Method for operating an information technology system, computer program product and vehicle

Abstract

The invention relates to a method for operating an information technology system in a vehicle (1), the information technology system comprising at least one client device (2), one server device (3) and one mechatronic device (4).The invention is characterized in that the server device (3) provides at least one layer stack (7) comprising at least one persistent layer (8) and one transient layer (9), wherein the persistent layer (8) comprises a state for at least one mechatronic device (4) and states for the at least one mechatronic device (4) can be written to transient layers (9); wherein a client device (2) transmits a method call message (6) to the server device (3), comprising at least one state for the at least one mechatronic device (4); wherein the server device (3) writes the states contained in the method call message (6) to a transient layer (9); and the server device (3) designates a layer (8, 9, 10) in the layer stack (7) as the active layer and configures the at least one mechatronic device (4) according to the states contained in the active layer.

Description

[0001] The invention relates to a method for operating an information technology system of the type defined in more detail in the preamble of claim 1, a computer program product and a vehicle with at least one client device, one server device and one mechatronic device.

[0002] Operating a vehicle requires processing information by computing units. These computing units are embedded systems, usually implemented as a system-on-a-chip (SoC). For example, car control units include components such as an engine control unit, a throttle control unit, a climate control unit, and the like. The task is to transmit and process information generated by sensors within the vehicle's electrical system and, in response, to control actuators. Increasingly, multiple functions are being integrated into a single computing unit with increased processing capacity, which can also be referred to as a central on-board computer. This is particularly true for processing sensor data generated by environmental sensors, which is fused to derive control commands for automated or even autonomous driving.Furthermore, subtasks can be outsourced to an external backend, i.e., a cloud server, and additional information can be retrieved from the cloud server. For communication, the vehicle's onboard network can be connected to the internet via a telecommunications unit, for example, using a mobile network.

[0003] Electronic control units (ECUs) typically exchange information via a fieldbus such as a CAN bus or an Ethernet data line. A vehicle may have several bus systems interconnected via gateways. The software architecture for electronic control units developed by AUTOSAR has become a de facto standard. AUTOSAR provides a range of specifications that describe fundamental software modules, application programming interfaces, and a common development methodology.

[0004] Service-oriented architecture (SOA), originating from the IT sector, is being adapted as a promising concept for future vehicle architectures. The general idea behind SOA is to decouple in-vehicle communication on the (Ethernet) backbone from communication on the subnets of individual domains. By hierarchizing, abstracting, and decoupling vehicle functions, complexity can be reduced, individual development cycles at different architectural levels are enabled, and it is easier to combine different generations of domains. Until now, most mechatronic functions have been controlled by targeted requests via signal-oriented communication. The signals come from known client devices that want to control the system.In signal-oriented communication, data generated by a vehicle while driving is exchanged as raw signals between different functions, with the receivers themselves having to collect and interpret these raw signals. In the following context, systems that provide functions within the vehicle are referred to as mechatronic devices.

[0005] In vehicle-based SOA, a dedicated server, also known as a server device, adds value to information by providing high-quality information to its client devices, which then no longer need to interpret the raw data themselves. This high-quality information is distributed to systems within the vehicle network and can be requested and used by multiple client devices to modify a vehicle resource to execute a vehicle function. The signal-oriented network architecture is not replaced, but rather further developed and complemented by the service-oriented communication paradigm.

[0006] The implementation and use of SOA in AUTOSAR is realized via "Scalable Service-Oriented Middleware over IP" (SOME / IP).

[0007] One of the most important (technical) goals of service-oriented architecture is the decoupling of access to vehicle resources through the use of client / server interfaces. Access to vehicle resources is not customized for each use case, but rather generically through the offering and use of so-called "services." There is only one available standard (AUTOSAR) for the development and deployment of a service as a vehicle interface (SOME / IP), but no standard for modeling a vehicle APL service interface with respect to the design patterns and data structure that comprise such an interface. Developing vehicle service interfaces requires an architectural design concept and specific design patterns for SOME / IP services to provide solutions for secure and reliable communication within the vehicle network.

[0008] The request-response communication between a client device, which wants to request access to and modification of vehicle resources via the vehicle API, and a service provider (server device) takes place according to the following asynchronous data exchange principle: 1. The client device initiates communication by sending a so-called method call (method call PDU), hereinafter referred to as a method call, to the server device (service provider). For this purpose, the client device outputs a method call message via the data bus. 2. The server device sends back a response message (Return-PDU) and signals the result of the operation to the requesting client device. 3. If the status of the requested resource changes, the server device sends an additional status event to all subscribed client devices.

[0009] According to this general client / server communication principle, a client device that wants to access a vehicle resource sends a method call to the respective service provider (server device). Since the vehicle API service interfaces are generic, multiple client devices can send a method call to request access to and modifications to the same vehicle resource. If two or more competing method calls are sent by one or more client devices, all attempting to access the same vehicle resource, this leads to unintended and confusing system behavior.Therefore, client devices that want to use the vehicle's API service interfaces for their purpose—to access and modify vehicle resources—are highly problematic for vehicle safety and system reliability if no mechanism is used to handle these competing method calls for accessing vehicle resources.

[0010] The present invention is based on the objective of providing an improved method for operating an information technology system in a vehicle, which also works reliably when said competing method calls occur.

[0011] According to the invention, this problem is solved by a method for operating an information technology system in a vehicle with the features of claim 1. Advantageous embodiments and further developments, as well as a computer program product and a vehicle for carrying out the method, are described in the dependent claims.

[0012] A generic method for operating an information technology system in a vehicle, the information technology system comprising at least one client device, one server device, and one mechatronics device, wherein the respective mechatronics devices are indirectly connected to the respective client devices via a data bus using an application programming interface, wherein the at least one mechatronics device has a state which can be changed to provide a function, wherein the server device provides at least one service, wherein, in the course of using a service, client devices transmit a method call message to the server device in order to set a desired state for a respective mechatronics device, is further developed according to the invention in that the server device provides at least one layer stack, comprising at least one persistent layer and one transient layer.wherein the persistent layer comprises a state for at least one mechatronic device and states for the at least one mechatronic device can be written to transient layers; wherein a client device transmits a method call message to the server device, comprising at least one state for the at least one mechatronic device; wherein the server device writes the states contained in the method call message to a transient layer; and , The server device designates a layer in the layer stack as the active layer, and at least one mechatronic device is configured according to the states contained in the active layer.

[0013] The various layers of the layer stack allow different states to be defined and maintained simultaneously for the respective mechatronic device. Since the mechatronic device can only assume a single configuration at a time, only one layer of the layer stack can be active at any given time. The server then decides which layer from the layer stack is activated as needed. The layer stack can thus be considered a kind of "buffer" to catch incoming method calls for the use of functions almost simultaneously. This allows the server to coordinate competing method calls. According to the state of the art, however, the server would implement the "last is best" principle.The mechatronic device would thus always be configured according to the method call received later, which would mean that a first client device, which transmitted a method call first, would not be able to complete its function if the same method call from a second client device was received during the execution period. According to the invention, however, the server device switches the active layer of the layer stack as needed, so that after the function requested by the second client device has been executed, the state requested by the first client device is set for the mechatronic device. This prevents erratic system behavior.

[0014] Transient layers allow for the predefined and temporary storage of situationally required states. If no deviation from this configuration is needed, a default behavior for the mechatronic device can be set using the states stored in the persistent layer. For example, the mechatronic device could be a vehicle seat or its seat heating system. The default behavior could then be that the seat heating should be switched off. If a vehicle occupant activates the seat heating via a control in the vehicle, the client device managing the activation command sends a method call message to the server device to activate the seat heating at the requested intensity. The server device then writes the state defined by this method call message to a transient layer and activates this layer.The seat heating is thus activated by the mechatronics unit. Each layer in the layer stack receives its own priority. The layer with the highest priority is always set as active by the server. The priority can be determined by the server itself or based on information contained in method call messages. The server can also override the decision made based on a method call message to determine the active layer.

[0015] The persistent layer is therefore also suitable for storing preferred user settings for vehicle systems. Since the states of transient layers are only set temporarily, such user preferences should not be written to states in transient layers.

[0016] Each layer stack comprises exactly one persistent layer. Without such a layer, which permanently stores a state, there would otherwise be a risk that the state of the mechatronic device would be undefined. Further examples of persistent layer applications include the color scheme of ambient lighting or a preset for a vehicle's climate control system.

[0017] There are several ways to deactivate an active layer. A dedicated method call message can be transmitted from a client device, terminating the currently active layer. Preferably, this method call message is sent by the same client device that activated the layer in question. However, this method call message can also be sent by a different client device or the server device itself. In this case, the persistent layer is activated. It is also possible for a method call message to be transmitted from the same or a different client device to the server device to set a different state for the mechatronic device. Accordingly, a new state is written to a different transient layer. If this transient layer is then assigned a higher priority, it is also set as active.This changes the function of the mechatronic device. However, if the priority of this additional transient layer is lower than that of the active layer, the currently active layer will remain active until the priorities change.

[0018] An advantageous embodiment of the method according to the invention provides that the server device provides a separate layer stack for different services and / or different mechatronic devices. In this way, layer stacks can be maintained specifically for mechatronic devices as well as for services. Each mechatronic device can be configured by a single layer stack to avoid conflicts. If a particular service affects several mechatronic devices, states can also be provided for multiple mechatronic devices within a single layer of a layer stack.

[0019] According to a further advantageous embodiment of the method according to the invention, it is further provided that the layers in the layer stack are arranged in sequence, wherein the persistent layer forms the lowest layer and all other layers are arranged above it, and wherein the server device designates as the active layer the layer in the layer stack which corresponds to the topmost layer in the layer stack that comprises at least one state.

[0020] The individual layers in the layer stack can therefore preferably be arranged sequentially. A vertical stacking arrangement is considered below as an analogy. The persistent layer comprises predefined states for the mechatronic device and represents the lowest, essentially the base layer. If state changes are requested from the mechatronic devices as needed, states are written to transient layers, with the topmost layer in the layer stack being set as the active layer. The position of a respective transient layer in the layer stack then represents the aforementioned "priority." The persistent layer thus has the lowest priority.

[0021] A further advantageous embodiment of the method according to the invention provides that a decay period is assigned to the states when writing to a transient layer, after which the respective state is removed from its transient layer. The decay period thus allows the priority of the individual layers in the layer stack to be controlled. Only those transient layers that contain at least one state for the mechatronic device can be set as active. After the decay period has expired, the state is deleted from the respective transient layer, so that this layer can no longer be set as active. The active layer then moves down one level in the layer stack. In this way, the layer stack can be traversed step by step.During the process, new requests for the use of the mechatronic device's function can be made as needed, i.e., new method call messages can be issued by client devices, which cause the setting of states on one transient layer and thus the activation of another transient layer.

[0022] The expiration time is included in a method call message as additional information from the respective client device. An expiration time of zero can also be set, which can be interpreted as a command to deactivate the respective layer. If, however, the expiration time expires automatically, the change of the active layer is initiated automatically.

[0023] It is also conceivable that an active layer is deactivated because a new transient layer with a higher priority is activated, even though its own expiration time has not yet expired. It is possible that the expiration time continues to run even when a transient layer is deactivated. This allows for the fulfillment of requirements such as a control unit needing a function to be executed within a predetermined time. If this time expires without the function being fully executed, the control unit can perform an error response, such as issuing an error message or restarting the function.

[0024] Preferably, a client device resets the expiration time before it expires by sending a new method call message to the server device. This allows the underlying service to continue to be used, especially continuously, despite the expiration time.

[0025] A further advantageous embodiment of the method according to the invention provides that each transient layer in the layer stack is assigned a maximum expiration time that depends on its height in the layer stack, with the maximum expiration time decreasing from bottom to top. This allows for even more targeted priority control using the expiration time. For example, functions of the mechatronic device that are particularly short are preferably executed. Once all short functions have been processed, the next longest functions are executed. This continues until the persistent layer is set to active.However, since new method call messages from client devices are constantly being received by the server device during vehicle use, transient layers located higher up in the layer stack can be temporarily activated, thus delaying the activation of the persistent layer indefinitely.

[0026] According to a further advantageous embodiment of the method according to the invention, the server device inserts at least one mode layer into the layer stack, comprising at least one predefined state and / or at least one state writable by a method call message, wherein a mode layer is arranged in the layer stack between two transient layers, above a transient layer, or below a transient layer, and wherein a timeout of zero or greater than zero is assigned to the mode layer by a method call message, wherein a timeout greater than zero does not expire, and the server device removes the mode layer from the layer stack when a timeout of zero is assigned to the mode layer. Thus, in addition to the persistent layer and the transient layers, a third layer type is introduced.The mode layer can be inserted at any position in the layer stack, as long as it is above the persistent layer. Multiple mode layers can also be used. The position of the mode layers within the layer stack can also be controlled by their expiration time. A mode layer is a transient layer that does not have an automatic expiration time. The expiration time assigned to the mode layer serves only to define its position within the layer stack or to remove a mode layer from the stack.

[0027] A mode layer allows you to set modes for mechatronic devices that should remain permanently active. In particular, the configuration of a mechatronic device can be maintained across the individual usage intervals of a vehicle using an active mode layer. Such a usage interval is, for example, the duration during which the ignition or the vehicle's on-board electronics are continuously switched on.

[0028] Since a mode layer can also be located below a transient layer in the layer stack, this means that, should the situation require it, a function of the mechatronic device requested by another client device can be temporarily prioritized. For example, a mode layer can be used to set a specific lighting mood for ambient lighting. During an automatic emergency braking maneuver performed by the vehicle, a warning light, such as a red flashing light, can be output via the ambient lighting. To output the red flashing light, a corresponding transient layer above the mode layer is then activated.

[0029] A further advantageous embodiment of the method according to the invention provides that the server device assigns a zero expiration time to a mode layer if, after activation of the vehicle's on-board electronics, the server device does not receive a method call message relating to the respective mode layer within a defined period of time. This can be understood as an emergency measure or so-called "fallback." Typically, the activation of a mode layer is also initiated by a client device by issuing a corresponding method call message. After the vehicle is switched off and the ignition restarted, the respective client device may malfunction. For example, it may have frozen, no longer function correctly after a software update, require the processing of sensor data from a failed sensor, or the like.In this case, the respective client device might refrain from retransmitting a method call message relating to the respective mode layer. The server device could interpret this as information indicating a malfunction in the respective client device. Consequently, the server device itself can deactivate the mode layer. Accordingly, the next lower transient layer or the persistent layer is activated, and the mechatronic device is configured accordingly.

[0030] Preferably, only the client device that inserted the mode layer into the layer stack or the server device is able to assign a zero expiration time to the mode layer. This prevents other client devices from overwriting the mode layer. Since the server device plays a special role as the managing entity, it is also preferably authorized to deactivate such a mode layer or remove it entirely from the layer stack.

[0031] A further advantageous embodiment of the method according to the invention provides that the respective client devices query the active layer and / or a layer intended for writing a state from the server device. The respective client devices in the vehicle are thus able to query the active or planned status of the mechatronic device. The client devices can use this information to adapt their own behavior. For example, a first client device can use a method call message to set a specific state for the mechatronic device, which is required for using a service or function. Accordingly, a first transient layer is activated. While the respective function is being executed, a second client device with a higher priority can activate a second transient layer, in particular one located further up in the layer stack.The first client device can query the status of the currently active layer from the server device and thus determine that the requested transient layer is not active. The first client device can use this information, for example, to pause the execution of a data processing program until the first transient layer is activated for the mechatronic device. This prevents erratic behavior for the first client device.

[0032] According to a further advantageous embodiment of the method according to the invention, it is further provided that each client device is assigned unique identification information, that the respective client devices include this identification information in method call messages, and that the identification information is additionally written to the respective transient layers when states are written. This enables both the server device and the respective client devices to transparently track which client device has assigned states to a particular layer in the layer stack. Accordingly, it can be determined which client device has currently taken control of the function provided by the mechatronic device. The server device can also have its own identification information, which can be assigned to a layer in the layer stack when the server device changes the states of the respective layer.Preferably, the identification information is the so-called "Universally Unique Category".

[0033] A computer program product according to the invention comprises machine-interpretable instructions which, when executed by a client device and a server device, cause each of them to implement the steps to be carried out by the respective device in the course of a method described above.

[0034] In a vehicle comprising at least one client device, one server device and one mechatronic device, it is provided according to the invention that the at least one client device and server device have read access to a computer-readable storage medium containing a computer program product as described above.

[0035] The vehicle in question can be any road vehicle, such as a car, truck, bus, construction vehicle, agricultural vehicle, van, or similar. It could also be a rail vehicle, watercraft, or aircraft.

[0036] Further advantageous embodiments of the inventive method for operating the information technology system in a vehicle also result from the exemplary embodiments, which are explained in more detail below with reference to the figures.

[0037] This shows: Fig. 1 A schematic top view of an information technology system in a vehicle; Fig. 2. A flowchart of the communication between the individual components of the information technology system; and Fig. 3 A schematic representation of a layer stack.

[0038] Fig. Figure 1 shows a top view of a vehicle 1 according to the invention, comprising an information technology system with at least one client device 2, a server device 3, and a mechatronic device 4. The devices are connected via a data bus 5. Several devices are shown by way of example.

[0039] The server device 3, which mediates between the client devices 2 and the mechatronic devices 4, allows the client devices 2 to use services that are based on the respective functions of the mechatronic devices 4. Fig. Figure 1 illustrates a simple example where a client device 2 detects a position of an operating device 11.

[0040] The control element 11, for example in the form of a dial, can be used to set a level for the seat heating 12. The seat heating 12 is controlled via one of the mechatronic devices 4.

[0041] Fig. Figure 2 illustrates the communication process via data bus 5 according to the state of the art. Client device 2 initiates the communication by sending a method call message 6 to server device 3. Server device 3 sends a response message 13 back to client device 2, signaling to the requesting client device 2 that the method call message 6 was processable. If the status of the requested resource changes, i.e., if the configuration of the mechatronic device 4 has been adjusted, server device 3 sends a status event message 14 to all subscribed client devices 2. For this purpose, server device 3 sends a configuration message 15 to mechatronic device 4 and receives a configuration confirmation 16 from it.

[0042] A disadvantage is that a collision can occur if two client devices 2 attempt to use the same function of a mechatronic device 4 simultaneously. This can lead to erratic system behavior.

[0043] To avoid this, the information technology system is operated according to a method according to the invention. This method provides that the server device 3 has at least one in Fig. 3 provides a layer stack 7, comprising at least one persistent layer 8 and one transient layer 9, wherein the persistent layer 8 includes a state for at least one mechatronic device 4 and states for the at least one mechatronic device 4 are writable on transient layers 9, wherein a client device 2 transmits a method call message 6 to the server device 3, comprising at least one state for the at least one mechatronic device 4, wherein the server device 3 writes the states contained in the method call message 6 to a transient layer 9, and the server device 3 designates a layer 8, 9, 10 in the layer stack 7 as the active layer and configures the at least one mechatronic device 4 according to the states contained in the active layer.

[0044] In addition to the persistent layer 8 and the respective transient layers 9, the layer stack can include at least one mode layer 10. Preferably, the layers 8, 9, and 10 are stacked vertically, with the persistent layer 8 forming the base. Each transient layer 9 and the mode layers 10 are preferably assigned a decay time. For the transient layers 9, the state(s) are removed from the respective layer 9 after the decay time has elapsed. Preferably, the maximum permissible decay time decreases with increasing stack height of the respective layers 9 and 10 in the layer stack 7, which is Fig.This is indicated by a pyramid-like representation. Server device 3 preferentially sets the top layer 8, 9, 10 in layer stack 7, which contains a state for the mechatronic device 4, as "active". For mode layers 10, the expiration time does not expire but merely serves to determine the position within layer stack 7. To remove a mode layer 10 from layer stack 7, a method call message 6 relating to the respective mode layer 10 can be issued by a client device 2, which has an expiration time of zero. While the persistent layer 8 always contains a state, the transient layers 9 can be empty. Mode layers 10 can be entirely absent. This ensures that at least the state set in the persistent layer 8 is configured on the mechatronic device 4.

[0045] The transient layers 9 act as a kind of "buffer" for storing a configuration for the mechatronic device 4 when multiple client devices 2 simultaneously request the corresponding use of the function provided by the mechatronic device 4. Depending on the situation, the server device 3 then sets the state(s) contained in the respective layer(s) 8, 9, 10, thus preventing collisions. The reliable operation of the information technology system is therefore ensured.

Claims

[1] Method for operating an information technology system in a vehicle (1), the information technology system comprising at least one client device (2), one server device (3) and one mechatronic device (4), wherein the respective mechatronic devices (4) are indirectly connected to the respective client devices (2) via a data bus (5) using an application programming interface, wherein the at least one mechatronic device (4) has a state which can be changed to provide a function, wherein the server device (3) provides at least one service, wherein, in the context of using a service, client devices (2) transmit a method call message (6) to the server device (3) in order to set a desired state for a respective mechatronic device (4), characterized by , that the server device (3) provides at least one layer stack (7) comprising at least one persistent layer (8) and one transient layer (9), wherein the persistent layer (8) comprises a state for at least one mechatronic device (4) and states for the at least one mechatronic device (4) are writable on transient layers (9); wherein a client device (2) transmits a method call message (6) to the server device (3), comprising at least one state for the at least one mechatronic device (4); wherein the server device (3) writes the states contained in the method call message (6) to a transient layer (9); and the server device (3) designates a layer (8, 9, 10) in the layer stack (7) as the active layer and configures at least one mechatronic device (4) according to the states contained in the active layer. [2] Method according to claim 1, characterized by, that the server device (3) provides a separate layer stack (7) for different services and / or different mechatronic devices (4). [3] Method according to claim 1 or 2, characterized by , that the layers (8, 9, 10) in the layer stack (7) are arranged sequentially, wherein the persistent layer (8) forms the lowest layer and all other layers (9, 10) are arranged above it, and wherein the server device (3) designates as the active layer the layer (8, 9, 10) in the layer stack (7) which corresponds to the topmost layer in the layer stack (7) which comprises at least one state. [4] Method according to claim 3, characterized by , that when writing to a transient layer (9), the states are assigned a decay period, after which the respective state is removed from its transient layer (9). [5] Method according to claim 4, characterized by, that a client device (2) resets the expiry period by sending a new method call message (6) to the server device (3) before the expiry period expires. [6] Method according to claim 4 or 5, characterized by , that each transient layer (9) in the layer stack (7) is assigned a maximum decay time which depends on the arrangement height in the layer stack (7), with the maximum decay time decreasing from bottom to top. [7] Method according to any one of claims 1 to 6, characterized by, that the server device (3) inserts at least one mode layer (10) into the layer stack (7), having at least one predefined state and / or at least one writable state by a method call message (6), wherein a respective mode layer (10) is arranged in the layer stack (7) between two transient layers (9), above a transient layer (9) or below a transient layer (9), and wherein the mode layer (10) is assigned a decay time of zero or greater than zero by a method call message (6), wherein a decay time greater than zero does not expire, and the server device (3) removes a mode layer (10) from the layer stack (7) when a decay time of zero is assigned to the mode layer (10). [8] Method according to claim 7, characterized by, that the server device (3) assigns a zero expiry time to a mode layer (10) if, after activation of the vehicle's on-board electronics (1), the server device (3) does not receive a method call message (6) relating to the respective mode layer (10) within a specified time period. [9] Method according to claim 7 or 8, characterized by , that only the client device (2) which caused the insertion of the mode layer (10) into the layer stack (7) or the server device (3) are able to assign an expiration time of zero to the mode layer (10). [10] Method according to any one of claims 1 to 9, characterized by , that respective client devices (2) query the active layer and / or a layer intended for writing a state from the server device (3). [11] Method according to any one of claims 1 to 10, characterized by, that each client device (2) is assigned a unique identification information, the respective client devices (2) include the identification information in method call messages (6) and the identification information is additionally written to respective transient layers (9) when writing states. [12] Computer program product, characterized by machine-interpretable instructions which, when executed by a client device (2) and a server device (3), cause the latter to implement the steps to be carried out by the respective device in the course of a method according to one of claims 1 to 11. [13] Vehicle (1) comprising at least one client device (2), one server device (3) and one mechatronic device (4), characterized by , that at least one client device (2) and server device (3) have read access to a computer-readable storage medium, containing a computer program product according to claim 12.

Images