Method for operating a system with at least two computing units

Abstract

Method for operating a system (100, 100', 100") comprising a first computing unit (110) and at least one second computing unit (140, 150, 160) which is in communication connection with the first computing unit (110), wherein the first computing unit (110) and the at least one second computing unit (140, 150, 160) are used for different functions (111, 141, 151, 161) during the operation of the system (100, 100', 100"), wherein, during operation (B0) of the system, a prediction (P) for a future desired and / or necessary behavior of the system in the event of a functional limitation of the first computing unit (110) and / or the communication link between the first computing unit (110) and the at least one second computing unit (140, 150, 160) is determined and transmitted to the at least one second computing unit (140, 150, 160), and wherein, if a functional limitation of the first computing unit (110) and / or the communication link between the first computing unit (110) and the at least one second computing unit (140, 150, 160) is detected, the operation (B1, B2) of the system with respect to the function of the first computing unit (110) is carried out by the at least one second computing unit (140, 150, 160) on the basis of the prediction (P) transmitted to it, characterized in that if the functional limitation is remediable, the Functional limitation will be resolvedduring the operation (B1) of the system with respect to the function of the first computing unit (110) is carried out by the at least one second computing unit (140, 150, 160) on the basis of the prediction (P) transmitted to it, and wherein the operation (B0) of the system with respect to the function of the first computing unit (110) is subsequently carried out again by the first computing unit (110), wherein the first computing unit is a computing unit, in particular a microcontroller, in a vehicle and the at least one second computing unit is a computing unit located outside the vehicle.

Description

[0001] The present invention relates to a method for operating a system comprising a first computing unit and at least one second computing unit which is in communication connection with the first computing unit, as well as to a system and a computer program for carrying out the method. State of the art

[0002] Modern motor vehicles use control units that perform various functions. For example, higher-level control units can be used for higher-level monitoring or control functions, while lower-level control units can be used for specific functions, such as a brake control system.

[0003] With increasing automation, even autonomous driving, it is important—and sometimes even mandatory—to make control units as fail-safe and error-proof as possible, while also ensuring that the vehicle can still be safely controlled even if a control unit fails. This is especially true for higher-level control units.

[0004] DE 10 2013 007 857 A1 discloses a method for operating a braking system in fully automated driving and a motor vehicle. This method provides that, during a fault-free operating phase of the braking system, an action plan comprising a safe state of the motor vehicle, in particular bringing the vehicle to a standstill, is determined in a chronological sequence based on operating parameters and continuously updated based on current operating parameters. The current action plan is stored in a memory and executed by an emergency module when a fault occurs in the braking system. Disclosure of the invention

[0005] According to the invention, a method for operating a system comprising a first computing unit and at least one second computing unit, as well as a system and a computer program for implementing the method, are proposed, with the features of the independent patent claims. Advantageous embodiments are the subject of the dependent claims and the following description.

[0006] A method according to the invention serves to operate a system which comprises a first computing unit and at least one second computing unit which is communicatively connected to the first computing unit. Such a system can be a physical system, in which case it may include, for example, control units, processor cores and the like, as explained in more detail later. However, such a system can also be a logical system, in which the computing units are then formed by logical units such as, for example, various software components in a software architecture. The logical system can be executed on one or more computing units, for example comprising control units, microcontrollers and computer cores. In the case of the physical system, such a communication connection can be established, for example, via a communication network such as a bus, Ethernet or even wirelessly.In the case of a logical system, the communication connection can be established, for example, in the software itself. The first processing unit and at least one second processing unit are used for different functions during the operation of the system. The system can, in particular, be part of a (motor) vehicle. However, the processing units can also be used in mechanical or plant engineering, in medical devices (e.g., for medication) or applications, in process or power plant engineering, or even in aircraft and rail vehicles.

[0007] The computing units themselves can (in the case of a physical system) be used in particular as control units. However, it is equally conceivable that microcontrollers or processor cores are used, for example each in a vehicle. It is also conceivable to use microcontrollers and active drivers (i.e. driver circuits with their own “intelligence”, e.g. in the form of an IC or ASIC), the latter then as a second computing unit. It is also conceivable that the first computing unit, in particular a microcontroller, is used in a vehicle, and that the at least one second computing unit is used as a computing unit located outside the vehicle. This at least one second computing unit can be networked with the first computing unit via a suitable communication and can be located, for example, in a fleet management system or another vehicle or a technical device.However, it is equally conceivable for the first and second computing units to be formed as separate microcontroller cores within a microcontroller or as separate microcontrollers in a control unit or multiple control units in a technical unit, e.g. a vehicle, or from combinations of these elements. It is also particularly preferred for the first computing unit to be used as the master computing unit and the at least one second computing unit to be used as the slave computing unit. Although the invention is described here and below in particular with reference to control units in a motor vehicle, it should be noted that the invention can also be used in the other fields or applications mentioned.

[0008] During operation of the system, a prediction is now determined for a future desired or necessary behavior of the system in the event of a functional restriction, in particular a failure, of the first computing unit and / or the communication connection between the first computing unit and the at least one second computing unit (i.e. when a functional restriction occurs in which the first computing unit can no longer be used properly for the system) and in particular continuously or repeatedly transmitted to the at least one second computing unit. In other words, the prediction determines how the system should or would have to behave in the future if no such functional restriction occurred, i.e. if regular operation were to continue and / or how the system should or would have to behave in the future assuming a corresponding functional restriction.The behavior of the system includes in particular the control of actuators, a concrete use of measured values ​​from sensors and the like.

[0009] The prediction can, for example, include data from the system's environment and surroundings, as well as from the system itself or from external systems. Furthermore, functional or technical data of the system can be collected, as well as data related to functional and information technology safety (safety and security).

[0010] The sources of the data can be, for example, location data (direction, speed and acceleration) of objects moving around the system or data from the behavior of system components themselves or environmental data from road properties (humidity, roughness and the like).

[0011] Data from the observation of functional or informational safeguards can also be considered, e.g., the number, severity, and frequency of these safeguards being triggered. From the data history of these sources, taking into account data already stored and possibly pre-processed by the system, conclusions can be drawn about the desired or necessary future behavior of the system.

[0012] An example would be a motor vehicle that is driven or driven along a winding country road under the control of a driver assistance system. The driver assistance system calculates not only the vehicle data for the currently required lane tracking, but also additional data. This additional data is based on the current data from the driver assistance system and serves the purpose of keeping the vehicle safely on the road and, if necessary, bringing it to a controlled stop in the event of a failure of the driver assistance system or functionally relevant components of that driver assistance system.

[0013] Another example would be a motor vehicle controlled by a driver assistance system driving or being driven along a winding country road that is also used by other vehicles with which communication exists. The driver assistance system calculates not only the vehicle data for the currently required lane tracking, but also additional data. This additional data is based on the current data from the driver assistance system and serves the purpose of informing other vehicles about the vehicle's expected behavior in the event of a failure of its driver assistance system or functionally relevant components of the driver assistance system (see also the previous example), so that the other vehicles can independently initiate an appropriate response, e.g., evasive maneuvering.

[0014] Yet another example would be a motor vehicle with a battery system that is connected to a safety-relevant shutdown device via its own control unit and serves to supply other safety-relevant systems via an electrical circuit. The safe state of the battery system is defined as being disconnected from the electrical circuit. These systems continuously transmit to the battery or battery system their expected energy requirements, the duration, and the purpose in the event that one of these systems or the communication with it fails. Using this information, the shutdown behavior of the battery system can be influenced in such a way that it disconnects from the electrical circuit with a delay. The delay is dynamically adapted to the current situation. The duration of the delay is selected according to the aforementioned specifications of the other systems.In addition to the duration, the shutdown condition can also be based on other technical criteria, such as the power requirement of the braking system during the currently active control.

[0015] As mentioned, such transmission can occur regularly, continuously, or quasi-continuously; the recorded (raw data) and, if applicable, already processed values ​​(intermediate data) or compressed data (reduced to support points) can be stored in a data memory. Based on the values ​​in this memory and associated mathematical models, the prediction can, for example, produce an extrapolation to a specific time period in the future. Depending on the length of this time period, the prediction can be determined with varying degrees of complexity. Such a prediction can, in particular, be based on data or measured values ​​that are recorded or determined, for example, using sensors and on the basis of which the first computing unit performs its function. Values ​​or parameters used to control actuators are also possible.Such functions are particularly suitable for functions within the context of autonomous or semi-autonomous driving. Functions of the at least one second processing unit, on the other hand, are particularly suitable for decentralized functions such as transmission control, drive control, brake control, directional control, and the like. In particular, several second processing units with different functions can be provided. For example, additional control units that provide sub-mechanisms for sensors, actuators, or communication (e.g., network connection, signal preprocessing) are also conceivable. The prediction itself can preferably also be plausibility-checked by the at least one second processing unit.

[0016] If a functional limitation of the first computing unit and / or the communication connection between the first computing unit and the at least one second computing unit is detected, the operation of the system with respect to the function of the first computing unit is carried out by the at least one second computing unit based on the prediction transmitted to it. A functional limitation can be understood in particular as a failure of the computing unit or a part of the computing unit or the associated communication connection.

[0017] In this way, the system can continue to operate, at least temporarily, even in the event of a functional limitation with respect to the first processing unit, i.e., within the scope of prediction. However, the first processing unit does not have to be completely redundant, i.e., no additional first processing unit needs to be provided, as has been the case up to now, which would entail additional design, material, and cost expenditure. Rather, the invention makes it possible to use other, and in particular subordinate, processing units that are already present as redundancy, so to speak.

[0018] The more and more precise data the prediction provides (i.e., the more functional support points, i.e., data values, it has for extrapolation), the longer and more accurately the system can be reliably operated by at least one second processing unit with the prediction based on this data. Thus, the failure tolerance time (FTT) of the first processing unit increases by the amount of data depth. In the case of multiple second processing units, it is also expedient to have or implement synchronization between these multiple second processing units.

[0019] It is preferred if the prediction for the behavior of the system is determined in the first computing unit. The prediction can thereby be determined particularly quickly and easily. Alternatively, it is preferred if the prediction is determined in a further computing unit that is in communication with the first computing unit and / or the at least one second computing unit. The further computing unit can be a further first computing unit, in particular a master computing unit. However, a computing unit provided specifically for this purpose is also conceivable. The prediction can then take place independently of the first computing unit. Compared to a completely redundant first computing unit, however, significantly less effort is required.

[0020] According to the invention, if the functional limitation is remediable, the functional limitation is remedied, while the operation of the system with respect to the function of the first computing unit is carried out by the at least one second computing unit based on the prediction transmitted to it. Subsequently, the operation of the system with respect to the function of the first computing unit is then carried out again by the first computing unit. In this way, a period of time until the functional limitation is remedied is bridged by means of the at least one second computing unit. Such a remediation of the functional limitation can, for example, take place - if possible - by restarting the first computing unit.

[0021] Such recoverable functional limitations include, in particular, random, non-permanent disruptions in the control and / or monitoring function of the first computing unit or the communication link, including the transmission of the prediction. Instead of resetting the entire first computing unit, it is also possible, for example, to reset only an affected part of its functionality, in each case with the functional goal of healing the system with respect to the first computing unit, with the at least one second computing unit now executing the overall control task of the system redundantly and independently for the period of time that can be classified, for example, as non-critical (with regard to the functional and safety objectives) based on the transmitted prediction. During this time, the first computing unit must then have recovered and be able to assume the control and monitoring tasks again.The prediction should be sufficiently deep to bridge a recovery of the first computing unit without the system becoming functionally critical.

[0022] Advantageously, if the functional limitation cannot be remedied, the operation of the system with respect to the function of the first computing unit is carried out by the at least one second computing unit based on the prediction transmitted to it, with the system being transferred to a safe state by the at least one second computing unit. Thus, if the limitation cannot be remedied, the motor vehicle can, for example, at least be stopped safely in a defined manner.

[0023] Such irrecoverable functional limitations are understood to mean random or systematic, but then remaining, failures in the control and / or monitoring function of the first processing unit or the communication link, including the transmission of the prediction to the at least one second processing unit. The first processing unit can then be transferred to the safe state (e.g., switched off) completely, or only an affected part of its functionality, with the aim of achieving the safe state of the system through the at least one second processing unit, which now executes the system's emergency control task redundantly and independently for the period that can be classified as non-critical (with regard to the functional and safety objectives) based on the transmitted prediction.During this time, at least one second processing unit should take over the control and monitoring tasks until the system can be transferred to a terminal safe state (e.g. shutdown, standstill or the like).

[0024] Depending on the type of functional restriction, it is therefore possible to maintain system operation as far as possible despite the functional restriction. In addition, a different reaction with regard to sensors and / or actuators can preferably occur depending on the type of functional restriction. The prediction should therefore generally be sufficiently deep and plausible to be able to bridge the failure or recovery of the first computing unit without the system becoming functionally critical. The at least one second computing unit can optionally also be able to differentiate between the two types of functional restriction, i.e. whether recoverable or irrecoverable, in order to be able to initiate a correspondingly suitable reaction after a functional restriction.If the control functionality of the first computing unit returns very quickly, the functional objective of the system can also be achieved by exclusively or largely using the prediction stored and plausibly verified in the at least one second computing unit (in the case of a motor vehicle, for example, simply continuing along a route that has already been estimated and appears plausible or the most plausible).

[0025] It is also advantageous if, in addition to the prediction for the system's behavior, at least one alternative prediction for the system's behavior is determined for a case of changed system states and transmitted to the at least one second computing unit. Particularly for a prediction covering a longer period, alternatives for executing the emergency control task can also be provided in advance. If, for example, one of several second computing units recognizes the need to use one of the available alternatives - due to changed states such as changed surrounding or environmental conditions or technical interference factors - the other second computing units can also control this alternative with sufficient plausibility.

[0026] Preferably, the at least one second processing unit uses actuators and / or sensors assigned to the first processing unit, if possible (i.e., if appropriate communication is still possible), to update and / or improve the prediction. This makes it possible to optimize the operation of the system and, if necessary, also to extend the bridging time. For example, in the case of a motor vehicle, an emergency stop bay can then also be detected and the motor vehicle steered there. Also conceivable, for example, is the detection of a changed surface and the associated modified control of the motor vehicle.

[0027] In general, it is also conceivable that the prediction could be refined in an external control unit, for example, in a traffic management system or a vehicle interaction system. This allows additional data from environmental and surroundings detection to be used to extend emergency operation.

[0028] A system according to the invention, e.g. a control unit network of a motor vehicle, is set up, in particular in terms of programming, to carry out a method according to the invention.

[0029] Implementing the method in the form of a computer program is also advantageous, as this results in particularly low costs, especially if an executing control unit is also used for other tasks and is therefore already present. Suitable storage media for the computer program include, in particular, magnetic, optical, and electrical storage devices, such as hard disks, flash memories, EEPROMs, DVDs, and others. Downloading a program via computer networks (Internet, intranet, etc.) is also possible.

[0030] Further advantages and embodiments of the invention will become apparent from the description and the accompanying drawings.

[0031] The invention is illustrated schematically in the drawing using exemplary embodiments and is described below with reference to the drawing. Short description of the drawings Fig. 1 to 3 schematically show systems according to the invention in various preferred embodiments. Fig. 4 schematically shows a second computing unit as part of a system according to the invention in a preferred embodiment. Fig. 5 schematically shows sequences of methods according to the invention in various preferred embodiments. Embodiment(s) of the invention

[0032] In Fig. Figure 1 schematically illustrates a preferred embodiment of a system 100 according to the invention, with which a method according to the invention can be carried out. The system 100 comprises, for example, a first processing unit 110 and three second processing units 140, 150, and 160, each of which is embodied as control units. These processing units are connected via a communications network 190.

[0033] The first processing unit 110 can be used as a master processing unit with a higher-level, central function 111. The second processing units 140, 150, and 160 can be used as slave processing units with subordinate, decentralized functions 141, 151, and 161, respectively. While the first processing unit can, for example, assume functions within the framework of autonomous or semi-autonomous driving, in particular global control, the second processing units can assume functions within the framework of, for example, transmission control, drive control, brake control, or directional control.

[0034] Such functions include, for example, downshift monitoring and transmission lock monitoring, torque and speed control and torque monitoring of the drives or the drivetrain, brake force position and wheel lock monitoring of the brake control, or rotation angle and angular speed control and steering gear monitoring. Sensors or detectors from monitoring mechanisms or combinations of these and / or functional and informational security functions are also conceivable.

[0035] The first processing unit 110 is connected to associated sensors 115 and actuators 116 and has a communication interface 117 for connection to the communication network 190. Likewise, the second processing unit 140 is connected to associated sensors 145 and actuators 146 and has a communication interface 147 for connection to the communication network 190. Furthermore, the second processing unit 150 is connected to associated sensors 155 and actuators 156 and has a communication interface 157 for connection to the communication network 190. Finally, the second processing unit 160 is connected to associated sensors 165 and actuators 166 and has a communication interface 167 for connection to the communication network 190.

[0036] Sensors can be radar, ultrasonic, or video sensors, for example, but also wheel speed sensors, microphones, motion sensors, or engine temperature monitors. Actuators can be those for control and actuators for transmissions, control and physical power actuators for combustion and electric motors, and data transmission systems for vehicle fleet systems. However, notification functions for functional and informational safety are also conceivable as actuators, which forward calculated data to other control units or systems, e.g., how often and how severely a security breach was, and how often and how severe a reaction occurred.

[0037] In the first computing unit 110, a prediction P for a future behavior of the system 100 can now be continuously determined during operation of the system 100, which prediction P is then transmitted to each of the second computing units 140, 150 and 160.

[0038] For example, the physical or technical variables to be observed are transmitted as raw data, either debounced or plausibility-checked data, or data that has been predicted (extrapolated) for a future process. The data can originate from the functional implementation of the system itself or its functional and / or informational security functions (safety or security). It is also possible to reduce or compress the data to mere sampling points, provided this does not represent a technical disadvantage.

[0039] The prediction can be determined based on the data or measured values ​​read in via the sensors 115 and / or based on the parameters or values ​​used to control the actuators 116. It is conceivable that the prediction P is the same for all second computing units and includes any specifics for all second computing units. It is also conceivable to provide different predictions for different second computing units or to specifically refine them in the second computing units 140, 150, 160, for example, by linking them to their functional and technical data as well as sensor and actuator data.

[0040] In Fig. 2 schematically shows a system 100' according to the invention in a further preferred embodiment, with which a method according to the invention can also be carried out. In contrast to the system 100 according to Fig. 1, the prediction P is determined here not in the first computing unit 110, but in a further first computing unit 120 and transmitted from there to the second computing units 140, 150, and 160. The further first computing unit 120 can receive data or measured values ​​from the first computing unit 110 for this purpose.

[0041] In this way, greater reliability can be achieved, since the prediction P is determined on a different processing unit than the one performing function 111. The additional first processing unit 120 can also be used for another function, which, however, is not related to the second processing units relevant here. Decomposition in the sense of functional or information technology security is also conceivable.

[0042] In Fig. 3 schematically shows a system 100" according to the invention in a further preferred embodiment, with which a method according to the invention can also be carried out. Here, too, the prediction P is not determined on the first computing unit 110, but in an additional computing unit 130, in particular one specifically provided for this purpose. In the example shown, the prediction P is not transmitted directly, but via the first computing unit 110 to the second computing units 140, 150 and 160. In this way, a higher level of reliability can also be achieved.

[0043] In Fig. 4 is now schematically the second computing unit 140 from the Fig. 1 to 3 are shown in more detail. A module 142 is shown, by means of which a functional limitation, for example of the first computing unit 110 or the communication connection, such as a failure of the communication network 190, can be detected.

[0044] If a functional limitation is detected, a module 143 initiates system operation, in which the function of the first computing unit, or a portion thereof, is performed by the second computing unit 140 based on the prediction P, i.e., based on available data. The other second computing units can then, for example, take over other portions of the function of the first computing unit. Additionally, data 143 can be collected from the sensors associated with the first computing unit 110, if possible, to optimize operation.

[0045] In Fig.Figure 5 schematically illustrates sequences of methods according to the invention in various preferred embodiments. Two time sequences are shown plotted against time t. Initially, in both variants, regular operation B0 occurs, in which the first processing unit performs its regular function. Likewise, the second processing units perform their associated regular functions. In this case, the prediction is determined and transmitted to the second processing units.

[0046] At time t0, a functional restriction is detected in both variants. In the variant shown above, this is a correctable functional restriction. The system then switches to restricted operation B1, in which the second computing units take over operation of the system based on the prediction P. This restricted operation B1 lasts until time t1. Firstly, time t1 represents the point in time up to which - starting from time t0 - operation can proceed accordingly based on the prediction. Secondly, the functional restriction has been rectified by time t1, for example by a restart of the first computing unit, and regular operation B0 can resume.

[0047] In the variant shown below, however, this is a non-recoverable functional limitation. Here, too, restricted operation – designated B2 here – is initially performed until time t1, i.e., as long as operation can be maintained based on the prediction. At time t1, however, the system then switches to a safe state or emergency operation B3.

Claims

[1] Method for operating a system (100, 100', 100") comprising a first computing unit (110) and at least one second computing unit (140, 150, 160) which is in communication connection with the first computing unit (110), wherein the first computing unit (110) and the at least one second computing unit (140, 150, 160) are used for different functions (111, 141, 151, 161) during operation of the system (100, 100', 100"), wherein, during operation (B0) of the system, a prediction (P) for a future desired and / or necessary behavior of the system in the event of a functional restriction of the first computing unit (110) and / or the communication connection between the first computing unit (110) and the at least one second computing unit (140, 150, 160) is determined and transmitted to the at least one second computing unit (140, 150, 160), and wherein, if a functional restriction of the first computing unit (110) and / or the communication connection between the first computing unit (110) and the at least one second computing unit (140, 150, 160) is detected, the operation (B1, B2) of the system with respect to the function of the first computing unit (110) is carried out by the at least one second computing unit (140, 150, 160) based on the prediction (P) transmitted to it, characterized bythat if the functional restriction can be remedied, the functional restriction is remedied, while the operation (B1) of the system with regard to the function of the first computing unit (110) is carried out by the at least one second computing unit (140, 150, 160) on the basis of the prediction (P) transmitted to it, and wherein the operation (B0) of the system with regard to the function of the first computing unit (110) is subsequently carried out again by the first computing unit (110), wherein a computing unit, in particular a microcontroller, in a vehicle is used as the first computing unit and a computing unit located outside the vehicle is used as the at least one second computing unit. [2] Method according to claim 1, wherein the prediction (P) for the behavior of the system is determined in the first computing unit (110) or in a further computing unit (120, 130) which is in communication connection with the first computing unit (110) and / or the at least one second computing unit (140, 150, 160). [3] Method according to claim 1 or 2, wherein the first computing unit (110) is used as a master computing unit, in particular for central and / or higher-level monitoring and / or control functions, and wherein the at least one second computing unit (140, 150, 160) is used as a slave computing unit, in particular for decentralized and / or specific monitoring and / or control functions. [4] Method according to one of the preceding claims, wherein, if the functional restriction cannot be remedied, the operation (B2) of the system with respect to the function of the first computing unit (110) is carried out by the at least one second computing unit (140, 150, 160) on the basis of the prediction (P) transmitted to it, and wherein the system is transferred to a safe state (B3) by the at least one second computing unit (140, 150, 160). [5] Method according to one of the preceding claims, wherein in addition to the prediction (P) for the future behavior of the system during regular operation of the first computing unit (110), at least one alternative prediction (P) for the future behavior of the system during regular operation of the first computing unit (110) is determined for a case of changed states of the system and is transmitted to the at least one second computing unit (140, 150, 150). [6] Method according to one of the preceding claims, wherein the prediction (P) transmitted to the at least one second computing unit (140, 150, 160) is checked for plausibility by the at least one second computing unit (140, 150, 160). [7] Method according to one of the preceding claims, wherein the at least one second computing unit (140, 150, 160) uses actuators (116) and / or sensors (115) associated with the first computing unit (110) to update and / or improve the prediction (P). [8] System (100, 100', 100") comprising a first computing unit (110) and at least one second computing unit (140, 150, 160), which is configured to carry out a method according to one of claims 1 to 7. [9] Computer program which causes a system (100, 100', 100") comprising a first computing unit (110) and at least one second computing unit (140, 150, 160) to carry out a method according to one of claims 1 to 7 when it is executed on the system (100, 100', 100"). [10] A machine-readable storage medium having stored thereon a computer program according to claim 9.

Images