Methods for the dynamic context-based distribution of software in a vehicle control system and a control system

Abstract

Method for the dynamic context-based distribution of program codes (20, 22, 24, 26, 28, 30) in a control system (10) of a self-driving vehicle (1), wherein the control system (10) has a plurality of control devices (12, 14, 16, 18), wherein the assignment of the program codes (20, 22, 24, 26, 28, 30) to the corresponding control devices (12, 14, 16, 18) of the control system (10) is carried out by a global placement graph (62), wherein the global placement graph (62) is calculated on a computing unit (64, 66, 68) which is located outside the control system (10) and the data of the global placement graph (62) are transmitted to the control system (10), characterized in that in the event of a failure of a control device (12, 14, 16, 18) or an error in the execution of program code (20, 22, 24, 26, 28, 30) is checked,whether the control system (10) already has an allocation plan for assigning the remaining active program codes (20, 22, 24, 26, 28, 30) to the available control units (12, 14, 16, 18) of the self-driving vehicle (1).

Description

[0001] The invention relates to a method for the dynamic, context-based distribution of software in a control system of a motor vehicle, a control system for carrying out such a method, a motor vehicle with such a control system and a computer program product according to the preamble of the independent claims.

[0002] Modern vehicles already feature a multitude of driver assistance systems that provide computer-based support to the driver in a wide variety of driving situations. These systems utilize sensors to capture a vast amount of data, far exceeding human sensory capabilities. Furthermore, the speed of these systems significantly surpasses human reaction time. Well-known examples of driver assistance systems include lane keeping assist, pedestrian detection braking assist, and adaptive cruise control, particularly useful in traffic jams.

[0003] Through the application of such assistance systems, the driver's autonomy regarding driving decisions is increasingly transferred to the vehicle or to correspondingly operating control units. The end result of these developments is a self-driving vehicle that can maneuver completely without human intervention. With such a self-driving vehicle, fully automated passenger transport becomes possible.

[0004] The control of a car's driving operation, particularly that of a self-driving car, is carried out by a driving system, which, within the scope of this application, is understood in the broadest sense to mean a control unit specifically designed and configured for this task. This control unit is configured to automatically lateral and longitudinally control the vehicle using a multitude of input signals, in particular sensor data acquired by the vehicle itself and received communication data. Such control of automatic lateral and longitudinal guidance places complex computational demands on the driver assistance system, which typically employs algorithms, models, and control functions that are at least partially based on machine learning (artificial intelligence).

[0005] Operating an autonomous vehicle safely requires numerous software applications that interact with each other. The problem, however, is that errors, such as those in a software application or a computing node, can cause some applications to stop running. Depending on the application's criticality, this can have dramatic consequences for the safety of passengers and other road users.

[0006] To avoid the dramatic consequences of errors, software applications can be run redundantly on different computing nodes. The idea is that the redundant instances run in a passive mode. This means they perform the same operations as the active instances, but do not interact with the executing systems.

[0007] Depending on the functional relevance of the function in question, this could lead to uncontrolled driving conditions, a loss of comfort, or even a danger to the passengers of the autonomous vehicle. It is known that safety-relevant systems are designed redundantly to reliably prevent dangerous driving situations.

[0008] Determining the allocation between application instances and compute nodes is not trivial. The decision depends on many different parameters. For example, compute nodes have only a limited amount of computing and storage resources. On the other hand, each application requires a certain amount of resources to function as intended. To ensure that all applications can run on the compute nodes installed in the vehicle, a multidimensional and complex application placement problem must be solved.

[0009] As previously mentioned, dangerous situations caused by software or hardware failures can be (partially) prevented through redundant software design. However, introducing redundant application instances increases the complexity of the application placement problem, as additional parameters must be considered. For example, the minimum number of redundant instances can be specified for each application. Furthermore, the minimum degree of hardware segregation can be defined for each application. This parameter specifies the minimum number of different compute nodes on which the application instances must run. The number of available control units and the requirement for minimum hardware segregation with respect to the programs then lead to a distribution problem.

[0010] Since the number of software applications required to operate an autonomous vehicle is quite high (approximately several hundred applications are involved), numerous valid mappings between compute nodes and application instances generally exist. However, not all valid mappings are equally "good." To select the best possible mapping, an optimization goal must be formulated. For example, the optimization goal could be formulated such that mappings that allow the shutdown of as many compute nodes as possible are preferred over those that utilize all compute nodes with which the vehicle is equipped. In addition to this optimization goal, various other objective functions are conceivable that consider other criteria.

[0011] In the event of a malfunction of the control system due to the failure of a sensor, a control unit or an error in a program code, a reconfiguration of the software on the different control units of the control system may be necessary in order to be able to perform the functions of the control system reliably again.

[0012] From US patent 2016 / 0142253A1, a cloud computing system and a method for operating such a system are disclosed. The cloud computing system can exchange data with external computing units, such as a desktop computer, a smartphone, a laptop, or a control unit in a motor vehicle.

[0013] Such solutions are known, for example, for navigation systems in motor vehicles, where real-time navigation is possible through a variety of external data acquisition modules and evaluation of this data by a cloud computer system, taking into account the current traffic density and current traffic disruptions.

[0014] The invention is based on the objective of improving the reconfiguration process when reconfiguration of the software on a control system for autonomous driving of a motor vehicle is necessary, and thus minimizing the required computing power and energy consumption in the motor vehicle.

[0015] According to the invention, this problem is solved by a method for the dynamic, context-based distribution of program codes in a vehicle control system, wherein the control system comprises a plurality of control units for executing the program codes. It is provided that the assignment of the program codes to the corresponding control units of the control system is carried out by means of a global placement graph, wherein the global placement graph is calculated on a computing unit located outside the control system, and the data of the global placement graph are transmitted to the control system.This allows for the dynamic distribution of active program code to the remaining control units in the event of a control unit failure or an error in the execution of a control system program code. This means that a complex and energy-intensive solution to an optimization problem does not have to be executed by the vehicle's control system, but is instead provided by an external data center. This limits the computing power required in the vehicle and thus increases its energy efficiency. Furthermore, for similar problems in comparable vehicles, a solution can be provided before the problem actually occurs in the specific vehicle, enabling rapid reconfiguration of the control system and thus increasing vehicle safety.

[0016] The features listed in the dependent claims enable advantageous improvements and non-trivial further developments of the method specified in the independent claim for the dynamic context-based distribution of software in a control system of a motor vehicle.

[0017] In a preferred embodiment of the invention, it is provided that in the event of a control unit failure or an error during the execution of program code, a check is performed to see whether the control system already possesses an allocation plan for assigning the remaining active program codes to the available control units. This eliminates the need for complex and energy-intensive recalculations to optimally distribute the active program codes among the control units. Consequently, the computing power of the control system can be fully utilized for autonomous driving, resulting in a higher level of goal attainment and thus a greater safety margin.

[0018] In a preferred embodiment of the method, in the event of a control unit failure or an error during the execution of program code, the system checks whether an allocation plan for assigning the remaining active program code to the available control units is already available. Thus, if a contingency plan exists from the central placement graph, the control system can be quickly reconfigured. If no contingency plan has yet been provided by the global placement graph, a corresponding solution can be calculated locally and subsequently shared with similar vehicles via an upload to the data center. This allows the central placement graph to be further optimized based on the failure events.

[0019] It is particularly advantageous if, given an allocation plan, the program codes are assigned to the control units accordingly. This ensures that even after a control unit fails or a program code execution error, the highest possible level of goal attainment for autonomous driving is achieved.

[0020] Alternatively, it is advantageously provided that, in the event of a missing allocation plan, a check is performed to determine whether a minimum number of redundantly executed program codes necessary for autonomous driving operation are present. This allows for the calculation of whether there is a risk of dangerous traffic situations arising from the failure of the control unit or an error in the execution of a program code, and enables measures to be initiated as quickly as possible to minimize the consequences of the error or failure.

[0021] A further improvement to the procedure proposes that the vehicle be brought to a standstill by a fail-safe system and / or steered to the nearest safe stopping point if the minimum number of redundantly executed program codes is not met. Generally, braking the vehicle to a standstill de-escalates the situation. However, in certain driving situations, such as in an unlit tunnel or on a highway, particularly in a highway construction zone, a standstill can lead to a dangerous traffic situation. In this case, it is preferable if the fail-safe system can autonomously continue driving the vehicle at least until a safe stopping point is reached and hazardous traffic situations are avoided.

[0022] Furthermore, it is advantageously provided that the control system is operated in emergency mode and an allocation plan is created when a sufficient number of redundant program codes necessary for autonomous driving operation are executed.

[0023] In particular, the driving speed may be limited and other vehicle functions, especially comfort functions of the motor vehicle, may be restricted in order to prioritize and ensure safety-relevant functions.

[0024] In an advantageous embodiment of the procedure, it is provided that the control system is checked and free or only slightly utilized control units are identified, and an allocation plan is created based on the identified free control units.

[0025] It is particularly advantageous if program codes for autonomous driving are divided into at least two weighting levels, whereby program codes with a lower weighting are stopped to provide additional computing power for executing higher-weighted program codes. The multiple redundancy of the functions of the higher and highest weighting levels ensures that a failure of a control device does not lead to dangerous operating conditions, but is either imperceptible to the vehicle's passengers or only noticeable as a reduction in driving comfort.

[0026] In a preferred embodiment of the invention, an optimization routine is executed which optimizes the program code to be executed on the remaining control units, and the result of the optimization is transmitted to the computing unit. This allows a self-learning network to be run in the computing center, enabling optimization of the global placement graph based on the data collected in the vehicles.

[0027] In an advantageous embodiment of the method, the global placement graph is determined based on data from different control systems of similar motor vehicles. Since similar vehicles with identical or similar hardware and software configurations are likely to exhibit similar error and failure mechanisms, it is advantageous to calculate a global placement graph for a specific vehicle model or model series. This allows for the provision of an optimized emergency solution to similar vehicles even before an error occurs during program code execution or before a control unit fails.

[0028] In a further improvement to the process, the global placement graph is transmitted to a vehicle when it is at a charging station. During charging, the vehicle's control system is largely unloaded. Furthermore, unlimited energy is available, so data transfer does not reduce the vehicle's range. Therefore, it is advantageous to transmit the solution of the global placement graph to the vehicle's control system during charging. Additionally, in the event of a control unit failure or a program code execution error, the vehicle can transmit a locally calculated solution graph to the data center to share the solution and make it available to other vehicles.

[0029] Another aspect of the invention relates to a control system comprising several control devices, wherein the control system is configured to execute such a method for operating an at least partially autonomous motor vehicle when several machine-readable program codes are executed by at least two control devices of the control system.

[0030] A vehicle performing the method according to the invention further comprises a driving system configured for automatic vehicle operation. The driving system is specifically designed for fully automatic longitudinal and / or lateral control of the vehicle. For this purpose, the driving system preferably accesses a multitude of sensor data acquired by the vehicle as well as communication data received by the vehicle. The driving system is specifically designed to execute driver assistance functions up to and including fully automatic driving. For this purpose, the driving system comprises control algorithms that are at least partially based on machine learning and include, for example, target functions and / or neural networks. Therefore, functional data is required for the operation of the driving system, which includes, for example, parameters of a neural network or optimized functional parameters. This functional data is stored in the vehicle's driving system as a functional data set.At the beginning of the method according to the invention, a (relatively) first functional data set is always stored in the vehicle's driving system.

[0031] A vehicle performing the method according to the invention further comprises a control unit. This control unit is preferably configured to communicate with the other components of the vehicle, in particular with the first communication module and with the driving system, and optionally with sensors, and to coordinate their functions. The control unit also preferably assigns to or controls a memory.

[0032] In a particularly preferred embodiment, the functionality of the driving system increases with the vehicle's license level. In other words, the degree of automation of driving operations increases with the vehicle's license level. Particularly preferably, the vehicle's license levels are correlated with different levels of autonomous driving. Particularly preferably, a vehicle has a license level of 0 in its delivery state. Furthermore, preferably, license level 0 corresponds to an automation level of Level 0 ("Driver Only"), according to which the driver permanently performs longitudinal and lateral control and the driving system does not actively intervene in driving operations.

[0033] In a preferred embodiment of the method according to the invention, license level 1 corresponds to a level 1 automation level ("Assisted"), according to which a driver permanently assumes longitudinal or lateral control and the driving system assumes the other function. More preferably, license level 2 corresponds to a level 2 automation level ("Partially Automated"), according to which a driver must permanently monitor the vehicle and the driving system assumes longitudinal and lateral control in the specific application.

[0034] Furthermore, license level 3 preferably corresponds to an automation level of Level 3 ("Highly Automated"), according to which a driver does not need to constantly monitor the vehicle but must potentially be able to take control. According to automation level 3, the driving system also handles longitudinal and lateral control in a specific use case, independently recognizes the limits of the driving system, and prompts the driver to take control with sufficient time. License level 4 preferably corresponds to an automation level of Level 4 ("Fully Automated"), according to which no driver is required in the specific use case and the driving system handles the situation completely autonomously.

[0035] License level 5 also preferably corresponds to a level 5 automation level ("driverless"), according to which no driver is required from the beginning to the end of a journey and the driving system fully takes over the driving task in all use cases. The above definitions correspond to the "Five Levels of Autonomous Driving" as defined by the German Association of the Automotive Industry (VDA). The respective use case includes road types, speed range, and environmental conditions.

[0036] Another aspect of the invention relates to a vehicle, in particular a passenger car equipped with an internal combustion, electric, or hybrid engine, for carrying out the steps of a vehicle in the method according to the invention. For this purpose, the vehicle has at least sensors for acquiring environmental data, via which the control devices of the control system are supplied with data for autonomous driving operation.

[0037] Another aspect of the invention relates to a computer program comprising program code for carrying out the steps of such a method for operating an at least partially autonomous motor vehicle, when the program code of the computer program is executed on a computer.

[0038] The process steps of the method according to the invention can be implemented by electrical or electronic components (hardware), by firmware (ASIC), or by executing a suitable program (software). The method according to the invention is also preferably implemented by a combination of hardware, firmware, and / or software. For example, individual components for carrying out individual process steps are designed as a separately integrated circuit or arranged on a common integrated circuit. Individual components configured to carry out individual process steps are also preferably arranged on a (flexible) printed circuit board (FPCB / PCB), a tape carrier package (TCP), or another substrate.

[0039] The individual process steps of the method according to the invention are preferably configured as one or more processes that run on one or more processors in one or more electronic computing devices and are generated during the execution of one or more computer programs. The computing devices are preferably configured to cooperate with other components, for example, a communication module, as well as one or more sensors or cameras, in order to implement the functionalities described herein. The instructions of the computer programs are preferably stored in a memory, such as a RAM element. However, the computer programs can also be stored in a non-volatile storage medium, such as a CD-ROM, flash memory, or the like.

[0040] It is also apparent to those skilled in the art that the functionalities of several computers (data processing devices) can be combined or combined in a single device, or that the functionality of a particular data processing device can be distributed across a multitude of devices in order to carry out the steps of the method according to the invention without deviating from the method according to the invention.

[0041] Unless otherwise stated in individual cases, the various embodiments of the invention mentioned in this application can be advantageously combined with one another.

[0042] The invention is explained below using exemplary embodiments with reference to the accompanying drawings. These show: Fig. 1 a schematic representation of a system according to the invention consisting of a motor vehicle according to the invention with sensors and a control device for carrying out at least semi-autonomous driving operation of the motor vehicle. Fig. 2 a control system according to the invention with several control units which execute several program codes for controlling at least a partially autonomous driving operation. Fig. 3 a control system according to the invention with several control units in the event of a failure of a control unit or a crash of program code, wherein the failed function is taken over by a redundant program code on another control device. Fig. 4 a global placement graph to determine the best possible allocation of the executed program codes to the available control units. Fig. 5 a flowchart for monitoring the control system and for reconfiguring the control system in the event of a failure of a control unit and / or an error in the execution of a program code. Fig. 6 a diagram of communication between different motor vehicles and a central computing unit, wherein the reconfigurations performed in the motor vehicles are transmitted to the central computing unit and / or the central computing unit transmits a best possible reconfiguration to the motor vehicle. Fig. 7 A diagram illustrating the communication between a central computing unit and a motor vehicle, whereby the central computing unit exchanges additional information with other data sources.

[0043] Fig. Figure 1 shows a schematic representation, in particular a block diagram of an exemplary motor vehicle. 1, in particular a two-track vehicle with an internal combustion, electric or hybrid engine. The motor vehicle 1 includes a variety of first sensors, in particular a first sensor 32 , a second sensor 34 , and a third sensor 36 The first sensors 32 , 34 , 36 are equipped to capture environmental data of the vehicle 1 and include, for example, a camera for capturing an image of the motor vehicle 1 immediately surrounding environment, distance sensors, such as ultrasonic sensors or LIDAR, to detect distances to the vehicle 1 surrounding objects. The first sensors 32 , 34 , 36 They transmit the environmental signals they detect to control units. 12 , 14 , 16 , 18 a control system 10 of the motor vehicle 10 .

[0044] The motor vehicle 1 Furthermore, it features a plurality of second sensors, in particular a fourth sensor. 38 , a fifth sensor 40 , and a sixth sensor 42 up. Regarding the second sensors 38 , 40 ,42 these are sensors for determining the motor vehicle 1 self-related status data, such as current position and movement information of the vehicle 1 The second set of sensors are therefore, for example, speed sensors, acceleration sensors, tilt sensors, sensors for measuring the compression depth of a shock absorber, wheel speed sensors, or the like. 38 , 40 , 42 They transmit the status signals they have detected to the control units of the motor vehicle. 1 In particular, the second sensors transmit 38 , 40 , 42their measurement results directly to a control unit 12 , 14 , 16 , 18 of the control system 10 of the motor vehicle 1 .

[0045] The motor vehicle 1 Furthermore, the control system 10 on, which enables fully automatic driving operation, in particular autonomous longitudinal and lateral control of the motor vehicle 1 is set up. The control system 10 indicates a navigation module 64 on, which is used to calculate routes between a starting point and a destination point and to determine the distance traveled by the motor vehicle along this route 1 The maneuver to be performed is set up. The navigation module 44 is also preferred for performing specific maneuvers of the motor vehicle. 1 trained in maneuvers such as parking and unparking. Furthermore, the control system includes 10 an internal memory 66, which is connected to the navigation module 44 communicates, for example via a suitable data bus. On the internal memory 46 In particular, a model, a neural network, and / or a target function are stored, which are at least partially based on machine learning. Furthermore, the internal memory contains... 46 Functional data for the model, the neural network, and / or the objective function are stored as a function data set. The functionality of the control system. 10 is preferably controlled by a control unit and especially depending on the vehicle's license level. 1 unlocked.

[0046] The control system 10 is for carrying out the steps of the motor vehicle 1 set up in the method according to the invention. The control system performs the following steps. 10 the steps of the procedure using the control units 12 , 14 , 16 , 18through or controls the other components of the motor vehicle 1 accordingly. The control units are equipped for this purpose. 12 , 14 , 16 , 18 each via internal storage 46 and a CPU 48 which communicate with each other, for example via a suitable data bus. In addition, the control units are available. 12 , 14 , 16 , 18 of the control system 10 in communication link with at least the first sensors 32 , 34 , 36 and the second sensors 38 , 40 , 42 , as well as any other control devices of the motor vehicle 1, for example, to control the vehicle's heating or air conditioning, a radio, navigation system, or other information or entertainment systems. Communication takes place, for example, via one or more CAN connections, one or more SPI connections, or other suitable data connections. On the vehicle 1 is a communication interface for sending and receiving data with an external data center 64 trained.

[0047] Fig. Figure 2 shows a schematic configuration of a control system. 10 for controlling at least a semi-autonomous, preferably a fully autonomous motor vehicle 1 The control system 10 includes four control units 12 , 14 , 16 , 18 , each of which contains at least one program code 20 , 22 , 24 , 26 , 28 , 30for the implementation of semi-autonomous or fully autonomous driving of the motor vehicle 1 is executed. This includes every program code. 20 , 22 , 24 , 26 , 28 , 30 redundant on two different control units 12 , 14 , 16 , 18 The program code 20a, 22a, 24a, 26a, 28a, 30a is applied in each case by a control unit. 12 , 14 , 16 , 18 executed and for controlling the motor vehicle 1 evaluated, while the respective redundant program 20p, 22p, 24p, 26p, 28p, 30p remains passive and only then is integrated into the vehicle's control system. 1 is integrated when the formerly active program 20a, 22a, 24a, 26a, 28a, 30a is deactivated due to an error or failure of the respective control unit. 12 , 14 , 16 , 18no longer for controlling the motor vehicle 1 can be evaluated.

[0048] During the operation of a motor vehicle 1 The placement of the program code can change. 20 , 22 , 24 , 26 , 28 , 30 It can change several times. For example, it can change after events such as a control unit failure. 12 , 14 , 16 , 18 or an application instance error may necessitate switching to a new application location. In addition to these events, the detection of a potential optimization opportunity can also trigger a switch to a new control unit. 12 , 14 , 16 , 18 trigger. In Fig. 3 is such a case, using the example of a failure of the second control unit. 14 The third program code 24a was displayed in its initial state by the second control unit. 14executed. After a failure of this second control unit 14 or a program crash of the previously active second control unit 14 The third program code 24a, executed by the third program code 24p, is executed on the third control unit. 16 activated and for further control of the motor vehicle 1 This analysis can reveal that dramatic driving situations can arise due to a lack of vehicle control. 1 be avoided.

[0049] In order to enable optimization of the active program codes 20a, 22a, 24a, 26a, 28a, 30a, it is necessary to determine the current driving situation and the current performance of the control system. 10 to know. This system inherently affects the performance of all software applications. 20 , 22 , 24 , 26 , 28 , 30 , all control devices 12 , 14 , 16 , 18and other hardware, especially the sensors 52 , 54 , 56 , 58 , 60 , 62 Reference made to.

[0050] The following examples illustrate this dependency: Assume that the motor vehicle 1 an electrically powered automobile that transports a passenger to an important meeting, and the vehicle's battery 1 It is almost empty. In such a situation, the goal of arriving at the desired destination on time is more important than entertaining the passenger. To extend the vehicle's range 1 To increase the capacity, all applications that serve the purpose of entertainment can therefore be stopped. As a result, some control devices may be affected. 12 , 14 , 16 , 18 It will be shut down, which saves energy.

[0051] Imagine a motor vehicle 1in front, which is stuck in traffic. Since the vehicle 1 With minimal movement, redundant instances of driving functions can be stopped. This frees up resources that can be used, for example, to run an application that improves traffic flow.

[0052] Due to a system crash, half of the control units installed in the vehicle were not functioning. 12 , 14 , 16 , 18 no longer. Since the remaining control devices 12 , 14 , 16 , 18 not providing enough resources to run all program code 20 , 22 , 24 , 26 , 28 , 30 To execute the applications that were running before the crash, a new application placement plan must be calculated. The goal of placement optimization is to map all applications necessary to run the vehicle.1 to bring the vehicle to a safe stop in order to ensure the safety of passengers and other road users.

[0053] In Fig. 4 is a global placement graph 62 shown, which can also be called a mapping graph 62 This could be described as follows: In the present invention, a dynamic context-dependent optimization is achieved by abstracting the local computational problem of assigning program codes. 20 , 22 , 24 , 26 , 28 , 30 to the respective control units 12 , 14 , 16 , 18 in the tax systems 10 of motor vehicles 1 , 80 , 82 , 84 This results in a global computation problem. This computation problem is solved by a data center. 64 , especially through a cloud computing system 66, solved. As a result, various participants can help improve the global ranking graph. 62 to include in the calculations and to partially offload the computationally and costly task from the control systems 10 of the vehicle to a data center 64 to relocate. This has the advantage that motor vehicles 1 , 80 , 82 , 84 to be able to react more quickly to errors and, after the problem has been solved, to quickly return to working in accordance with a desired ASIL level.

[0054] The dynamic, context-dependent placement of software in a motor vehicle also offers the advantage of enabling optimization of energy consumption, thereby increasing the range of an electrically powered vehicle. 1 can be increased.

[0055] In Fig. Figure 5 shows a flowchart for monitoring the control system and reconfiguring the control system in the event of a control unit failure and / or an error during program code execution. In the first process step I, a monitoring element performs... 52 monitoring the execution of the program code 20 , 22 , 24 , 26 , 28 , 30 on the control units 12 , 14 , 16 , 18 of the control system 10 If an error is detected, a second step (II) checks whether a pre-calculated emergency plan exists or whether such a plan needs to be created. If no emergency plan currently exists, which would include a pre-calculated dynamic allocation of the executed program code, the following steps are performed: 20 , 22 , 24 , 26 , 28 , 30 on the control units12 , 14 , 16 , 18 Once the necessary information is provided, a third process step (III) checks whether a sufficient number of redundant program executions are possible to ensure reliable, autonomous driving operation. If this requirement is met, the corresponding redundantly executed program codes are selected in a fourth process step (IV) and switched by a switching element. 54 on another control unit 12 , 14 , 16 , 18 executed. In process step V, this new configuration is executed as new active program code. 20 , 22 , 24 , 26 , 28 , 30 selected.

[0056] After a control unit failure 12 , 14 , 16 , 18insufficient computing power is available to ensure safe, autonomous operation of the vehicle. 1 To ensure this, an emergency operating module is implemented in process step VI. 56 activated, which activates the control system's control panel 10 takes over. The motor vehicle is then 1 brought to a safe stop in process step VII.

[0057] If sufficient redundancies are available, a recovery module will be used. 58 activated, which aims to restore a software configuration to the highest possible level of goal achievement. For this purpose, in process step VIII, control units are selected. 12 , 14 , 16 , 18 sought which have sufficient resources to also include redundant program code 20 , 22 , 24 , 26 , 28 , 30To execute. If such a control unit is found, a new redundant program code is executed in process step IX. 20 , 22 , 24 , 26 , 28 , 30 on a control unit 12 , 14 , 16 , 18 executed. There are currently no sufficient free resources available on the control units. 12 , 14 , 16 , 18 If this occurs, low-priority program codes are stopped in a process step X to provide additional computing power for the safety-relevant program codes.

[0058] If a pre-calculated emergency plan is available after the review in process step II, this emergency plan is then optimized by a placement optimizer. 60 implemented in process step XI and the implementation via the communication interface 50 to the data center 64A response has been received. If no contingency plan is in place, a placement optimizer will be used. 60 In process step XII, objectives for the implementation of an emergency plan are defined, in process step XIII an optimization plan is calculated from this and this is implemented in process step XIV.

[0059] In Fig. 6 is the data exchange between the data center 64 calculated global placement graph 62 and various motor vehicles 1 , 80 , 82 , 84 depicted. This is shown in the first motor vehicle. 1 A solution graph is calculated. The second motor vehicle 80 loading the global placement graph 62 downloads and transmits this global placement graph to the control system 10 in the second motor vehicle 80 In the third vehicle, another solution graph is calculated and sent to the data center. 64transmitted. Such a solution graph for a subproblem is provided by the fourth motor vehicle. 84 to the data center 64 uploaded.

[0060] In Fig. 7 is the communication between the data center 64 with the central placement graph 62 , a motor vehicle 1 as well as other data sources 66 , 70 , 76 This is illustrated. Additional data sources can be provided, in particular, by a mobile phone. 70 , especially via a smartphone, a cloud computing system 66 or a server 68 The information provided will be taken into account. Furthermore, the global placement graph can be used. 62 through road-site units 76 to be further improved. The transmission of a solution from the central placement graph to the control system. 10of the motor vehicle preferably takes place during a charging process of an electrically powered motor vehicle. 1 at a charging station 74 This process can be controlled by a control unit. 72 the charging station 74 or through the control system 10 of the motor vehicle 1 This is triggered when sufficient energy and computing power are available during a charging process, allowing an optimization graph to be sent to the control system. 10 of the motor vehicle 1 can be transmitted and implemented there. Reference symbol list 1 motor vehicle 10 Control system 12 first control unit 14 second control unit 16 third control unit 18 fourth control unit 20 first program code 22 second program code 24 third program code 26 fourth program code 28 fifth program code 30 sixth program code 32 first sensor 34 second sensor 36 third sensor 38 fourth sensor 40 fifth sensor 42 sixth sensor 44 Navigation module 46 GB internal storage 48 CPU 50 Communication interface 52 Monitoring element 54 Switching element 56 Emergency operating module 58 Recovery Module 60 Placement Optimizers 62 global placement graph 64 Data Center 66 Cloud Computer System 68 servers 70 mobile phone 72 fifth control unit 74 charging stations 76 Road Site Unit 78 Transceiver unit 80 second motor vehicle 82 third motor vehicle 84 fourth motor vehicle 100 computer programs

Claims

[1] Method for the dynamic context-based distribution of program codes (20, 22, 24, 26, 28, 30) in a control system (10) of a vehicle (1), wherein the control system (10) comprises a plurality of control devices (12, 14, 16, 18), characterized by , that the assignment of the program codes (20, 22, 24, 26, 28, 30) to the corresponding control devices (12, 14, 16, 18) of the control system (10) is carried out by a global placement graph (62), wherein the global placement graph (62) is calculated on a computing unit (64, 66, 68) which is located outside the control system (10) and the data of the global placement graph (62) are transmitted to the control system (10). [2] Method according to claim 1, characterized by, that a monitoring element (52) is provided which monitors the execution of the program code (20, 22, 24, 26, 28, 30) and / or the function of the control devices (12, 14, 16, 18), wherein in the event of a failure of a control device (12, 14, 16, 18) or an error of a program code (20, 22, 24, 26, 28, 30) a redistribution of the program codes (20, 22, 24, 26, 28, 30) to the control units (12, 14, 16, 18) takes place on the basis of the global placement graph (62). [3] Method according to claim 1 or 2, characterized by , that in the event of a failure of a control device (12, 14, 16, 18) or an error in the execution of a program code (20, 22, 24, 26, 28, 30), it is checked whether the control system (10) already has an allocation plan for assigning the remaining active program codes (20, 22, 24, 26, 28, 30) to the available control units (12, 14, 16, 18). [4] Method according to claim 3, characterized by, that if an allocation plan is available, the program codes (20, 22, 24, 26, 28, 30) are assigned to the control units (12, 14, 16, 18). [5] Method according to claim 3, characterized by , that in the event of a missing allocation plan, a check is carried out to determine whether a minimum number of redundantly executed program codes (20, 22, 24, 26, 28, 30) necessary for autonomous driving operation is present. [6] Method according to claim 5, characterized by , that the motor vehicle (1) is brought to a standstill by a fail-safe system and / or is steered to the nearest safe stopping point if the minimum number of redundantly executed program codes (20, 22, 24, 26, 28, 30) is not met. [7] Method according to claim 5, characterized by, that the control system (10) is operated in emergency mode and an allocation plan is created when a sufficient number of redundant program codes (20, 22, 24, 26, 28, 30) necessary for autonomous driving operation are executed. [8] Method according to any of the preceding claims, characterized by , that a review of the control system (10) is carried out and free or only slightly utilized control units (12, 14, 16, 18) are identified, and an allocation plan is created on the basis of the identified free control units (12, 14, 16, 18). [9] Method according to claim 8, characterized by , that program codes (20, 22, 24, 26, 28, 30) for the function of autonomous driving operation are divided into at least two weighting levels, whereby program codes with a lower weighting are stopped to provide additional computing power for the execution of higher weighted program codes. [10] Method according to any of the preceding claims, characterized by , that an optimization routine is executed which optimizes the program codes to be executed (20, 22, 24, 26, 28, 30) on the remaining control units (12, 14, 16, 18), with the result of the optimization being transmitted to the computing unit (64, 66, 68). [11] Method according to any one of claims 1 to 10, characterized by , that the global placement graph (62) is determined on the basis of information from a server (68), a mobile phone (70), road-site units (76) and / or other traffic information systems in different control systems of similar motor vehicles (1, 80, 82, 84), information from a server (68), information from a mobile phone (70), information from road-site units (76) and / or other traffic information systems. [12] Method according to any one of claims 1 to 11, characterized by , that the global placement graph (62) is transmitted to a motor vehicle (1, 80, 82, 84) when the motor vehicle (1, 80, 82, 84) is at a charging station (74). [13] Control system (10) comprising several control devices (12, 14, 16, 18) wherein the control system (10) is configured to perform a method according to any one of claims 1 to 12 when several machine-readable program codes (20, 22, 24, 26, 28, 30) are executed by at least two control devices (12, 14, 16, 18) of the control system (10). [14] Motor vehicle (1) comprising a control system (10) configured to carry out a method according to any one of claims 1 to 12. [15] Computer program (100) comprising program code for carrying out the steps of a method according to any one of claims 1 to 12, when the program code is executed on a computer.

Images