Method for processing data set

Abstract

The invention relates to a method for processing a data set, the method comprising: providing the data set (202); processing (204) the data set (202) in each of a plurality of processing paths (206.1, 206.2, 206.3) on a computing system in accordance with a respective processing scheme (208.1, 208.2, 208.3), respectively, in order to obtain one of a plurality of comparison data sets (210.1, 210.2, 210.3), respectively, the computing system being different from each other for at least two of the plurality of processing paths (206.1, 206.2, 206.3); performing a rationality check (212) on the plurality of comparison data sets (210.1, 210.2, 210.3); if the rationality check is successful, determining (214) a result data set (216) on at least one comparison data set of the plurality of comparison data sets; and providing (218) the result data set for further use.

Description

Technical Field

[0001] The invention relates to a method for processing a data set as well as to a computing system for carrying out the method and to a computer program for carrying out the method. Background Art

[0002] In various fields, for example in vehicles, data such as sensor data are processed, i.e., various calculations are performed, for example; the results can then be used again in the vehicle, for example. Due to the large amount of data and the often complex calculations, this processing can be outsourced to a computing system outside the vehicle, which may be distributed. In this context, the so-called "cloud" is also mentioned. Summary of the invention

[0003] According to the invention, a method for processing a data set, a computing system for carrying out the method and a computer program for carrying out the method are proposed having the features of the independent patent claims. Advantageous embodiments are the subject matter of the dependent claims and the subsequent description.

[0004] The invention generally relates to the processing of data or data sets, i.e. data sets should be processed, for example, according to a specified algorithm or processing scheme. In other words, certain calculations should be performed with these data or the data set. In various fields, for example in vehicles or generally so-called infrastructure-based autonomous driving, data such as sensor data from sensors of vehicles or traffic infrastructure objects are obtained and processed, i.e., various calculations are performed, for example; the results can then be used again, for example in the vehicle or in another traffic infrastructure object.

[0005] For example, within the framework of automated or partially automated driving, complex calculations are required using sensor data in order to be able to assess what reactions should be made in the vehicle. As mentioned, due to the large amount of data and the often complex calculations, it is expedient in this respect to outsource this processing to a possibly distributed, high-performance computing system outside the vehicle. For this purpose, the data can be transmitted from the vehicle to a corresponding computing system (e.g., a computing center) via a suitable, usually wireless, communication connection. The data are then processed accordingly there and, if necessary, subsequently transmitted back to the vehicle, for example, for the operation of an autonomous vehicle.

[0006] In the example of (infrastructure-supported) autonomous driving or in general in vehicles, the data set may include, for example, information about traffic participants, in particular vehicles or objects on the road. The information about traffic participants may include, for example, at least one of the following information: the position of the traffic participant; the direction of the traffic participant; the speed of the traffic participant; the geometric dimensions of the traffic participant.

[0007] For many applications, especially also in vehicles, it is expedient or often necessary to ensure a certain safety by the accuracy of the processed data or calculation processes. In other words, possible errors in the processing or calculation should be excluded as far as possible or the probability of their occurrence should be reduced to a minimum.

[0008] In order to ensure a certain safety when calculating these data, these data or the data set can be processed in each of the multiple processing paths according to the corresponding processing scheme. Here, a comparison data set is obtained respectively, that is, one of several comparison data sets in total. Here, the same results as much as possible should be obtained in all paths or processing paths, that is, these comparison data sets should be at least the same within the range of specified tolerances or at least reasonable relative to each other.

[0009] A principle that can be used for this is the so-called lockstep method. In the field of computer technology, in particular in processors and microcontrollers, this refers to a method for fault tolerance and error detection in hardware that is implemented by using a plurality of identical or similar units, such as CPU cores in a multi-core processor. Lockstep-operated processors are used, for example, in safety-critical applications, such as engine control units (ECUs) in vehicles and autonomous thruster control units (FADECs) in aircraft.

[0010] This approach can also be implemented on a software basis, for example in a computing system. Such software-based lockstep solutions can be used, for example, according to the safety standards ISO 26262 and IEC 61508 for sporadic errors in arithmetic operations. In this case, the data to be processed are processed in a plurality of, for example two, usually three or more, separate paths according to a specified processing scheme (the desired calculations are performed, more precisely, in particular the same calculations are performed in both paths). The data processed in the two or more paths are then subjected to a plausibility check or compared with one another within the framework of a plausibility check.

[0011] For example, if at least two comparison data sets of the plurality of comparison data sets are respectively plausible relative to one another, the plausibility check can be considered successful. With this approach, errors can be identified. Then, a result data set can be determined based on at least one comparison data set of the plurality of comparison data sets, for example, one of the comparison data sets or an average value if the comparison data sets are identical or sufficiently identical. Then, the result data set can be provided again for further use and, for example, transmitted to the vehicle.

[0012] For example, DE 10 2021 202 935 A1 describes a basic operating principle for processing data within the framework of a lockstep method.

[0013] In this context, in particular, systematic errors should also be minimized within the framework of system validation according to ISO 26262 and IEC 61508. Although calculations in lockstep mode can intercept sporadic errors themselves, this solution alone is generally not suitable for the validation of systematic errors. In order to avoid systematic errors, the development process of the application is usually carried out according to the requirements from ISO 26262 and IEC 61508. The application is then executed on (ASIL) certified hardware.

[0014] However, in distributed computing systems such as cloud environments, this hardware is often not present. Additionally, due to virtualization, uncertified operating systems and applications, other layers are introduced where system errors may potentially exist.

[0015] The layers of a typical cloud setup - usually here we can speak of a computing system or, if necessary, a distributed computing system - follow, for example, so-called container technology; in this case, usually we can speak of different layers of the computing system. Within the scope of the invention, it is now proposed that differences or distinctions are provided (or embedded) in these layers, so that systematic errors are less likely to occur and can be particularly detected. These differences can potentially lead to different results (comparison data sets) in these processing paths. It is therefore expedient that these differences are so small that the results (comparison data sets) are still comparable.

[0016] Typically, the computing system is therefore different from one another for at least two of the plurality of processing paths. This may in particular relate to the hardware of the computing system, but may also relate to software. If necessary, the processing schemes may also differ from one another. In other words, the calculations (in the processing paths) are therefore performed, for example, on different hardware and / or using different software. In one embodiment, the computing system has a plurality of different layers, which are used to process data sets, wherein the computing system is different from one another for at least two of the plurality of processing paths in ideally all of the plurality of layers, but at least in two layers.

[0017] That is, the same layers can be provided for each processing path itself, which differ in their specific implementation. This may require, for example, that the computing system has two or more subsystems, which each have the same layers, but which differ in their implementation. These subsystems can be different computing centers, or else different processors on a computing unit or different software paths on a computing unit.

[0018] Based on these subsystems, for example, a software-based lockstep solution can be routed according to ISO 26262 and IEC 61508, because due to the differences, system errors in the lower, uncertified layers can also be intercepted. This is successful because due to the differences, system errors only occur in one of the lockstep processing paths. Therefore, the results (comparison data sets) of the two processing paths are no longer identical, and this error stands out when comparing the comparison data sets of multiple paths or in a plausibility check, so that corresponding measures can be taken (e.g. service degradation, transition to a safe state, etc.).

[0019] As mentioned, the different layers (or levels) of the typical cloud setup mentioned, usually a computing system or possibly a computing system, follow the so-called container technology, for example. These layers can then be as follows: physical hardware, hypervisor, virtual machine with operating system, container runtime, container operating system and application. These layers are then built on top of each other, also in this order, also called so-called stacks. However, it should be mentioned that in principle, only some of these layers and / or other layers than the mentioned layers can also be provided.

[0020] At the level or tier of physical hardware, for example, the following differences or differences may be achieved: different hardware in different computing centers from different manufacturers (e.g., AMD, Intel), different processors, and different processor architectures (e.g., x86, ARM). It should be understood that these differences may also be combined.

[0021] Regarding the hypervisor level or layer, different hypervisors can be used on different servers. The hypervisor is responsible for allocating physical resources to the respective virtual machines (VMs). Different implementations can, for example, help avoid common mistakes. For example, there are hypervisors KVM, XEN and Hyper-V. Since hypervisors usually have a lot of running time, a "proven in use" argument is also possible.

[0022] At the virtual machine (VM) level, different operating systems can be used in order to exclude system errors at this level. However, it should be noted here that different Linux distributions such as Debian and CentOs may not be different enough, because the Linux kernel is always still used. However, if it is possible on the application side, it is promising to use Linux and Windows.

[0023] At the container runtime level, it may be difficult to trace the differences. For example, there is CRI-O, ContainerD, and Mirantis. However, all of these are based on runc.

[0024] Inside the container there is a file system corresponding to the operating system (container OS). Due to differences in the chosen operating system, system errors can also be avoided here. For example, Alpine Linux and Debian distributions can be used. For applications programmed in C / C++, for example, differences arise here, because Alpine Linux relies on musllibc, while Debian uses GNU libc. Using Windows can also contribute to better differentiation.

[0025] At the application level, it is appropriate to use different compilers such as MSVC and GCC to obtain different binaries. In addition, the differences in the binaries and thereby the code execution can be increased by different optimizations. Using different processor instruction sets is also suitable to cause differences or variability.

[0026] The binaries generated by these measures have different processor calls and / or a different order of these calls. This can also help detect system errors, because the underlying layers are affected differently. However, depending on the application, it can be checked whether differences in optimization flags or processor instructions continue to produce comparable results (compare data sets).

[0027] Another way to provide differences in the application programs is to use different algorithms (i.e., for example, the processing schemes mentioned) in the respective application programs. However, this usually requires that there are multiple algorithms for solving a given problem, i.e., for performing the desired calculations. If this is not the case, different implementations of the same algorithm can also be used. In addition, different programming languages ​​can also be used in order to create differences in the execution of the programs. Here, too, it should be checked whether the results continue to be comparable.

[0028] The proposed approach can be an important component for using cloud resources in safety-critical applications, since systematic errors in uncertified layers can be discovered thereby. Therefore, demonstration according to safety standards ISO 26262 and IEC61508 is feasible.

[0029] It should be noted that, depending on the type of application, the differences should be handled specifically and that the differences mean more costs. In this case, costs and error probability, for example, should be weighed against each other.

[0030] A computing system according to the invention, such as a computing center or also a computing network, for example with a plurality of computing centers, is set up, in particular in a program-technical manner, to carry out the method according to the invention. Here, the computing system can in particular have the above-mentioned differences in the individual processing paths, for example in different layers.

[0031] In particular, when the executed control device is also used for other tasks and thus always exists, the implementation scheme in the form of a computer program or computer program product with a program code for executing all method steps according to the method of the present invention is also advantageous, because this causes particularly low costs. Finally, a machine-readable storage medium is provided, on which a computer program as described above is stored. In particular, storage media or data carriers suitable for providing the computer program are magnetic storage, optical storage and electrical storage, such as hard disks, flash memories, EEPROMs, DVDs and others, etc. It is also feasible to download the program via a computer network (Internet, intranet, etc.). Here, this download can be implemented in a wired manner or in a cable manner or in a wireless manner (for example, via a WLAN network, 3G, 4G, 5G or 6G connection, etc.).

[0032] Further advantages and embodiments of the invention are apparent from the description and the accompanying drawings.

[0033] The invention is schematically illustrated in the drawings based on exemplary embodiments and is described below with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1a An environment for explaining the present invention is schematically shown.

[0035] Figure 1b A computing system according to the invention is shown in a preferred embodiment.

[0036] Figure 2 The sequence of the method according to the invention in a preferred specific embodiment is schematically shown as a block diagram. DETAILED DESCRIPTION

[0037] exist Figure 1a In FIG. 1 , an environment for explaining the present invention is schematically shown, more precisely by way of example in the environment of so-called infrastructure-supported autonomous driving.

[0038] For this purpose, a vehicle 100 is shown by way of example, which has a computing unit or computing system 102 and a sensor 104, which is designed, for example, as a camera. With the aid of the computing unit or computing system 102, for example, calculations can be performed, and a wireless communication connection can also be established, for example, via an integrated radio module, in order to send and / or receive data. With the aid of the camera 104, for example, objects in the environment can be detected.

[0039] Furthermore, an infrastructure object 110, such as a traffic light system, is shown by way of example, which also has a computing unit or computing system 112 and a sensor 114, which is designed, for example, as a camera. With the aid of the computing unit or computing system 112, for example, calculations can be performed, and a wireless communication connection can also be established, for example, via an integrated radio module, in order to send and / or receive data (however, depending on the type, a wired communication connection, for example, may also be possible). With the aid of the camera 114, for example, objects in the environment, such as a vehicle 100, can be detected.

[0040] Furthermore, an (external) computing system 150 is shown by way of example, with the aid of which, for example, calculations are performed, in particular, for example, also the method according to the invention is performed. For example, a wireless communication connection can also be established via a radio module (for example a connected antenna mast) 152 in order to send and / or receive data.

[0041] Within the framework of infrastructure-assisted autonomous driving, vehicle 100 can now be detected, for example, by means of camera 114 of traffic infrastructure object 110 and the sensor data generated can be transmitted to computing system 150. There, these sensor data can be processed in the sense of a data set into result data or generally into a result data set, which can then be used again, for example, for navigation of vehicle 100.

[0042] In order to achieve a certain security with respect to the data or their accuracy, the data set can be processed multiple times, for example three times, more precisely on three different processing paths. The comparative data sets obtained in this way can then be compared in order to ensure that the processing is normal. This will be explained in more detail below.

[0043] exist Figure 1b 1 again shows a computing system 150, more precisely, a computing system having different layers or levels. These layers include, by way of example, physical hardware 150.1, hypervisor 150.2, virtual machine 150.3, container runtime 150.4, container operating system 150.5 and application or application program 150.6.

[0044] The layers of the different processing paths may differ from one another if the method according to the invention is executed on a computing system 150. For possible differences in these layers, reference should be made to the above statements to avoid repetition.

[0045] For hardware, particularly preferred combinations are, for example: different processors from different manufacturers (Intel vs. AMD). If the application allows, different processor architectures can be used (ARM vs. x86). For hypervisors, XEN vs. Hyper-V are preferred; for virtual machines (VMs) with operating systems: Windows vs. Linux (e.g. RHEL); for container runtimes: e.g. CRI-O vs. ContainerD; for container operating systems: Windows vs. Linux; and for application compilers: MSVC vs. GCC. For algorithms, these can be different languages ​​in order to implement the same algorithm, or in extreme cases different algorithms.

[0046] exist Figure 2 In the figure, the process of the method according to the present invention in a preferred embodiment is schematically shown. Figure 1a , 1b to be explained in more detail.

[0047] In step 200, an image of vehicle 100 can be captured, for example, by means of camera 114 of infrastructure object 110 according to FIG. 1. In this process, sensor data, also referred to as data set 202 below, are obtained. These sensors can be transmitted, for example, to computing system 150 according to FIG. 1. Then, in step 204, the output data (data set 202) should be processed or calculated there on different, for example three different processing paths 206.1, 206.2, 206.3. For this purpose, in each of these processing paths 206.1, 206.2, 206.3, a processing scheme 208.1, 208.2, 208.3 can be used; these processing schemes 208.1, 208.2, 208.3 can be identical, but can also differ from each other if necessary, as described above.

[0048] In each of these processing paths 206.1, 206.2, 206.3, a comparison data set is obtained, which is denoted here by 210.1, 210.2, 210.3. For example, position information etc. is determined based on these images and, if necessary, other information of the data set.

[0049] Since the layers used for this processing are different from one another for different processing paths, as described above and also with reference to Figure 1b As explained, possible system errors lead to deviations in only one of these processing paths.

[0050] Then, in step 212, a plausibility check is performed; here, for example, it is determined or checked whether the plurality of comparison data sets are considered identical or identical within a specified tolerance, or whether the plurality of comparison data sets are identical. If a system error has occurred, the comparison data sets will not be consistent or plausible relative to one another. At this point, it should be mentioned that for three processing paths, it is also conceivable, for example, that the plausibility check is considered successful if two processing data sets are plausible relative to one another.

[0051] If this is the case, i.e. if the plausibility check succeeds, a result data set 216 is determined in step 214; this result data set can, for example, correspond to the comparison data set or the (e.g. arithmetic) mean, possibly for each component (if there are multiple components for each data set) or be determined therefrom in another way. For example, it can be specified that in the case of a deviation of at most 5% or another value between two comparison data sets, these comparison data sets should be considered to be identical within a specified tolerance - and that the plausibility check is thereby successful.

[0052] Then, step 218 , the resultant data set 216 may be provided for further use, such as operation of the autonomous vehicle.

Claims

1. A method for processing a data set, the method comprising: Providing the data set (202); On a computing system (150), in each of a plurality of processing paths (206.1, 206.2, 206.3), processing (204) the data set (202) according to a corresponding processing scheme (208.1, 208.2, 208.3) to obtain one of a plurality of comparison data sets (210.1, 210.2, 210.3), respectively, wherein the computing system (150) is different for at least two of the plurality of processing paths (206.1, 206.2, 206.3); Performing a rationality check (212) on the plurality of comparison data sets (210.1, 210.2, 210.3); If the rationality check succeeds, determining (214) a result data set (216) on at least one of the plurality of comparison data sets; and The resulting data set is provided (218) for further use.

2. The method according to claim 1, wherein: The computing system (150) has a plurality of different layers that are used to process the data set (202), and wherein the computing system (150) differs from one another in at least one of the plurality of layers for at least two of the plurality of processing paths (206.1, 206.2, 206.3).

3. The method according to claim 2, wherein: The plurality of different layers comprises at least one of the following layers: - Physical Hardware (150.1); - management procedures (150.2); - Virtual machines with operating systems (150.3); -Container runtime (150.4); -Container OS (150.5); -Applications (150.6).

4. A method according to any one of the preceding claims, wherein: The plausibility check is deemed to be successful if at least two comparison data sets of the plurality of comparison data sets are respectively plausible with respect to one another.

5. A method according to any one of the preceding claims, wherein: The data set (202) is obtained at least in part with the aid of one or more sensors (104, 114) of a vehicle (110) or a traffic infrastructure object (110).

6. The method according to claim 5, wherein: The data set (202) includes information about traffic participants, in particular vehicles or objects on the road.

7. A computing system (150) which is configured to carry out all method steps of the method according to any one of the preceding claims.

8. The computing system (150) of claim 7, the computing system having a plurality of different layers operable to process the data set, and wherein: The computing system differs from one another in at least one layer of the plurality of layers for at least two processing paths of the plurality of processing paths (206.1, 206.2, 206.3).

9. A computer program which, when executed on a computing system (150), causes the computing system to perform all method steps of the method according to any one of claims 1 to 6.

10. A machine-readable storage medium having stored thereon the computer program according to claim 9.

Images