are stored in the driving system of the vehicle as functional data sets (Funktionsdatensatz). At the beginning of the method according to the invention, the (relatively speaking) first functional data set is always stored in the driving system of the vehicle.

[0031] The vehicle that performs the method according to the invention also has a control device. The control device is preferably designed to communicate with other components of the vehicle, in particular with the first communication module and the driving system, and if necessary also with sensors, and coordinate their functions. The control device also preferably has a memory or monitors the memory.

[0032] In a particularly preferred embodiment, the functional scope of the driving system increases with increasing authorization level of the vehicle. In other words, the degree of automation of the driving operation increases with increasing authorization level of the vehicle. Particularly preferably, the authorization level of the vehicle is associated with different levels of autonomous driving. Particularly preferably, the vehicle has authorization level 0 in the delivery state. Furthermore, authorization level 0 preferably corresponds to automation level 0 ("driver only"), according to which the driver continuously performs the longitudinal and lateral guidance and the driving system does not actively intervene in the driving operation.

[0033] In a preferred embodiment of the method according to the invention, authorization level 1 corresponds to automation level 1 ("assisted"), according to which the driver permanently assumes longitudinal or transverse guidance and the drive system accordingly assumes other functions. It is also preferred that authorization level 2 corresponds to automation level 2 ("partial automation"), according to which the driver must permanently monitor the vehicle and the drive system takes over longitudinal and transverse guidance in certain application cases.

[0034] Furthermore, preferably, authorization level 3 corresponds to automation level 3 ("high automation"), according to which the driver does not have to constantly monitor the vehicle, but must potentially be able to take over the monitoring of the vehicle. According to automation level 3, the driving system can also take over longitudinal and lateral guidance in certain application situations, and furthermore independently recognize the limitations of the driving system and request the driver to take over the monitoring with sufficient time reserves. Preferably, authorization level 4 corresponds to automation level 4 ("full automation"), according to which a driver is not required in certain application situations and the driving system is fully capable of taking over the monitoring in certain application situations completely autonomously. The situation.

[0035] Likewise preferably, permission level 5 corresponds to automation level 5 ("unmanned driving"), according to which no driver is required from the beginning to the end of the journey and the driving system completely takes over the driving task in all application cases. The above definition corresponds to the "five levels of autonomous driving" defined by the German Association of the Automotive Industry VDA. The corresponding application cases include road type, speed range and environment or environmental conditions.

[0036] Another aspect of the invention relates to a vehicle, in particular a passenger car with an internal combustion engine, an electric motor or a hybrid engine, which is configured to carry out the vehicle steps of the method according to the invention. To this end, the vehicle has at least one sensor for detecting environmental data, via which data for autonomous driving are supplied to a control device of a control system.

[0037] A further aspect of the invention relates to a computer program comprising a program code for carrying out the steps of such a method for operating a motor vehicle that travels at least partially autonomously, when the program code of the computer program is executed on a computer.

[0038] The method steps of the method according to the present invention can be implemented by electrical or electronic components or assemblies (hardware), by firmware (ASIC) or by executing a suitable program (software). It is also preferred to implement or realize the method according to the present invention by a combination of hardware, firmware and / or software. For example, the various components for performing the various method steps are constructed as separate integrated circuits or are arranged on a common integrated circuit. In addition, the various components set up to perform the various method steps are preferably arranged on a (flexible) printed circuit carrier (FPCB / PCB), a tape carrier package (TCP) or other substrates.

[0039] It is also preferred that the individual method steps of the method according to the invention are configured as one or more processes that are run on one or more processors in one or more electronic computing devices and are generated when executing one or more computer programs. In this case, the computing device is preferably configured to work together with other components, such as a communication module and with one or more sensors or cameras, in order to implement the functionality described herein. In this case, the instructions of the computer program are preferably stored in a memory, such as a RAM element. However, the computer program can also be stored in a non-volatile storage medium, such as a CD-ROM, a flash memory, etc.

[0040] Those skilled in the art can also see that the functionality of multiple computers (data processing devices) can be combined or combined in a single device, or the functionality of a specific data processing device can be distributed to a large number of devices in order to perform the steps of the method according to the present invention without deviating from the method according to the present invention.

[0041] Unless otherwise indicated in individual cases, the various embodiments of the invention mentioned in this application can be advantageously combined with one another. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The invention is explained below in the form of an exemplary embodiment based on the accompanying drawings.

[0043] Figure 1 A schematic diagram of a system according to the invention is shown, which consists of a motor vehicle according to the invention having sensors and a control device for carrying out an at least partially autonomous driving operation of the motor vehicle.

[0044] Figure 2 A control system according to the invention is shown which has a plurality of control devices which execute a plurality of program codes for controlling an at least partially autonomous driving operation.

[0045] Figure 3 A control system according to the invention with a plurality of control units is shown in the event of a failure of a control unit or a corruption of the program code, wherein the failed functions are taken over by redundant program codes on other control units.

[0046] Figure 4 A global placement diagram is shown, which is used to determine the best possible distribution of the executed program codes to the available control devices.

[0047] Figure 5 A flow chart is shown for monitoring a control system and reconfiguring the control system in the event of a control device failure and / or an error in executing program code.

[0048] Figure 6 A diagram is shown for the communication of different motor vehicles with a central computing unit, wherein a reconfiguration carried out in the motor vehicle is transmitted to the central computing unit and / or the central computing unit transmits the best possible reconfiguration to the motor vehicle.

[0049] Figure 7 The diagram shows a communication between a central computing unit and a motor vehicle, wherein the central computing unit exchanges additional information with other data sources.

[0050] Figure 8 A visualization of an optimization scheme for reconfiguring a control system based on a global placement graph is shown. DETAILED DESCRIPTION

[0051] Figure 1A schematic diagram, in particular a block diagram, of an exemplary motor vehicle 1, in particular a two-lane vehicle with an internal combustion engine, an electric motor or a hybrid electric motor is shown. The motor vehicle 1 comprises a plurality of first sensors, in particular a first sensor 32, a second sensor 34 and a third sensor 36. These first sensors are set up to detect environmental data of the motor vehicle 1 and comprise, for example, a camera for detecting images of the environment directly surrounding the motor vehicle 1, a distance sensor for detecting the distance to objects in the surroundings of the motor vehicle 1, for example an ultrasonic sensor or a lidar. These first sensors transmit the environmental signals detected by them to the control devices 12, 14, 16, 18 of the control system 10 of the motor vehicle 1.

[0052] The motor vehicle 1 also has a plurality of second sensors, in particular a fourth sensor 38, a fifth sensor 40 and a sixth sensor 42. These second sensors are sensors for determining status data relating to the motor vehicle 1 itself, for example current position information and movement information of the motor vehicle 1. Thus, the second sensors are, for example, speed sensors, acceleration sensors, inclination sensors, sensors for measuring the immersion depth of shock absorbers, wheel speed sensors, etc. These second sensors transmit the status signals detected by them to the control device of the motor vehicle 1. In particular, these second sensors transmit their measurement results directly to the control device 12, 14, 16, 18 of the control system 10 of the motor vehicle 1.

[0053] The motor vehicle 1 also has a control system 10, which is set up for fully automatic driving operation of the motor vehicle 1, in particular for autonomous longitudinal and transverse guidance. The control system 10 has a navigation module, which is set up for calculating a route between a starting point and a destination point and determining the maneuvers to be performed by the motor vehicle 1 along the route. The navigation module 44 is also preferably configured to perform specific maneuvers of the motor vehicle 1, such as parking-in maneuvers and parking-out maneuvers. In addition, the control system 10 includes an internal memory, which communicates with the navigation module 44, for example via a suitable data bus. Models, neural networks and / or target functions based at least partially on machine learning are stored in the internal memory 46. In addition, functional data for the model, the neural network and / or the target function are stored in the internal memory 46 as functional data sets. Preferably, the functionality of the control system 10 is monitored by a control device and released (freeschalten) in particular according to the authorization level of the motor vehicle 1.

[0054] The control system 10 is configured to execute the steps of the motor vehicle 1 in the method according to the invention. In this case, the control system 10 executes the steps of the method by means of control devices 12, 14, 16, 18, or correspondingly controls other components of the motor vehicle 1. For this purpose, the control devices 12, 14, 16, 18 each have an internal memory 46 and a CPU 48, which communicate with each other, for example, via a suitable data bus. In addition, the control devices 12, 14, 16, 18 of the control system 10 are in communication connection with at least the first sensor and the second sensor of the motor vehicle 1 and, if necessary, with other control devices of the motor vehicle 1, for example, to control the heating or air conditioning, radio, navigation system or other information or entertainment system of the motor vehicle. The communication is carried out, for example, via one or more corresponding CAN connections, one or more corresponding SPI connections or other suitable data connections. A communication interface with an external computing center 64 for sending and receiving data is constructed on the motor vehicle 1.

[0055] Figure 2 The schematic configuration of a control system 10 for controlling an at least partially autonomous, preferably fully autonomous, motor vehicle 1 is shown. The control system 10 comprises four control devices 12, 14, 16, 18, in which at least one program code 20, 22, 24, 26, 28, 30 is respectively executed for executing a partially autonomous or fully autonomous driving operation of the motor vehicle 1. In this case, each program code 20, 22, 24, 26, 28, 30 is redundantly applied to two different control devices 12, 14, 16, 18. Here, program code 20a, 22a, 24a, 26a, 28a, 30a is actively executed by control devices 12, 14, 16, 18 respectively and evaluated for controlling motor vehicle 1, while redundant programs 20p, 22p, 24p, 26p, 28p, 30p respectively remain passive (passivverbleiben) and are only integrated into the controller of motor vehicle 1 when the previously active program 20a, 22a, 24a, 26a, 28a, 30a can no longer be evaluated for controlling motor vehicle 1 due to an error or failure of the corresponding control device 12, 14, 16, 18.

[0056] During operation of the motor vehicle 1, the placement of the program code 20, 22, 24, 26, 28, 30 may change several times. For example, after an event such as an error in a control device 12, 14, 16, 18 or an error in an application instance, it may be necessary to switch to a new application placement. In addition to these events, the recognition of possible optimization possibilities may also trigger a switch to a new control device 12, 14, 16, 18. Figure 3, such a situation is illustrated by taking the failure of the second control device 14 as an example. The third program code 24a is already executed by the second control device 14 in the initial state. After the failure of the second control device 14 or a program crash of the third program code 24a that was previously actively executed on the second control device 14, the third program code 24p is activated on the fourth control device 18 and evaluated for continued control of the motor vehicle 1. Dramatic driving situations caused by a lack of control of the motor vehicle 1 can thus be avoided.

[0057] In order to optimize the active program code 20a, 22a, 24a, 26a, 28a, 30a, it is necessary to know the current driving situation and the current operating capacity of the control system 10. In this case, due to the system, reference is made to the operating capacity of all software applications 20, 22, 24, 26, 28, 30, the operating capacity of all control devices 12, 14, 16, 18 and the operating capacity of other hardware, in particular sensors.

[0058] The following example illustrates this dependency:

[0059] Assume that the motor vehicle 1 is an electrically driven car transporting passengers to an important meeting, and the battery of the motor vehicle 1 is almost empty. In this situation, the goal of arriving at the desired destination on time is more important than the entertainment of the passengers. Therefore, in order to increase the cruising range of the motor vehicle 1, all applications used for entertainment purposes can be stopped. Therefore, some control devices 12, 14, 16, 18 can be turned off, which saves energy.

[0060] Assume that the motor vehicle 1 is in a traffic jam. Since the motor vehicle 1 is hardly moving, redundant instances of the driving function can be stopped. Resources can thus be freed up that can be used to execute applications that, for example, help improve traffic flow.

[0061] Due to the system crash, half of the control devices 12, 14, 16, 18 installed in the motor vehicle are no longer functional. Since the remaining control devices 12, 14, 16, 18 do not provide enough resources to execute all the program codes 20, 22, 24, 26, 28, 30 of the applications that were executed before the crash, a new application placement plan must be calculated. The goal of the placement optimization is to map all the applications that are required to stop the motor vehicle 1 safely in order to ensure the safety of passengers and other traffic participants.

[0062] exist Figure 4A global placement diagram 62 is shown, which can also be referred to as an allocation diagram. In the present invention, a dynamic, context-dependent optimization is performed by abstracting the local computing problem of the allocation of program code 20, 22, 24, 26, 28, 30 to the corresponding control devices 12, 14, 16, 18 in the control system 10 of the motor vehicle 1, 80, 82, 84 into a global computing problem. This computing problem is solved by a computing center 64, in particular by a cloud computer system 66. As a result, various participants can help calculate the global placement diagram 62 together and partially transfer computing and cost-intensive tasks from the control system 10 of the motor vehicle. This has the following advantages: the motor vehicle 1, 80, 82, 84 can react to errors more quickly and, after solving the problems that have occurred, quickly work again according to the desired ASIL level.

[0063] The dynamic, context-dependent placement of software in the motor vehicle also offers the advantage that an optimization of the energy consumption is conceivable, whereby the range of the electrically driven motor vehicle 1 can be increased.

[0064] Figure 5 , a flowchart for monitoring a control system and reconfiguring the control system in the case of a control device failure and / or when an error occurs during the execution of a program code is shown. In a first method step I, the execution of a program code 20, 22, 24, 26, 28, 30 on a control device 12, 14, 16, 18 of a control system 10 is monitored by a monitoring element 52. If an error is identified here, then in a second method step II, it is checked whether a pre-calculated emergency plan exists, or whether such a plan must be created first. If there is currently no following emergency plan, which provides: a pre-calculated dynamic allocation of the executed program code 20, 22, 24, 26, 28, 30 to the control device 12, 14, 16, 18, then in a third method step III, it is checked whether there may be enough redundant programs to execute in order to ensure safe, autonomous driving operation. If this precondition is met, then in a fourth method step IV, a corresponding redundantly executed program code is selected and executed on another control device 12, 14, 16, 18 by a switching element 54. In this case, in method step V, this new configuration is selected as new active program code 20 , 22 , 24 , 26 , 28 , 30 .

[0065] If after a failure of control devices 12, 14, 16, 18 there is no longer enough computing power available to ensure operationally safe, autonomous driving of motor vehicle 1, emergency operation module 56 is activated in method step VI, which takes over system control of control system 10. In this case, the motor vehicle is safely brought to a standstill in method step VII.

[0066] If sufficient redundancy is available, a recovery module 58 is activated, which seeks to restore the software configuration to the highest possible target achievement level. For this purpose, a search is performed in method step VIII for a control device 12, 14, 16, 18 that has sufficient resources to additionally execute redundant program code 20, 22, 24, 26, 28, 30. If such a control device is found, in method step IX the new redundant program code 20, 22, 24, 26, 28, 30 is executed on the control device 12, 14, 16, 18. If there are currently insufficient free resources on the control device 12, 14, 16, 18, in method step X the program code with a low priority is stopped in order to provide additional computing power for the safety-related program code.

[0067] If a precalculated emergency plan exists after the check in method step II, this is implemented in method step XI by the placement optimizer 60, and the implementation is reported to the computer center 64 via the communication interface 50. If no emergency plan exists, targets for implementing the emergency plan are defined in method step XII by the placement optimizer 60, an optimization plan is calculated therefrom in method step XIII, and this optimization plan is implemented in method step XIV.

[0068] Figure 6 8 shows the data exchange between the global placement map 62 calculated in the computing center 64 and the different motor vehicles 1, 80, 82, 84. In this case, the solution map is calculated in the first motor vehicle 1. The second motor vehicle 80 downloads the global placement map 62 and transmits it to the control system 10 in the second motor vehicle 80. In the third motor vehicle, a further solution map is calculated and transmitted to the computing center 64. Such a solution map for a partial problem is uploaded to the computing center 64 via the fourth motor vehicle 84.

[0069] Figure 7, the communication between a computing center 64 with a central placement map 62, a motor vehicle 1 and further data sources is shown. Here, in particular, information provided by mobile phones or servers can be considered as further data sources. In addition, the global placement map 62 can be further improved by way of a roadside unit 76. Preferably, during the charging process of the electrically driven motor vehicle 1 at a charging station 74, the solution of the central placement map is transmitted to the control system 10 of the motor vehicle. This process can be triggered by the control device 72 of the charging station 74 or by the control system 10 of the motor vehicle 1. In this case, during the charging process, not only enough energy but also enough computing power is available so that the optimization map can be transmitted to the control system 10 of the motor vehicle 1 and implemented there.

[0070] Figure 8 An optimization scheme for calculating a global placement map for reconfiguring a control system 10 in a motor vehicle 1 is shown in .

[0071] Reference numerals list

[0072] 1Motor Vehicles

[0073] 10Control System

[0074] 12. First control device

[0075] 14 Second control device

[0076] 16Third control device

[0077] 18 Fourth control device

[0078] 20 First program code

[0079] 22 Second program code

[0080] 24 Third Program Code

[0081] 26 Fourth Program Code

[0082] 28 Fifth Program Code

[0083] 30 Sixth Program Code

[0084] 32 First Sensor

[0085] 34 Second sensor

[0086] 36 Third sensor

[0087] 38 Fourth sensor

[0088] 40 Fifth Sensor

[0089] 42 Sixth Sensor

[0090] 44 Navigation module

[0091] 46 Internal Memory

[0092] 48CPU

[0093] 50 Communication interface

[0094] 52 Monitoring components

[0095] 54 Switching elements

[0096] 56 Emergency operation module

[0097] 58 Recovery Module

[0098] 60 Placement Optimizer

[0099] 62 Global placement diagram

[0100] 64 Computing Center

[0101] 66 Cloud Computer System

[0102] 68 Servers

[0103] 70 Smartphone

[0104] 72 Fifth control device

[0105] 74 Charging Stations

[0106] 76 Roadside Unit

[0107] 78 send-receive unit

[0108] 80 Second motor vehicle

[0109] 82 Third Motor Vehicle

[0110] 84 Fourth Motor Vehicle

[0111] 100 computer programs

[0112] R1 Current Configuration

[0113] R2 Precomputed Configuration

[0114] R3 has so far undetermined configuration

[0115] R4 Precomputed Configuration

[0116] R5 has so far undetermined configuration

[0117] R6 Precomputed Configuration

[0118] R7 has so far undetermined configuration

[0119] R8 has so far undetermined configuration

[0120] R9 has not yet been determined

[0121] R10 next confirmed configuration

Claims

1. A method for dynamically and context-basedly distributing program code (20, 22, 24, 26, 28, 30) in a control system (10) of a motor vehicle (1), wherein the control system (10) has a plurality of control devices (12, 14, 16, 18), wherein the program code (20, 22, 24, 26, 28, 30) is distributed to the corresponding control devices (12, 14, 16, 18) of the control system (10) via a global placement map (62), wherein the global placement map (62) is calculated on a computing unit located outside the control system (10), and the data of the global placement map (62) are transmitted to the control system (10), characterized in that The global placement graph (62) is calculated starting from the current configuration (R1) and known reconfigurations (R2, R4, R6), wherein the selection of the next node to be calculated in the global placement graph (62) is calculated based on the probability of occurrence of an error and the impact of the error.

2. The method according to claim 1, characterized in that A plurality of categories are formed for the probability of occurrence (E) and the impact (S) of the errors, wherein the errors are assigned to the probability of occurrence (E) and the impact (S).

3. The method according to claim 2, characterized in that The occurrence probability (E) and the impact (S) of the error are weighted and specified, wherein the node with the highest weighting factor of the global placement graph (62) is calculated based on the weighting.

4. The method according to claim 3, characterized in that The weighting factor is determined by multiplying the occurrence probability (E) by the influence (S).

5. The method according to any one of claims 2 to 4, characterized in that Four different categories are set for the error impact (S).

6. The method according to claim 5, characterized in that The error effects (S) are classified into errors with no risk of injury (S0), errors with a slight risk of injury (S1), errors with a serious risk of injury (S2) and errors with a life-threatening risk of injury (S3).

7. The method according to any one of claims 1 to 4, characterized in that The occurrence probabilities (E) are divided into at least four different categories (E0, E1, E2, E3).

8. The method according to any one of claims 1 to 4, characterized in that A monitoring element (52) is provided, which monitors the process of the program code (20, 22, 24, 26, 28, 30) and / or the function of the control device (12, 14, 16, 18), wherein in the event of a failure of the control device (12, 14, 16, 18) or an error in the program code (20, 22, 24, 26, 28, 30), the program code (20, 22, 24, 26, 28, 30) is redistributed to the control device (12, 14, 16, 18) based on the global placement map (62).

9. The method according to any one of claims 1 to 4, characterized in that In the event of a failure of a control device (12, 14, 16, 18) or an error in the execution of a program code (20, 22, 24, 26, 28, 30), a check is performed to determine whether a distribution plan already exists for the control system (10) for distributing the remaining active program code (20, 22, 24, 26, 28, 30) to available control devices (12, 14, 16, 18).

10. The method according to any one of claims 1 to 4, characterized in that If a sufficient number of redundant program codes (20, 22, 24, 26, 28, 30) required for executing an autonomous driving operation have been executed, the control system (10) is operated in an emergency mode and an allocation plan is created.

11. The method according to any one of claims 1 to 4, characterized in that If a minimum number of redundantly executed program codes (20, 22, 24, 26, 28, 30) is fallen below, the motor vehicle (1) is stopped by a fail-safe system and / or the motor vehicle (1) is controlled to the nearest safe stopping point.

12. The method according to any one of claims 1 to 4, characterized in that The global placement map (62) is determined based on different control systems of motor vehicles of the same type, information from a server (68), information from a mobile phone (70), information from a roadside unit (76) and / or other traffic information systems.

13. A control system (10), comprising a plurality of control devices (12, 14, 16, 18), wherein the control system (10) is configured to perform a method according to any one of claims 1 to 12 when a plurality of machine-readable program codes (20, 22, 24, 26, 28, 30) are executed by at least two control devices (12, 14, 16, 18) of the control system (10).

14. A motor vehicle (1) having a control system (10) which is configured to carry out the method according to claim 1.

15. Computer program product, comprising a computer program (100) having a program code for executing the steps of the method according to any one of claims 1 to 12 when the program code is executed on a computer.

Images