Vehicle, device, data carrier, computer program and method for executing safety-critical and non-safety-critical functions by means of data processing circuit

Abstract

Embodiments of the present disclosure relate to a vehicle, an apparatus, a data carrier, a computer program, and a method of performing safety-critical and non-safety-critical functions via a data processing circuit. The method comprises performing the non-security critical function using a dedicated first software resource and / or a dedicated first hardware resource, and performing the security critical function using a dedicated second software resource and / or a dedicated second hardware resource.

Description

[0001] The embodiments disclosed herein relate to a vehicle, a device, a data carrier, a computer program, and a method for performing safety-critical and non-safety-critical functions via data processing circuitry. Specifically, but not limited to, the embodiments relate to the concept of an x-by-wire system for a vehicle.

[0002] With the automation, electrification, and communication advancements in vehicles, safety-critical software plays an increasingly important role. However, safety-critical software may require special protection to prevent malfunctions and / or malicious attacks, which can bring several drawbacks: • Development and certification costs are high (considering that only a few features, such as a limited number of messages, are critical).

[0003] • Each change, even for non-safety-critical functions (also referred to as "quality management" (QM) functions in this article for automotive applications), may require a complete revalidation.

[0004] • Existing concepts are not scalable for complex systems (considering the number of features, lines of code, configuration space / variants, interdependencies, etc., the certification workload is enormous or grows exponentially).

[0005] • There is an undesirable trade-off between resources and complexity: higher resource consumption and management complexity (e.g., managing shared buffers instead of dedicated buffers).

[0006] Therefore, an improved concept may be needed for data processing circuitry that performs both safety-critical and non-safety-critical functions (or multiple functions or each function).

[0007] The subject matter disclosed herein can meet this need.

[0008] This disclosure provides a method for performing safety-critical and non-safety-critical functions via data processing circuitry. The method includes performing the non-safety-critical functions using dedicated first software resources and / or dedicated first hardware resources, and performing the safety-critical functions using dedicated second software resources and / or dedicated second hardware resources. This approach avoids undesirable interference (spatial and / or temporal interference) to safety-critical functions. Simultaneously, the certification workload for safety-critical software may be reduced. Similarly, the proposed method enables software including safety-critical functions to be scalable to complex systems and avoids undesirable trade-offs between resources and complexity.

[0009] In some implementations, a non-safety-critical function is a first sub-function of a higher-level function, and a safety-critical function is a second sub-function of the same higher-level function, wherein the first sub-function processes non-safety-critical data, and the second sub-function processes safety-critical data. Therefore, first dedicated software and / or hardware resources are reserved for / dedicated to the first sub-function, and second dedicated software and / or hardware resources are reserved for / dedicated to the second sub-function to avoid interference between the non-safety-critical and safety-critical functions. In this way, the safety-critical portion of the higher-level function can be reduced compared to methods that consider and / or identify the entire function, including both safety-critical and / or non-safety-critical portions, as safety-critical. Therefore, compared to this "holistic" approach, the complexity of the dedicated software and / or hardware resources required for the safety-critical portion (i.e., the second sub-function) of the safety-critical function can be reduced.

[0010] In practice, the dedicated second software resource may include dedicated software or software stacks for the safety-critical functions, and the dedicated second hardware resource may include one or more dedicated processing resources for one or more processing cores and / or one or more dedicated communication controller resources and / or one or more dedicated memory resources. Therefore, those skilled in the art will understand that the separation between safety-critical and non-safety-critical functions can be hardware-based and / or software-based. For example, safety-critical and non-safety-critical functions may use corresponding separate physical and / or virtual memory storage / buffers.

[0011] According to some implementation plans, it is recommended to use separate dedicated operating modes for safety-critical functions and non-safety-critical functions to avoid interference with functionality.

[0012] For example, in some implementations, the method further includes switching between a normal mode (where non-safety-critical functions can be performed) and a high-reliability mode, wherein when safety-critical functions are performed in high-reliability mode, their execution is protected against unacceptable interruptions. In this way, it can be ensured that safety-critical functions are performed within the expected timeframe (and are not delayed beyond an acceptable time due to interruptions).

[0013] Some embodiments of this disclosure are based on the finding that even safety-critical functions may include non-safety-critical components. Nevertheless, in other approaches, such non-safety-critical components are integrated with safety-critical components. Therefore, the implementation of such safety-critical functions is more complex, and the non-safety-critical components consume hardware and / or software resources dedicated to safety-critical software.

[0014] Therefore, one approach of this disclosure is to break down safety-critical functions (during their development) into sub-functions of safety-critical components and non-safety-critical components, as an alternative to or supplement to the separation of higher-level functions.

[0015] For example, safety-critical functions are separated into a first non-safety-critical sub-function for preparation and / or configuration and a second safety-critical sub-function for execution in a high-reliability mode. In such embodiments, the method further includes executing the first sub-function to generate input for the second sub-function, checking the validity of the input for the second sub-function, and if the input is valid, switching to a high-reliability mode. The second sub-function is then executed in high-reliability mode using the input.

[0016] In this way, the complexity of safety-critical components can be reduced, thereby reducing the hardware and / or software resources used in safety-critical components.

[0017] In some implementations, valid (verified) input is locked to prevent any action from being taken on the input after verification.

[0018] Those skilled in the art will understand that the proposed method can be applied to a variety of applications that require or implement safety-critical functions. In particular, implementations of the proposed method can be deployed in automotive applications.

[0019] For example, the data processing circuit is configured for use with the vehicle's control circuitry. In practice, the control circuitry may correspond to or include an electronic control unit (ECU) for the vehicle.

[0020] It should be noted that, in the context of this disclosure, the term "vehicle" should be interpreted broadly. Therefore, examples of vehicles can include any mode of transport, such as automobiles, rails, buses, motorcycles, ships, airplanes, etc.

[0021] In some implementations, data processing circuitry is configured for use with the engine control system and / or the steer-by-wire (X-system). The engine control system may be configured to control the propulsion engine (e.g., an electric motor and / or an internal combustion engine). In the term "steer-by-wire (X-system)," "X" should be understood as a placeholder for any function of electronic control. In practice, the proposed method may be applied, for example, to brake-by-wire systems or steering-by-wire systems.

[0022] The proposed method can be implemented as a computer-based method. In practice, the proposed method is implemented, for example, in a computer program.

[0023] Therefore, a further method provides a computer program comprising instructions that, when executed by a computer, cause the computer to perform an embodiment of the proposed method.

[0024] Such computer programs can be stored on various data carriers.

[0025] Therefore, the implementation scheme may provide a computer-readable data carrier on which the proposed computer program is stored.

[0026] A further embodiment provides an apparatus including one or more interfaces for communication and data processing circuitry configured to perform the proposed method.

[0027] For the hardware-based separation described above, one or more interfaces and / or data processing circuits may include dedicated hardware resources for safety-critical functions.

[0028] For example, the interface includes one or more dedicated interfaces and / or data processing circuitry for safety-critical functions, such as one or more dedicated processing cores, buffers, and / or memory devices for safety-critical functions.

[0029] As described above, the proposed method can be deployed in automotive applications. Therefore, the implementation scheme can provide a vehicle incorporating the proposed device.

[0030] Furthermore, embodiments are now described with reference to the accompanying drawings. It should be noted that the embodiments shown in the drawings are merely examples illustrating alternative embodiments, and the scope of this disclosure is by no means limited to the presented embodiments: Attached Figure Description

[0031] Figure 1 A flowchart is shown, schematically illustrating an implementation scheme for a method of performing safety-critical and non-safety-critical functions through data processing circuitry; Figure 2 It illustrates how a function can be broken down into individual sub-functions; Figure 3 A block diagram schematically illustrating an embodiment of the device according to the proposed method is shown; and Figure 4 An exemplary architecture of the proposed method is shown.

[0032] Interference between safety-critical and non-safety-critical software refers to situations where the operation or failure of non-safety-critical software affects the performance or safety of safety-critical software. Safety-critical software is designed to ensure the safe operation of systems in industries such as aviation, automotive, medical devices, and nuclear power plants, where failures can result in significant losses.

[0033] In complex systems, safety-critical software frequently interacts with non-safety-critical software components, such as user interfaces, diagnostic tools, or support systems. However, these interactions can pose risks if not managed properly. For example, errors or failures in non-safety-critical software can overload system resources, leading to delays or failures in safety-critical tasks. Similarly, interference can occur if non-safety-critical software competes for shared resources, resulting in unpredictable behavior or compromising the integrity of safety-critical functions.

[0034] This disclosure provides a solution / method to avoid such interference.

[0035] The proposed method will be described in detail below with reference to the accompanying drawings.

[0036] Figure 1 A flowchart is shown, schematically illustrating an implementation of method 100 for performing safety-critical and non-safety-critical functions via data processing circuitry. In other words, method 100 relates to an application where one or more safety-critical and / or non-safety-critical functions are performed by the same data processing circuitry. In practice, these functions may be performed by the same computer or computing device.

[0037] In the context of this disclosure, the term "function" should be understood broadly. Therefore, examples of a function can be not only building blocks of software, but generally any type of function, purpose, and / or task that a data processing circuit can perform. In practice, examples of functions include one or more communication functions, diagnostic functions, and / or control functions.

[0038] Non-safety-critical functions can be understood as any function unrelated to safety. Therefore, non-safety-critical functions can be any function that does not affect application security; for example, security will not be compromised when a non-safety-critical function fails or is not implemented. In some implementations, non-safety-critical functions are used, for example, for entertainment purposes only.

[0039] On the other hand, safety-critical functions can be any type of function that provides safety. In other words, safety-critical functions can be any type of function that affects the safety of an application; for example, safety is reduced when a safety-critical function fails or is not implemented. In practice, safety-critical functions are used, for example, for safety-related communication and / or control operations.

[0040] In automotive applications, non-safety-critical functions may correspond to optional features in the vehicle's infotainment system. In contrast, safety-critical functions may be essential to the vehicle's safety-related functions, such as brake-by-wire, steering-by-wire, or any other steer-by-wire system.

[0041] Referring to the Automotive Safety Integrity Level (ASIL), non-safety-critical functions are such as quality management (QM) functions, while safety-critical functions are ASIL A, ASIL B, ASIL C, or ASIL D functions.

[0042] Those skilled in the art will understand that competing hardware and / or software resources, as well as safety-critical and non-safety-critical functions, may interfere with each other. However, to avoid hazardous situations, spatial and / or temporal interference of safety-critical functions may be undesirable or unacceptable.

[0043] Therefore, the proposed method suggests using dedicated first software resources and / or dedicated first hardware resources to perform 110 non-safety-critical functions, and using dedicated second software resources and / or dedicated second hardware resources to perform 120 safety-critical functions.

[0044] In this way, interference with functionality can be avoided or at least reduced. Therefore, the proposed method may offer greater security in application.

[0045] Various software and / or hardware implementations can be employed to address the proposed methods for avoiding spatial and / or temporal interference. In practice, for example, separate storage areas or processing resources for one or more processing cores can be allocated to safety-critical or non-safety-critical functions. In doing so, hardware features such as virtual memory or memory protection mechanisms can be used to isolate memory areas accessed by different functions. Alternatively, containerization and / or virtualization technologies can be deployed to isolate environments for different functions.

[0046] In the implementation scheme, the dedicated second software resource includes dedicated software or software stack for safety-critical functions, and the dedicated second hardware resource includes one or more dedicated processing resources of one or more processing cores and / or one or more dedicated communication controller resources and / or one or more dedicated memory resources.

[0047] Those skilled in the art will understand that the proposed hardware and / or software limitations may restrict performance, for example, because parallel computing may be prohibited. However, those skilled in the art will understand that the proposed method allows for the use of, or requires, dedicated hardware and / or software resources to reduce software complexity.

[0048] For example, in some implementations, a higher-level function is to be executed. In practice, a higher-level function may include one or more safety-critical sub-functions and one or more non-safety-critical sub-functions. According to the proposed method, the higher-level function can be broken down into safety-critical components / functions. In such an implementation, for example, a non-safety-critical function is a first sub-function of the higher-level function, and a safety-critical function is a second sub-function of the same higher-level function. The first sub-function processes non-safety-critical data, and the second sub-function processes safety-critical data.

[0049] The parent function is, for example, "send a message". However, the parent function can be configured to send non-safety-critical messages (as a first sub-function) and safety-critical information (as a second sub-function). According to other methods, even if non-safety-critical messages are sent, the parent function may still consume hardware and / or software resources intended for safety-critical functions. In doing so, excessive hardware and / or software resources required for safety-critical functions are needed.

[0050] In contrast, the proposed method suggests allocating dedicated hardware and / or software resources for the corresponding sub-functions of the higher-level functions. Referring to the example above, sending safety-critical messages (the second sub-function) utilizes hardware and / or software resources dedicated to safety-critical functions, while sending non-safety-critical messages (the first sub-function) utilizes hardware and / or software resources allocated to non-safety-critical functions. This approach reduces performance limitations.

[0051] In some applications, the suggested approach can be applied to minimize safety-critical sub-functions, i.e., reduce them to an absolute minimum (the amount of code or computational cost of executing the code), in order to minimize performance limitations.

[0052] For time-separated functions, their execution can be scheduled so that they do not overlap in time when accessing shared resources. Appropriate synchronization mechanisms can be applied for this. In particular, scheduling algorithms can be used that prioritize safety-critical functions to ensure they execute at the appropriate time.

[0053] In particular, the proposed method suggests using at least two time modes to execute functions temporally separately. This achieves temporal separation.

[0054] For example, a high reliability mode (also referred to herein as "critical mode," cM) and a so-called "normal mode" (nM) can be applied (e.g., startup, shutdown). The high reliability mode ensures that functions performing in high reliability mode are not interrupted (if the interruption time is too long, such as exceeding a predefined time period).

[0055] To this end, method 100 may include switching between a normal mode (e.g., for non-safety-critical functions) and a high-reliability mode (e.g., for safety-critical functions). In doing so, when a safety-critical function is executed in high-reliability mode, its execution is protected against unacceptable interruptions. In this way, unacceptable delays in safety-critical functions can be avoided.

[0056] Therefore, protective mechanisms can be applied to prevent unexpected service interruptions, such as in high-reliability mode. An unexpected service interruption refers, for example, the use of a service interface that would cause the execution of safety-critical functions to be interrupted during high-reliability mode, such as calling a transceiver driver to stop communication (where communication is a safety-critical function) during high-reliability mode. Any service that provides a service interface that could directly lead to an unexpected service interruption needs to lock the relevant service interface in high-reliability mode by blocking such requests.

[0057] Dedicated hardware resources used for safety-critical functions (also referred to herein as "critical hardware," cHW) may include guaranteed or reserved central processing unit (CPU) time on one or more processing cores, dedicated (physical) memory, dedicated buffers (e.g., for communication), and exclusive control over critical I / O hardware such as communication controllers and transceivers. Dedicated hardware resources may be provided via dedicated physical resources or shared physical resources with protections in hardware (HW) and / or software (SW), such as memory protection units, task prioritization with a strict priority scheduler, and / or execution time budget execution.

[0058] Those skilled in the art will understand that application performance may be degraded in high reliability mode, for example, because parallel execution of other functions sharing the same resources is not permitted. However, by separating or splitting safety-critical and non-safety-critical components as proposed, the use of high reliability mode can be reduced (to a minimum) to mitigate performance limitations.

[0059] In some applications, safety-critical (sub)functions may include one or more safety-critical and non-safety-critical sub-functions. Therefore, it is recommended to separate safety-critical functions into a first non-safety-critical (sub)function for preparation and / or configuration and a second safety-critical (sub)function for execution in a high-reliability mode. This approach can further reduce the complexity of safety-critical software.

[0060] The first non-safety-critical subfunction is configured, for example, to obtain the (required) input of the second safety-critical subfunction, such as for initializing or configuring the second safety-critical subfunction.

[0061] Furthermore, this application of method 100 may include checking whether the input for the second sub-function is valid, and if the input is valid, switching to a high reliability mode and using the input to perform the second sub-function in the high reliability mode.

[0062] Referring to the example above, a security-critical function is, for example, "sending security-critical messages." For this, the message recipient's address (e.g., IP address) can be obtained and / or an encryption key can be exchanged with the recipient.

[0063] Based on one idea of ​​the proposed method, such preparation, initialization and / or completion measures, referred to herein as “auxiliary functions” or “non-safety-critical sub-functions”, may not themselves be safety-critical.

[0064] However, in other approaches, these auxiliary functions can be performed alongside the "actual" safety-critical parts of the safety-critical functions (e.g., transmitting safety-critical messages), using the same software and / or hardware resources as the safety-critical parts. Therefore, additional software and / or hardware resources and / or more certification effort may be required.

[0065] The proposed method suggests separating non-safety-critical sub-functions from safety-critical sub-functions. Therefore, dedicated, separate software and / or hardware resources can be used to execute both non-safety-critical and safety-critical sub-functions.

[0066] In other words, the implementation provides functional decomposition, including separating security-critical functions into at least one critical function and one or more auxiliary functions (normal functions that may be needed before or after the execution of the critical function, such as startup, shutdown, initialization, channel setup, and key exchange). In addition, other functions (normal functions that are not required for the operation of security-critical functions, such as diagnostics) can also be implemented.

[0067] Therefore, as Figure 2 As shown, in practice, the safety-critical function 210 is separated into a first non-safety-critical sub-function 211 for preparation and / or configuration and a second safety-critical sub-function 212 for execution in a high-reliability mode. In such an implementation, for example, the first sub-function 211 may generate input for the second sub-function 212. For sending a safety-critical message, the first sub-function 211 may include obtaining the address information of the message recipient and / or exchanging a cryptographic key with the recipient. Thus, the first sub-function 211 may include, for example, a handshake for communication. Therefore, the input may include address information and / or a cryptographic key. The second sub-function 212 may correspond to or include the (actual) transmission of the message, for example, generating (encrypted) communication signals / packets and / or transmitting such signals / packets for transmitting the safety-critical message.

[0068] The proposed method also suggests checking the validity of the input used for the second sub-function 212. In doing so, the input can be checked for any inaccuracies, errors, and / or anomalies. Referring to the use cases described above, for example, the recipient's address information and / or password key can be verified. To do this, the input can be compared with predefined references, such as reference address information and / or reference password key.

[0069] In an implementation of the high-reliability mode, if the input is valid, the proposed method can suggest switching to high-reliability mode and performing the second sub-function 212 in high-reliability mode using the input. In this way, the amount of software and / or hardware resources used for safety-critical components can be reduced, and / or the certification workload can be reduced.

[0070] Therefore, the proposed method can allow for the separation of dedicated hardware and / or software resources, while reducing or ideally minimizing functional duplication.

[0071] Therefore, the proposed method can provide a so-called "online self-test" to avoid the security assignment of accessibility functions by entering high-reliability mode before execution. The service is then locked, and the results of the accessibility function are verified through the online self-test. For example, the server address is discovered by the service discovery component (accessibility function) and will be used for critical communication between the client and server. After providing the server address to the client, updates to the client's server address are locked (to prevent subsequent manipulation or modification). Tests are performed, such as on the communication between the server and client, and if successful, the transition to high-reliability mode is approved. With this approach, no security requirements are directly assigned to the accessibility functions—the results of these functions are verified, so how the results are achieved (from a security perspective) is not considered.

[0072] Those skilled in the art will understand that the proposed method can be applied to any number of safety-critical functions.

[0073] The proposed method not only guarantees or allocates hardware and / or software resources for safety-critical functions and surplus hardware resources for normal functions (non-safety-critical functions), but also provides functional replication / splitting (dedicated software for safety-critical functions). In doing so, the individual software implementations of safety-critical functions can be reduced (ideally to the absolute minimum of the required functions (critical software (cSW))) and executed on cHW in a high-reliability mode.

[0074] Those skilled in the art will also understand that the proposed functional splitting allows for functional reuse, such as the reuse of auxiliary functions. For example, this allows the use of commercial off-the-shelf (COTS) basic software (unqualified software or embedded system software) running on the nHW in normal mode to perform the functions required for safety-critical functions, but without performing the actual safety-critical parts (e.g., the actual transmission of safety-critical messages).

[0075] Function reuse can also be applied to other functions. In doing so, the COTS base software (embedded system software) can be used on the nHW for normal functions independent of the mode used.

[0076] As mentioned above, safety-critical function 210 can be a sub-function of higher-level function 200. For example, higher-level function 200 includes a non-safety-critical first sub-function 220 and a second sub-function 210 corresponding to safety-critical function 210.

[0077] For the exemplary parent function "Send Message", the safety-critical function 210 corresponds to "Send Safety-Critical Message", and the sub-function 220 corresponds to "Send Non-Safety-Critical Message".

[0078] In practice, the proposed method can be applied to any data processing circuit performing both safety-critical and non-safety-critical functions. Those skilled in the art will understand that the proposed solution can be applied not only to automotive applications but also to any other applications in various technical fields, such as medicine and information technology.

[0079] In automotive applications, data processing circuitry is configured, for example, as part of the vehicle's control circuitry. In this example, the data processing circuitry may be part of or include the vehicle's electronic control unit (ECU).

[0080] In particular, implementations of the proposed method can be used in safety-critical applications. In automotive applications, the data processing circuitry is configured, for example, for engine control systems and / or drive-by-wire systems (brake-by-wire, steering-by-wire, etc.).

[0081] As mentioned above, the proposed method can be implemented not only in software but also in hardware. Therefore, implementations can involve devices specifically adapted to implementations of the proposed method.

[0082] Figure 3 A block diagram schematically illustrating an embodiment of such a device 300 is shown. The device includes one or more interfaces 310 for communication and data processing circuitry 320 configured to perform the proposed method.

[0083] In the implementation, one or more interfaces 310 may include wired and / or wireless interfaces for transmitting and / or receiving communication signals while performing the proposed concept. In practice, interfaces may include, for example, pins, wires, antennas, etc. Similarly, interfaces may include means for performing (analog and / or digital) signal or data processing during communication, such as filters, samplers, analog-to-digital converters, signal acquisition and / or reconstruction means, and signal amplifiers, compressors, and / or any encryption / decryption means.

[0084] The data processing circuit 320 can correspond to or include any type of programmable hardware. Therefore, examples of the data processing circuit 320 include, for example, a memory, a microcontroller, a field-programmable gate array (FPGA), or one or more central and / or graphics processing units (CPUs). To perform the proposed method, the data processing circuit 320 can be configured to access or retrieve an appropriate computer program from its memory or a separate memory communicatively coupled to it to perform the proposed method.

[0085] The hardware of the device can be configured such that one or more interfaces and / or data processing circuitry include dedicated hardware resources for safety-critical functions. In practice, the interfaces include separate dedicated interfaces for both safety-critical and non-safety-critical functions (e.g., a separate dedicated Controller Area Network (CAN) interface). Alternatively or additionally, the data processing circuitry 320 may include a dedicated controller (e.g., a dedicated CAN controller) for both safety-critical and non-safety-critical functions.

[0086] Optionally, the data processing circuitry includes one or more dedicated processing cores, buffers, and / or memory devices for safety-critical functions.

[0087] like Figure 4 As shown in the right-hand block diagram, the proposed method's implementation provides hardware and software-based separation of data paths. Figure 4 In some implementations, for example, safety-critical sub-functions (referred to herein as “Fault-Operated (Op) Safety Applications”) run on a dedicated software stack (referred to herein as the “Fault-Operated (Op) Stack”) and use a dedicated CAN interface (“Fault-Operated (Op) CAN”). Furthermore, a dedicated CAN controller is used for the safety-critical sub-functions.

[0088] On the other hand, the non-safety-critical subfunctions (“fail-safe applications”) and additional software (“QM applications”) run on a separate software stack (“standard stack”) dedicated to the non-safety-critical functions and use a separate CAN interface (“CAN”). Furthermore, they also use a separate CAN controller.

[0089] As can be seen in the foregoing description, various features are grouped together in the examples for the purpose of simplification. This approach of the disclosure should not be construed as reflecting an intention that the claimed examples require more features than are expressly recited in each claim. Rather, as reflected in the appended claims, the subject matter of the invention may lie in fewer than all the features of a single disclosed example. Therefore, the appended claims are incorporated herein by reference, wherein each claim may itself serve as a separate example. While each claim may itself serve as a separate example, it should be noted that although dependent claims may refer to a specific combination with one or more other claims in the claims, other examples may also include combinations of dependent claims with the subject matter of each other dependent claim, or combinations of each feature with other dependent or independent claims. Such combinations are proposed herein unless it is stated that a specific combination is not contemplated. Furthermore, even if a claim is not directly dependent on any other independent claim, the features of that claim are contemplated to be included in that independent claim.

[0090] While specific embodiments have been shown and described herein, those skilled in the art will understand that various alternatives and / or equivalent implementations may be substituted for the specific embodiments shown and described without departing from the scope of the invention. This application is intended to cover any adaptations or variations of the specific embodiments discussed herein. Therefore, it is contemplated that the embodiments are limited only by the claims and their equivalents.

Claims

1. A method (100) for performing safety-critical functions (210) and non-safety-critical functions (220) via a data processing circuit (320), the method (100) comprising: The non-safety-critical function (220) described in (110) is performed using dedicated first software resources and / or dedicated first hardware resources; as well as The safety-critical function (210) described in (120) is performed using dedicated second software resources and / or dedicated second hardware resources.

2. The method (100) as claimed in claim 1, wherein the non-safety-critical function (220) is a first sub-function of a higher-level function (200), and the safety-critical function (210) is a second sub-function of the same higher-level function (200), wherein the first sub-function (211) processes non-safety-critical data, and the second sub-function (212) processes safety-critical data.

3. The method (100) of claim 1 or claim 2, wherein the dedicated second software resource includes dedicated software or software stack for the security-critical function (210), and wherein the dedicated second hardware resource includes one or more dedicated processing resources of one or more processing cores and / or one or more dedicated communication controller resources and / or one or more dedicated memory resources.

4. The method (100) as claimed in any of the preceding claims, wherein the method (100) further includes switching between a normal mode and a high reliability mode, wherein when the safety-critical function (210) is performed in the high reliability mode, its execution is protected against unacceptable interruptions.

5. The method (100) as claimed in any of the preceding claims, wherein the safety-critical function (210) is separated into a first non-safety-critical sub-function (211) for preparation and / or configuration and a second safety-critical sub-function (212) for execution in the high-reliability mode, and wherein the method (100) further comprises: Execute the first sub-function (211) to generate input for the second sub-function (212); Check whether the input to be used in the second sub-function (212) is valid; If the above is effective, then switch to the high reliability mode; as well as The second sub-function (212) is executed in the high reliability mode using the input.

6. The method (100) as described in any of the preceding claims, wherein the data processing circuit (320) is configured for use in the control circuit of the vehicle.

7. The method (100) as described in any of the preceding claims, wherein the data processing circuit (320) is configured for use in an engine control system and / or a drive-by-wire system.

8. A computer program comprising instructions that, when executed by a computer, cause the computer to perform the method (100) as claimed in any one of claims 1 to 7.

9. A computer-readable data carrier storing a computer program as described in claim 8.

10. An apparatus (300), comprising: One or more interfaces (310) for communication; as well as A data processing circuit (320) configured to perform the method (100) according to any one of claims 1 to 7.

11. The device (300) of claim 10, wherein the one or more interfaces (310) and / or data processing circuitry include dedicated hardware resources for safety-critical functions (210).

12. The device (300) of claim 11, wherein the interface (310) includes one or more dedicated interfaces for the safety-critical function (210), and / or wherein the data processing circuitry (320) includes one or more dedicated processing cores, buffers and / or memory devices for the safety-critical function (210).

13. A vehicle comprising the device (300) according to any one of claims 10 to 12.

Images