Method for operating a motor vehicle

Abstract

The invention relates to a method for operating a motor vehicle (1), the motor vehicle (1) comprising a computer system (2) by means of which a main application (100) for operating the motor vehicle is operated. The computer system (2) is divided by virtualization into functional parts (5, 6), each of which is assigned to a main application (100) or a verification application (200) for verifying a function of the motor vehicle (1). The invention further relates to a computer program product for carrying out the method.

Description

TECHNICAL FIELD

[0001] The invention relates to a method for operating a motor vehicle having a computer system by means of which at least one main application for operating the motor vehicle is executed. Furthermore, the invention relates to a computer program product for executing the method. BACKGROUND

[0002] In motor vehicles, applications for operating the motor vehicle are generally employed. In the motor vehicle, these applications are each able to implement a function required for operating the motor vehicle or a part of a function required for operating the motor vehicle. In order to run the applications, the motor vehicle generally comprises a computer system having suitable hardware.

[0003] In order to improve functions and / or to introduce new functions, it is often necessary to verify the new or modified functions. Often, these changes are provided in the form of suitable applications to be verified.

[0004] US 2021 / 382756 A1 describes a method of statically partitioning hardware accelerators on the cloud such that the partitions do not influence each other.

[0005] According to US 2019 / 0286607 A1, the sharing utilization of storage devices is known. This allows data from different sources to be written to the storage device at the same time.

[0006] WO 2021 / 179780 A1 describes a method of dynamically shifting resources between virtual graphics processors of a computer system. This allows graphics processors to be provided to multiple clients for use. SUMMARY

[0007] It is an object of the present invention to show a new, in particular improved or otherwise embodied method for operating a motor vehicle and a computer program product for executing the method.

[0008] This object is achieved by the independent claims. Advantageous methods are the subject of the dependent claims.

[0009] Accordingly, the subject of the present application is the use of one and the same computer system of a motor vehicle for running: an application for functions required during operation of the motor vehicle (hereinafter also referred to as main application), and an application for verifying modified and / or new functions (hereinafter also referred to as verification application). In this process, virtualization is employed to divide the computer system into virtual sections separated from one another, for running the main application on the one hand, and for running the verification application on the other hand. Accordingly, for example, costs and resources as well as energy can be saved significantly in comparison with the provision of separate computer systems for running the main application and the verification application, respectively. By separating the running of the main application from the running of the verification application by means of virtualization, undesired mutual influences between the main application and the verification application can also be avoided, so that the method does not simultaneously affect the operation of the motor vehicle. The latter increases the safety. The present application achieves the advantages of saving costs and resources and increasing safety.

[0010] Accordingly, the present application relates to a method for operating a motor vehicle. For operating the motor vehicle, a main application is first run. In this process, the motor vehicle comprises a computer system by means of which at least one such main application is run. In addition, a verification application for verifying functions of the motor vehicle is also provided. According to the present application, the computer system is divided by means of virtualization into at least one virtual function section for at least one main application and at least one virtual function section for the verification application. In the following, the respective function section for the main application is also referred to as main function section, and the respective function section for the verification application is also referred to as further function section. The at least one main application is run by means of the at least one main function section. In addition, the verification application is run completely by means of the at least one further function section.

[0011] The division of the computer system by means of virtualization into the at least one main function section and the at least one further function section is carried out in such a way that the at least one main function section is separated from the at least one further function section. This means that, preferably, no mutual influences between the at least one main function section and the at least one further function section take place.

[0012] In this context, the running of the verification application completely by means of the at least one further function section means that the verification application is run without the need to run the at least one main function section.

[0013] The respective main application can be any type of software which at least partially runs functions for operating the motor vehicle. This includes, for example, operating systems and firmware, etc.

[0014] The provision of the verification application can take place in any manner. For example, the verification application can be transmitted to the motor vehicle (in particular wirelessly) by means of data communication via an external source.

[0015] It is conceivable to provide the verification application in an updated or upgraded form. As described herein, the update or upgrade is verified in the vehicle, after which, upon successful verification, it can subsequently become the main application.

[0016] The computer system according to the application preferably comprises all hardware required for running the application. In particular, the computer system (in addition to the computer unit) can comprise at least one memory, an accelerator, etc.

[0017] For example, the computer system can comprise a system on a chip (or simply “SoC”) or comprise at least one SoC.

[0018] For example, the computer system can comprise at least one hardware accelerator that is divided by virtualization. This means that the at least one hardware accelerator forms or can be part of at least one such virtual main functional part and part of at least one such virtual further functional part.

[0019] At least one of the at least one hardware accelerator can advantageously be or comprise an AI accelerator, wherein “AI” stands for “Artificial Intelligence”. The AI accelerator can comprise or be a neuromorphic processor.

[0020] Similarly, at least one of the at least one hardware accelerator can comprise or consist of at least one graphics processor.

[0021] Preferably, the virtualization is performed such that all hardware of the computer system described herein and / or all available resources of the computer system are divided into virtual functional parts and thus form part of the respective functional part.

[0022] The division of the computer system by virtualization can essentially be performed dynamically. In this case, more or less computer system resources can be provided for the at least one main functional part and the at least one further functional part by virtualization depending on the requirements.

[0023] In a preferred embodiment, the computer system is statically divided into the at least one main functional part and the at least one further functional part. This means that by virtualization, resources of the computer system are statically allocated to the at least one main application and the verification application. Thus, a lower limit of resources for the at least one main application and the verification application is also guaranteed, so that in particular the at least one main functional part can be reliably and predictably operated. This leads to an improved operation of the motor vehicle and an increased safety.

[0024] The division of the computer system by virtualization is preferably performed such that sufficient computer system resources are allocated to the at least one main application for its smooth execution. This leads to a further increased safety.

[0025] Advantageously, the computer system is divided by virtualization in such a way that more resources are assigned to the at least one main functional part than to the at least one further functional part.

[0026] In an advantageous variant, the computer system is divided by virtualization in such a way that the amount of resources assigned to the at least one main functional part is at least twice the amount of resources assigned to the at least one further functional part. For example, two-thirds of the resources can be assigned to the at least one main functional part, and one-third of the resources can be assigned to the at least one further functional part.

[0027] A variant of a hypervisor is preferably provided. The hypervisor comprises at least one virtual machine for the at least one main application and at least one virtual machine for the verification application. In the following, the respective at least one virtual machine for the main application is also referred to as main virtual machine, and the at least one virtual machine for the verification application is also referred to as further virtual machine. Thus, the hypervisor comprises at least one main virtual machine and at least one further virtual machine. The at least one main virtual machine is assigned to the at least one main functional part and separated from the at least one further functional part. Furthermore, the at least one further virtual machine is assigned to the at least one further functional part and separated from the at least one main functional part. The at least one main application runs in the at least one main virtual machine, and the verification application runs in the at least one further virtual machine. Thus, a further clear separation between the run of the respective main application and the run of the verification application exists. In addition to a more reliable operation, the security is further improved.

[0028] Preferably, the hypervisor is connected in a data communication manner to the functional parts, such that on the one hand data communication takes place between the respective main functional part and the associated main virtual machine, and on the other hand data communication takes place between the respective further functional part and the associated further virtual machine. The data communication can take place, for example, via a bus.

[0029] In fact, the motor vehicle comprises hardware which provides, in particular supplies, data for at least one of the at least one main application during operation. In the following, the hardware is also referred to as application hardware, and the provided data is also referred to as input data. Thus, the application hardware generates input data during operation, which is provided to at least one of the at least one main application.

[0030] Preferably, the input data is also provided at least partially to the validation application. Based on the same input, it is possible, in particular, to compare the evaluation and / or execution of the main application and the evaluation and / or execution of the validation application for validating the validation application. For example, it is thus possible to compare whether the validation application supplies a result which is comparable or better compared to the respective main application. Thus, preferably, the result of the validation application is compared with the result of at least one of the at least one main application when used for validating the validation application.

[0031] Preferably, the input data is provided to the validation application in consideration of a partitioning of computer system resources. For example, when one third of the resources is allocated to the at least one further functional part and two thirds of the resources are allocated to the at least one main functional part, a corresponding proportion of the input data can be provided to the validation application.

[0032] The input data can be processed before the provision of the data. For example, the input data can be filtered and / or adjusted and / or converted and / or merged, for example in a fused manner. In this context, it is conceivable to perform this processing as part of the at least one such main application.

[0033] The application hardware can be of any kind.

[0034] For example, the application hardware can be or comprise a sensor which, in the course of operation, provides sensor data as input data.

[0035] The sensor can be a camera which, during operation, provides images and provides the image data thus provided as input data.

[0036] Similarly, the sensor can be a LIDAR sensor, a radar sensor or an ultrasonic sensor.

[0037] The application hardware can also comprise two or more such sensors.

[0038] In particular, in view of the resources, for example all sensor data, for example all image data, can be provided to the at least one main application and only a part of the sensor data, for example a part of the image data, is provided to the validation application.

[0039] For partitioning the computer system, any type of virtualization can be employed.

[0040] For example, so-called “Single-Root Input / Output Virtualization” (whose abbreviation “SR-IOV” is well known) can be employed. This means that the computer system can be partitioned by means of SR-IOV into at least one virtual main functional part and at least one virtual further functional part.

[0041] It is to be understood that by means of the method according to the application, two or more verification applications can also be run. This means that by means of at least one further functional part, at least one verification application is run. This also means that when a hypervisor is provided, at least one verification application is run on at least one further virtual machine.

[0042] For carrying out the method, advantageously a suitable computer program product is employed. Such a computer program product is likewise part of the application.

[0043] The computer program product comprises instructions which, when the computer program product is executed by the motor vehicle, cause the motor vehicle to carry out the method.

[0044] Further important features and advantages of the application will be derived from the dependent claims, the drawings and the related description of the drawings.

[0045] It is to be understood that the above-mentioned and still to be explained features, which are mentioned in the above description and in the claims, can be used not only in the respective combinations indicated, but also in other combinations or in isolation, without departing from the scope of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0046] Preferred exemplary embodiments of the application are shown in the drawings and are explained in greater detail in the following description, in which the same reference signs denote the same, similar or functionally identical parts.

[0047] In each case, schematically shown is:

[0048] Figure 1 : highly simplified schematic diagram of a motor vehicle with a computer system;

[0049] Figure 2 : schematic diagram of a computer system divided into virtual functional parts;

[0050] Figure 3 : flowchart for operating a motor vehicle. DETAILED DESCRIPTION

[0051] Figure 1 Exemplarily shown in Fig. 1 is a motor vehicle 1 which comprises a computer system 2 for running an application 100, 200 (see Fig. 2). In Fig. 1, Figure 3 ) the computer system 2 is shown in a highly simplified manner. Figure 1In the exemplary embodiment shown, data is processed by the computer system 2, wherein the computer system 2 receives data from the hardware 3 of the motor vehicle 1. In the following, the hardware 3 is also referred to as application hardware 3 and the data is also referred to as input data. In the exemplary embodiment shown, the application hardware 3 is exemplarily shown as a sensor 4, which provides data of, for example, the environment of the motor vehicle 1 as input data, i.e. sensor data, during operation. In the following, it is exemplarily assumed that the sensor 4 is a camera, which provides image data as sensor data and thus as input data during operation. The computer system 2 is operated by applications 100, which are used for the current operation of the motor vehicle 1. In the following, these applications 100 are also referred to as main applications 100. Thus, the respective main applications 100 perform at least one step of the functionality required for the current operation of the motor vehicle 1. With the computer system 2, at least one application 200 for verifying the functionality of the motor vehicle 1 is additionally operated. The functionality can be a new functionality or a modified version of an existing functionality. This application 200 is also referred to as verification application 200 in the following. The respective at least one verification application 200 can be wirelessly transmitted to the motor vehicle 1 from an external source. Thus, the respective verification application 200 is not used for the current operation of the motor vehicle 1. With the respective verification application 200, it is checked in the exemplary embodiment shown whether a new functionality can be introduced or whether a modification of an existing functionality can be implemented.

[0052] For example, as Figure 2 For this purpose, the computer system 2 is divided into at least one virtual function part 5 for operating the at least one main application 100 and at least one virtual function part 6 separate from the at least one virtual function part 5 for operating the at least one verification application 200, as shown. For example, the computer system is divided into the virtual function parts 5, 6 by "Single Root Input / Output Virtualization" (short: "SR-IOV"). In the following, the respective virtual function part 5 is also referred to as main function part 5 and the respective virtual function part 6 is also referred to as further function part 6. As follows from the Figure 3 Exemplarily explained, the at least one main application 100 is operated by the at least one main function part 200 and the at least one verification application 200 is operated by the at least one further function part 200 and does not use the at least one main function part 200, i.e. exclusively by the further function part 200.

[0053] In Figure 2 and Figure 3 In the exemplary embodiment shown, a single main function part 5 and a single further function part 6 are both exemplarily assumed.

[0054] In the exemplary embodiment shown, the computer system 2 is statically divided into at least one main functional part 5 and at least one further functional part 6. This means that the resources of the computer system 2 can be statically allocated to the at least one main functional part 5 and the at least one further functional part 6. For example, two-thirds of the resources can be statically allocated to the at least one main functional part 5, and one-third of the resources can be statically allocated to the at least one further functional part 6. Virtualization is performed accordingly.

[0055] like Figure 2 As schematically shown, the illustrated exemplary embodiment further provides a hypervisor 7, which includes at least one virtual machine 8 for at least one main application 100 and at least one virtual machine 9 for at least one verification application 200. In the following, the corresponding at least one virtual machine 8 for at least one main application 100 is also referred to as the main virtual machine 8, and the corresponding at least one virtual machine 9 for the verification application 200 is also referred to as the additional virtual machine 9. In the illustrated exemplary embodiment, a single main virtual machine 8 and a single additional virtual machine 9 are assumed only as an example. The main virtual machine 8 is assigned to the main functional part 5 and is separated from at least one additional functional part 6. This means that the resources of the additional functional part 6 are not available to the main virtual machine 8. In addition, the additional virtual machine 9 is assigned to the additional functional part 6 and is separated from the main functional part 5. This means that the resources of the main functional part 5 are not available to the additional virtual machine 9. From Figure 3 It can be clearly seen that at least one main application 100 runs in the main virtual machine 8, and at least one verification application 200 runs in the other virtual machine 9. Figure 2 As shown, data communication 10 is performed between the main virtual machine 8 and the main functional part 5, and between the additional virtual machine 9 and the additional functional part 6. Figure 2 As shown, data communication 10 can take place via a bus 11 .

[0056] In the exemplary embodiment shown, the computer system 2 is illustratively a system on a chip 12, or simply "SoC" 12. In the exemplary embodiment shown, the SoC 12 includes a hardware accelerator 13. The hardware accelerator 13 illustratively includes an AI accelerator (not shown), which includes, for example, a neuromorphic processor (not shown), or is, for example, an AI accelerator. Figure 3In the exemplary embodiment shown, the hardware accelerator 13 is similarly divided by virtualization and thus comprises a virtual part as constituent of the main functional part 5 as well as a virtual part as constituent of the further functional part 6. The SoC 12 can further comprise a control device (short: "ECU") and / or an accelerator and / or a memory, each of which is not shown and is similarly divided by the described virtualization. In the exemplary embodiment shown, both the main virtual machine 8 and the further virtual machine 9 are running in the SoC 12.

[0057] Figure 3 An exemplary operation of the motor vehicle 1 during operation with respect to applying input data provided by the hardware 3 is shown. In the exemplary embodiment shown, the camera 4 is thus assumed as an application hardware, which provides images and thus image data as input data during operation.

[0058] As Figure 3It is shown that the image data is supplied to a host application 100, 100a, by which the image data, which exists as raw data, is converted. In the following, the host application 100, 100a is also referred to as a conversion application 100, 100a. The image data, which is converted by the conversion application 100, 100a, is supplied to a host application 100, 100b, which performs an image equalization. In the following, this host application 100, 100b is also referred to as an equalization application 100, 100b. Thus, the processing and / or preparation of the image data is performed by the conversion application 100, 100a and the equalization application 100, 100b. Thereby, the processed or prepared image data is supplied to a host application 100, 100c and a verification application 200, 200a, which are run by suitable components of the hardware accelerator 13. With the host application 100, 100c, objects in the image are detected by a virtual part of the hardware accelerator 13 belonging to the host function part 5. In the following, the host application 100, 100c is also referred to as a detection application 100, 100c. Furthermore, objects in the image are detected with the verification application 200, 200a, likewise by a virtual part of the hardware accelerator 13 belonging to the further function part 6. In the exemplary embodiment shown, the verification application 200, 200a represents, for example, a modified version of the detection application 100, 100c. The verification application 200, 200a is thus exemplarily an update or upgrade of the detection application 100, 100c. In the following, the verification application 200, 200a is also referred to as an update application 200, 200a. Based on a different allocation of resources, only a part of the processed and / or prepared image data can be provided to the update application 200, 200a. For example, it is conceivable to provide every third processed and / or prepared image to the update application 200, 200a and to provide all images to the detection application 100, 100c. The objects detected by the detection application 100, 100c are provided to a host application 100, 100d. For example, with the host application 100, 100d, the detected objects can be fused and tracked. In the following, the host application 100, 100d is also referred to as a tracking application 100, 100d. The objects detected by the update application 200, 200a are provided to a verification application 200, 200b. Furthermore, the objects detected by the detection application 100, 100c are provided to the verification application 200, 200b. In the verification application 200, 200b, the results of the update application 200, 200a can be compared with the corresponding results of the detection application 100, 100c. By this comparison, it can be assessed whether the update application 200, 200a can be approved as a future host application 100, for example, as a future detection application 100, 100c. In the following, the verification application 200, 200b is also referred to as an assessment application 200, 200b.

[0059] In the exemplary embodiment shown, the results of the tracking application 100, 100d are provided to a host application 100, 100e. The host application 100, 100e can be a component of a driver assistance system (not shown separately) of the motor vehicle 1, in the following also referred to as assistance application 100, 100e. For example, by means of the assistance application 100, 100e, an automatic braking function of the motor vehicle 1 can be executed.

[0060] The method is exemplarily executed by means of a computer program product containing corresponding instructions.

Claims

1. A method for operating a motor vehicle (1), - having: a computer system (2) of a motor vehicle (1), at least one main application (100) for operating the motor vehicle (1) being executed via the computer system (2), -in, The computer system (2) is divided into at least one virtual main functional part (5) and at least one virtual further functional part (6) by virtualization, - wherein the at least one main application (100) is executed via the at least one main functional part (5), - wherein at least one verification application (200) is provided for verifying the functionality of the motor vehicle (1), - wherein at least one authentication application (200) in the computer system (2) is completely executed by the at least one further functional part (6).

2. The method according to claim 1, It is characterized in that The computer system (2) is statically divided into the at least one main functional part (5) and the at least one further functional part (6).

3. The method according to claim 1 or 2, It is characterized by: The computer system (2) is divided by virtualization in such a way that more resources of the computer system (2) are allocated to the at least one main functional part (5) than to the at least one further functional part (6).

4. The method according to claim 3, It is characterized in that The computer system (2) is divided by virtualization in such a way that the resources of the computer system (2) allocated to the at least one main functional part (5) are at least twice as many as the resources of the computer system (2) allocated to the at least one further functional part (6).

5. The method according to any one of claims 1 to 4, It is characterized by: - providing a hypervisor (7) comprising a primary virtual machine (8) and at least one further virtual machine (9), - the at least one primary virtual machine (8) is assigned to the at least one primary functional part (5) and is separate from the at least one further functional part (6), - the at least one further virtual machine (9) is assigned to the at least one further functional part (6) and is separate from the at least one main functional part (5), - the at least one main application (100) is executed in the at least one main virtual machine (8), and the at least one verification application (200) is executed in the at least one further virtual machine (9).

6. The method according to any one of claims 1 to 5, It is characterized by: - the motor vehicle (1) comprises application hardware (3) which generates input data during operation, wherein the input data is provided to at least one of the at least one host application (100), - said input data being at least partially provided to at least one of said at least one authentication application (200).

7. The method according to claim 6, It is characterized by: At least one sensor (4) is used as application hardware (3), which provides sensor data as input data.

8. The method according to claim 6 or 7, It is characterized by: For verification, a result of at least one of the at least one verification application (200) is compared with a result of at least one of the at least one main application (100).

9. The method according to any one of claims 1 to 8, It is characterized by: The computer system (2) comprises at least one hardware accelerator (13), which is divided by virtualization so that the at least one hardware accelerator (13) forms part of at least one such virtual main functional part (5) and part of at least one such virtual further functional part (6).

10. The method according to any one of claims 1 to 9, It is characterized in that The computer system (2) is divided into the at least one virtual main functional part (5) and the at least one virtual additional functional part (6) by single root input / output virtualization.

11. A computer program product comprising commands which, when executed by a motor vehicle (1), cause the motor vehicle (1) to carry out the method according to any one of the preceding claims.

Images