Method for transmitting data in a computing unit

Abstract

The invention relates to a method for transmitting data in a computing unit (100), a first application area (110) and a second application area (120) being provided in the computing unit (100), a first application program (112, 113, 114, 115) being executed independently of one another in the first application area (110) and a second application program (122, 123, 124, 125) being executed independently of one another in the second application area (120), a first storage area (111) is arranged in the first application area (110), a first application program (112, 113, 114, 115) of the first application area (110) is allowed to access the first storage area, a second storage area (121) is arranged in the second application area (120), a second application program (122, 123, 124, 125) of the second application area is allowed to access the second storage area (120), the computing unit (100) has a data transfer unit (130) with at least one gateway, the transfer of data from the first application area (110) to the second application area (120) comprising: transfer of data from the first storage area (111) to the second storage area (121) by means of the at least one gateway; and providing (143) the data in the second storage area (121) to a second application program (122, 123, 124, 125) of the second application area (120).

Description

Technical Field

[0001] The invention relates to a method for transmitting data within a computing unit, as well as to a computing unit and a computer program for carrying out the method. Background Art

[0002] Different application areas can be implemented in a computing unit, such as a main application area (hereinafter referred to as the first application area), in which a first application provided for the functionality of the computing unit (hereinafter referred to as the first application) is executed; and a test application area (such as the so-called "shadow mode", hereinafter referred to as the second application area), in which a test application (hereinafter referred to as the second application) is executed independently of the first application.

[0003] In this way, for example, in a computing unit in a (motor) vehicle, for example in a system on a chip (SoC) or a control device, it is possible to execute a verified or certified application for controlling vehicle functions in a first application area. For example, in a second area, it is possible to execute uncertified applications, which, for example, should be tested in a vehicle fleet before they can be verified and used as actual vehicle functions. As a result, these test applications can be exposed to a large number of test cases that cannot be realized, for example, due to test bench conditions.

[0004] If such a second and first application area are executed in the same partition of the same SoC or computing unit, a logical separation and decoupling of these areas can be achieved, so that the second application does not impair the execution and processing of the first application (so-called "Freedom from Interference"). However, it may be necessary to transfer data (e.g. measurement data) from the first area to the second area, wherein any damage to the first application during these data transfers should be avoided. Summary of the invention

[0005] According to the invention, a method for transmitting data within a computing unit and a computing unit and a computer program for carrying out the method are proposed having the features of the independent patent claims. Advantageous embodiments are the subject matter of the dependent claims and the following description.

[0006] The computing unit can be designed as a system on chip or a control device, which is used in particular in a (motor) vehicle. A first application area and a second application area (so-called "shadow area", test area) are arranged or implemented in the computing unit, wherein first applications or processes, applications or tasks are executed independently of each other in the first application area and second applications or processes, applications or tasks are executed independently of each other in the second application area. These different application areas can be executed in particular in the same partition of the same system on chip or computing unit. Preferably, the application areas are logically decoupled from each other so that the second application does not affect the execution and processing of the first application in terms of time.

[0007] In the first application area, a first shared or common storage area (English: "Shared Memory") is provided, and the first application in the first application area is allowed to access the storage area. In particular, the second application is not allowed to access the first storage area. In the second application area, a second shared or common storage area ("Shared Memory") is provided, and the second application in the second application area is allowed to access the storage area. Suitably, the first application is not allowed to access the second storage area. Suitably, the first storage area and the second storage area are set as different areas in the same storage unit, for example, as independent areas in a RAM memory respectively. However, it is also conceivable that the first storage area and the second storage area are respectively designed as independent storage units, for example, respectively designed as independent flash memory or RAM memory, or designed as independent storage areas in different storage units. For example, when executing the first application, input data and / or specific output data required for executing the first application can be stored in the first storage area.

[0008] The invention now provides the possibility of transferring data from a first application area to a second area without impairing the first application program. Within the scope of the method, the individual data are transferred from a first storage area to a second application area. For this purpose, the computing unit has a data transfer unit with at least one gateway. At least one gateway of the data transfer unit allows access to the first storage area. In addition, at least one gateway of the data transfer unit allows access to the second storage area.

[0009] In order to transfer data from the first application area to the second application area, at least one gateway transfers the data to be transferred from the first storage area to the second storage area and makes the data in the second storage area available to the second application in the second application area. The second application can then read the data from the second storage area, for example, by a so-called "zero-copy method".

[0010] For the data transmission from the first to the second application area, the data transmission unit is designed as an independent, separate unit (hardware and / or software), which reads the data to be transmitted from the first storage area on an independent separate data path and makes it available in the second storage area. The data transmission unit in particular provides a second communication infrastructure, via which the data from the first storage area can be transmitted to the second application in the second application area, in particular in a manner independent of the first communication infrastructure in the first application area, wherein the first application can exchange data with the first storage area via the first communication infrastructure. In this way, a data transmission to the second application area without reactions to the execution of the first application can be achieved in a particularly suitable manner, in particular also for larger data volumes. In particular, a safe, reaction-free and interference-free data transmission can be achieved in this way, thereby achieving information technology security ("security") and functional safety ("safety") in the computing unit.

[0011] The data transfer unit can be implemented particularly expediently in software. In this way, a software solution is particularly expediently provided for the safe, non-reactive data transfer from the first application area to the second application area. In particular, no additional hardware units are required, which can save costs and enable simplified operation as well as simplified provision and integration.

[0012] According to an advantageous embodiment, the data transfer unit has a first gateway and a second gateway as the at least one gateway. The first gateway allows read access to the first storage area, in particular only read access, but expediently does not allow read access to the second storage area. Conversely, the second gateway allows at least write access to the second storage area, but in particular does not allow write access to the first storage area. In particular, two independent gateways with different access authorizations are thus provided to ensure that the first storage area is not interfered with and the information technology security of the data transfer is ensured.

[0013] Advantageously, in order to transfer data from the first storage area to the second storage area via the at least one gateway, the data to be transferred from the first storage area is subscribed to by the first gateway. The subscribed data is transferred from the first gateway to the second gateway. The second gateway publishes the data in the second storage area. When new data are present in the first storage area, the first gateway can receive a notification, in particular from the first application area, on the basis of which the first gateway can subscribe to the new data and transfer it to the second gateway. Suitably, the second storage area can be used by the second application via a zero-copy method and subscription or publication of services.

[0014] Preferably, the first gateway subscribes to the data to be transmitted in the first storage area using a zero-copy method. During the zero-copy method, the data is not transmitted or copied.

[0015] Preferably, the subscribed data is directly or immediately transmitted or copied from the first gateway to the second gateway using interprocess communication (IPC). In particular, the subscribed data is transmitted from the first gateway to a shared buffer, and the second gateway reads the data from the shared buffer.

[0016] Preferably, the second gateway directly or immediately publishes the data to the second storage area using a zero-copy method, so that the second application can appropriately use the published data through zero-copy.

[0017] During this data transmission, the data to be transmitted are in particular only copied once between the first gateway and the second gateway. In particular, additional, redundant copying processes can be avoided, thereby saving resources or computing power. Advantageously, the degree of non-reaction of the data transmission can thus be increased, because as little computing power as possible is required to transmit the data, and as much computing power as possible can be available for executing and processing the first application.

[0018] The present invention is particularly suitable for the field of (motor) vehicles. The computing unit can be particularly suitably designed as a system on chip, for example in a control device of a (motor) vehicle. The execution of the first application in the first application area can be carried out in particular in the process of safety-critical functions for the safe operation and control of the vehicle, for example in the process of engine control, in the process of driver assistance functions, in the process of assisted automatic driving (IAD), in the process of automatic or partially automatic driving, etc. The first application can be in particular a verified and certified vehicle software, which has been approved and released by the legislator or the authority or the licensing agency for normal operation. As the second application, in particular, an uncertified application can be executed, which, for example, should first be tested in a fleet, and then can be verified and executed as an actual vehicle function in the first application area. For example, with the help of the second application, a vehicle function that should be normally implemented in the fleet in the future can be tested. In addition, with the help of the second application, for example, data required for the development or improvement of vehicle functions can also be collected or evaluated on site. By decoupling these two areas, not only the decoupling of data use but also the decoupling of the time influence on the first storage area is achieved.

[0019] In particular, the invention makes it possible to transfer data determined, for example, during normal vehicle operation in a first application area to a second area, for example to be processed or evaluated there by a second application, without this data transfer impairing or delaying the execution and processing of the first application and thus the execution of vehicle functions (“freedom from interference”). The safety or fail-safety and integrity of the vehicle computing unit can thus be increased.

[0020] The invention makes it possible to provide a second application area in a series-produced vehicle at a significant cost advantage and thus to expand the volume market for this function. Since the decoupling of the application areas takes place completely in software within the scope of the method and does not require any additional hardware, costs can be saved and operation is simplified from the user's point of view, especially also with regard to provision and integration. In particular, the invention makes it possible to meet safety requirements in the (motor) vehicle sector, such as those specified in the ISO 26262 standard or in particular those specified by the so-called "Automotive Safety Integrity Level" (ASIL), which is the safety requirement level for safety-related systems in motor vehicles specified by ISO 26262.

[0021] The invention is particularly suitable for automatic or autonomous driving, in particular for partially automated and highly automated driving (level 2 or 3). Therefore, the development and verification of (vehicle) functions usually need to be ensured and verified in an extended fleet. For example, in real driving operations, rare events come into play, wherein the identification of these events requires more vehicles and corresponding mileage. For this purpose, the first and second application areas can be implemented in the individual computing units of the series vehicles respectively. In the first application area, the vehicle software, which is particularly verified and certified, is then executed for controlling active vehicle functions. In the second application area, for example, "uncertified software" can be executed, such as artificial intelligence for video recognition, driving functions or triggers. Through the present invention, the software in the second area can be controlled and decoupled from the effective certified driving software so as not to impair driving safety. The data transmission unit is suitably realized from the first area to the second area for the effective driving software without reaction, in particular also for the larger amount of data that is important for (highly) automated driving, because for example video data with a large amount of data is used here.

[0022] A computing unit according to the invention, for example a control unit of a motor vehicle, is provided, in particular in terms of programming, to carry out the method according to the invention.

[0023] It is also advantageous to implement the method according to the invention in the form of a computer program or computer program product with a program code for executing all method steps, because this leads to particularly low costs, especially when the executing control device is also used for further tasks and therefore already exists anyway. Finally, a machine-readable storage medium is provided on which a computer program as described above is stored. Suitable storage media or data carriers for providing computer programs are in particular magnetic, optical and electrical memories, such as hard disks, flash memories, EEPROMs, DVDs, etc. It is also possible to download programs via computer networks (Internet, intranets, etc.). Such downloads can be performed here in a wired or cabled manner or wirelessly (e.g., via a WLAN network, 3G, 4G, 5G or 6G connection, etc.).

[0024] Further advantages and embodiments of the invention are apparent from the description and the drawings.

[0025] The invention is schematically illustrated by way of example in the drawings and is described hereinafter with reference to the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 A computing unit which is provided for carrying out a preferred specific embodiment of the method according to the invention is schematically shown.

[0027] Figure 2 A computing unit which is provided for carrying out a preferred specific embodiment of the method according to the invention is schematically shown. DETAILED DESCRIPTION

[0028] exist Figure 1 In the figure, a computing unit is shown schematically and designated as 100, which is designed, for example, as a system on a chip (SoC) and is used in a control device of a vehicle, for example in a control device for controlling driver assistance functions, for example for performing object recognition in a partially automated or highly automated driving process.

[0029] A first application area 110 and a second application area 120 are provided in the SoC 100. In the first application area, first application programs 112, 113, 114, 115, such as authenticated or verified applications executed during normal vehicle operation, are executed to control object recognition.

[0030] Furthermore, a first shared memory area (English: “Shared Memory”) 111, for example a memory area in a RAM memory, is provided in the first application area 110, to which the first applications 112, 113, 114, 115 have joint access. For example, sensor data, for example video and image data of a camera of a vehicle, can be stored in the first memory area 111, wherein these sensor data are evaluated by the first applications 112, 113, 114, 115 in the object recognition process.

[0031] In the second application area 120, the second applications 122, 123, 124, 125 are executed independently and separately from the first applications 112, 113, 114, 115. Furthermore, a second shared memory area 121 is provided in the second application area 120, for example in the form of its own, independent area in a RAM memory, to which the second applications 122, 123, 124, 125 can jointly access.

[0032] The second applications 122, 123, 124, 125 can be, for example, uncertified applications which should be implemented normally in the vehicle fleet in the future but need to be tested and verified in the field first. For this purpose, the second applications 122, 123, 124, 125 should, for example, also evaluate the video and image data accessed by the first applications 112, 113, 114, 115 during normal vehicle functions.

[0033] In order to transfer the corresponding data from the first application area 110 to the second application area 120 without impairing the execution of the first application programs 112, 113, 114, 115, the computing unit 100 is configured, in particular in terms of programming technology, to execute a preferred embodiment of the method according to the invention. For this purpose, the computing unit 100 has a data transfer unit 130, which is configured in a software-implemented manner, for example, in the form of a program executed by a processor unit.

[0034] Reference below Figure 2 The data transmission from the first application area 110 to the second application area 120 via the data transfer unit 130 is explained within the scope of a preferred embodiment of the method according to the invention, wherein schematically shown Figure 1 Elements of a computational unit in . Figure 1 and Figure 2 The same reference numerals in the drawings represent identical or structurally identical elements.

[0035] like Figure 2As shown, for example, the first application 113 stores raw video data of the vehicle camera in the first storage area 111. For example, the first application 112 reads the raw video data to perform object recognition and stores the result of the object recognition in the first storage area 111. For example, the raw video data should now be transferred to the second application area 120 so that, for example, the second applications 122, 123, 124 can evaluate the data.

[0036] The data transfer unit 130 has a first gateway 131 and a second gateway 132 , wherein the data to be transmitted are transmitted from the first storage area 111 via these gateways 131 , 132 to the second storage area 121 , where they can be read by the corresponding second application.

[0037] The first gateway 131 subscribes to data from the first storage area 111 by a zero-copy method, as indicated by reference numeral 141. In this process, in particular, the data is not transmitted and copied by the first gateway 131.

[0038] The subscribed data is directly or immediately transmitted or copied to the second gateway 132 by the first gateway 131 through inter-process communication (IPC), as shown by reference numeral 142. For example, the subscribed data is transmitted to a shared buffer from the first gateway 131. The second gateway 132 reads the data from the shared buffer.

[0039] The data is directly or immediately published to the second storage area 121 by the second gateway 132 through a zero copy method, as indicated by reference numeral 143. The second application programs 122, 123, 124 can use the new data from the second storage area 121 through zero copy.

[0040] During the data transmission process using the zero-copy method, the data in the gateways 131 and 132 will not be copied additionally, but the same shared buffer will be accessed. Additional redundant copy processes in the gateways 131 and 132 are avoided, thereby saving resources or computing power of the SoC 100. In this way, data transmission without adverse effects on the execution of the first application 112, 113, 114, 115 can be achieved in the second application area 120, thereby achieving information technology security ("security") and functional safety ("safety") in the computing unit 100.

Claims

1. A method for transmitting data within a computing unit (100), in, A first application area (110) and a second application area (120) are provided in the computing unit (100), wherein first application programs (112, 113, 114, 115) are executed independently of one another in the first application area (110), and second application programs (122, 123, 124, 125) are executed independently of one another in the second application area (120), A first storage area (111) is set in the first application area (110), and the first application programs (112, 113, 114, 115) of the first application area (110) are allowed to access the first storage area. A second storage area (121) is set in the second application area (120), and a second application program (122, 123, 124, 125) of the second application area (120) is allowed to access the second storage area. The computing unit (100) has a data transmission unit (130) with at least one gateway (131, 132). Wherein, transmitting data from the first application area (110) to the second application area (120) comprises: Transmitting (141, 142, 143) the data from the first storage area (111) to the second storage area (121) via the at least one gateway (131, 132); The data in the second storage area (121) is provided (143) to the second application program (122, 123, 124, 125) in the second application area (120).

2. The method according to claim 1, wherein the data transfer unit (130) comprises a first gateway (131) and a second gateway (132) as at least one gateway (130), wherein the first gateway (131) allows read access to the first storage area (111), and wherein the second gateway (132) allows write access to the second storage area (121).

3. The method according to claim 2, wherein: Transmitting data from the first storage area (110) to the second storage area (120) via the at least one gateway (131, 132) comprises: subscribing (141) to data from the first storage area (111) via the first gateway (131); transmitting (142) the subscribed data from the first gateway (131) to the second gateway (132); The data is published (143) to the second storage area (121) through the second gateway (132).

4. The method according to claim 3, wherein the data is subscribed (141) from the first storage area (111) by a zero-copy method through the first gateway (131).

5. The method according to claim 3 or 4, wherein the subscribed data is transmitted (142) from the first gateway (131) to the second gateway (132) by inter-process communication.

6. The method according to any one of claims 3 to 5, wherein the data is published (143) to the second storage area (121) by the second gateway (132) using a zero-copy method.

7. The method according to any of the preceding claims, wherein in the first application area (110), a certified application of the vehicle is executed as the first application (112, 113, 114, 115), and wherein, In the second application area (120), an unauthenticated application of the vehicle is executed as the second application (122, 123, 124, 125).

8. A computing unit (100) configured to carry out all method steps of the method according to any of the preceding claims.

9. A computer program which, when executed on a computing unit (100), causes the computing unit (100) to carry out all method steps of the method according to any one of claims 1 to 7.

10. A machine-readable storage medium having stored thereon the computer program according to claim 9.

Images