Method for operating a motor vehicle

Abstract

The present invention relates to a method for operating a motor vehicle (1), wherein the motor vehicle (1) has a computing system (2) by means of which a main application (100) for operating the motor vehicle is executed. The computing system (2) is divided into functional parts (5, 6) by means of virtualization, which are each assigned to the main application (100) or a validation application (200) for validating a function of the motor vehicle (1). The invention also relates to a computer program product for carrying out the method.

Description

The present invention relates to a method for operating a motor vehicle having a computing system, by means of which at least one main application for operating the motor vehicle is executed. The invention also relates to a computer program product for executing the method.In a motor vehicle, applications for operating the motor vehicle are usually used. Such applications can each implement a function in the motor vehicle or be part of a function which is required for the operation of the motor vehicle. For executing such applications, motor vehicles generally have a computing system with corresponding hardware.To improve functions and / or to introduce new functions, it is usually necessary first to validate the new or changed functions. Typically, such changes are provided in the form of appropriate applications that are to be validated.US 2021 / 382756 A1 describes a method for statically partitioning a hardware accelerator in a cloud such that the partitionings do not influence each other.US 2019 / 0286607 A1 discloses the sharing of a storage device. This allows data from different sources to be written to the storage device at the same time.WO 2021 / 179780 A1 describes a method for dynamically moving resources between virtual graphics processors of a computing system.This allows the graphics processors to be provided to multiple customers for use.In the article "VM-Based Real-Time Services for Automotive Control Applications. In: Proceedings of the 2010 IEEE 16th International Conference on Embedded and Real-Time Computing Systems and Applications, 2010, pp. 218-223" by Masur, A. et al., the virtualization of a computing system of a motor vehicle is described.From EP 3 671 450 A1 a virtual electronic control unit in AUTOSTAR is known.The article "Virtual Test Benchmark for Validating a Steering Control Unit" published by MicroNova AG, Customer Journal inNOVAtion / / 01-21 / / 004-007 deals with the virtual testing and virtualization of ECU.The present invention is concerned with the object of demonstrating new, in particular improved or different, ways for a method for operating a motor vehicle and for a computer program product for executing the method.This object is achieved with the independent claims. Advantageous variants are the subject of the dependent claims.The invention accordingly relates to the use of the same computing system of a motor vehicle for executing applications for functions required during operation of the motor vehicle, also referred to below as main applications, and for validating changed and / or new functions, also referred to below as validation applications. In this case, virtualization is used to subdivide the computing system into virtual parts which are separate from one another for executing the main applications on the one hand and for executing the validation applications on the other hand. As a result, for example, in comparison with the provision of respectively dedicated computing systems for executing the main applications and the validation applications, a considerable saving in costs and resources and energy occurs. The separation of the execution of the main applications and the validation applications by means of the virtualization furthermore leads to the avoidance of an undesired mutual influencing of the main applications and the validation applications, so that the method at the same time has no influence on the operation of the motor vehicle. The latter leads to increased safety. Thus, the invention achieves advantages both with regard to saving costs and resources and advantages for increased safety.The invention thus relates to a method for operating a motor vehicle. At least one main application is executed for operating the motor vehicle. The motor vehicle has a computing system, by means of which at least one such main application is executed. In addition, a validation application for validating a function of the motor vehicle is provided. According to the invention, the computing system is divided by means of virtualization into at least one virtual function part for at least one main application and at least one virtual function part for the validation application. The respective functional part for the main application is also referred to below as the main functional part and the respective functional part for the validation application is also referred to below as the additional functional part. In this case, the at least one main application is executed by means of the at least one main functional part. In addition, the validation application is executed exclusively by means of the at least one additional function part.The subdivision of the computing system into the at least one main function part and the at least one additional function part carried out by means of the virtualization is carried out in such a way that the at least one main function part is separated from the at least one additional function part. This means that preferably no mutual influencing of the at least one main functional part and of the at least one additional functional part takes place.In the present case, exclusively executing the validation application by means of the at least one additional function part is to be understood as meaning that the validation application is executed without the at least one main function part.The respective main application can be software of any kind with which a function for operating the motor vehicle is at least partially executed. These include, for example, the operating system and firmware and the like.The validation application can be provided in any desired manner. For example, the validation application can be transmitted to the motor vehicle, in particular wirelessly, by means of data transmission via an external source.It is conceivable to provide the validation application in the form of an update or an upgrade. In this case, the update or upgrade is validated in the motor vehicle as described in the present case and can subsequently become the main application in the event of successful validation.A computing system in the sense of the present invention preferably comprises all the hardware required for executing the applications. In particular, the computing system can have at least one memory, accelerator and the like in addition to a computing unit.The computing system can be, for example, a system-on-a-chip or "SoC" for short or can have at least one SoC.For example, the computing system may include at least one hardware accelerator that is divided by virtualization. This means that the at least one hardware accelerator forms or can be a part of at least one such virtual main function part and a part of at least one such virtual auxiliary function part.At least one of the at least one hardware accelerator can advantageously be or have an AI accelerator, wherein "AI" stands for "artificial intelligence". The AI accelerator is also known as the English term "AI accelerator". The AI accelerator may include a neuromorphic processor or may be a neuromorphic processor.Likewise, at least one of the at least one hardware accelerators can comprise at least one graphics processor or consist of at least one graphics processor.Preferably, the virtualization is carried out in such a way that all hardware of the computing system and / or all available resources of the computing system are divided into the virtual functional parts, as described in the present case, and thus form parts of the respective functional part.The subdivision of the computing system by means of virtualization can in principle take place dynamically. In this case, more or fewer resources of the computing system are provided to the at least one main function part and the at least one additional function part by means of virtualization, as required.In preferred embodiments, the computing system is statically divided into the at least one main function part and the at least one additional function part. This means that the resources of the computing system are statically assigned to the at least one main application and the validation application by means of virtualization. Thus, the at least one main application and the validation application are also guaranteed a minimum amount of resources, so that in particular the at least one main function part can be executed reliably and planably. This leads to improved operation of the motor vehicle with increased safety.The subdivision of the computing system by means of virtualization is preferably carried out in such a way that sufficient resources of the computing system are provided to the at least one main application for smooth execution. This results in a further increase in safety.The computing system is advantageously divided by means of virtualization in such a way that more resources are assigned to the at least one main function part than to the at least one additional function part.In advantageous variants, the computing system is divided by means of virtualization in such a way that at least twice as many resources are assigned to the at least one main function part as the at least one additional function part. For example, two thirds of the resources can be assigned to the at least one main function part and one third of the resources can be assigned to the at least one additional function part.Variants in which a hypervisor is provided are preferred. The hypervisor comprises at least one virtual machine for the at least one main application and at least one virtual machine for the validation application. The respective at least one virtual machine for the main application is also referred to below as main virtual machine and the at least one virtual machine for the validation application is also referred to below as auxiliary virtual machine. The hypervisor thus comprises at least one main virtual machine and at least one additional virtual machine. In this case, the at least one main virtual machine is assigned to the at least one main function part and is separated from the at least one additional function part. In addition, the at least one additional virtual machine is assigned to the at least one additional function part and is separated from the at least one main function part. In this case, the at least one main application is executed in the at least one main virtual machine and the validation application is executed in the at least one additional virtual machine. Thus, a further clear separation occurs between the execution of the respective main application and the validation application. This leads to a further increased safety in addition to a more reliable operation.The hypervisor is preferably connected to the functional parts in a data-transmitting manner in such a way that a data transmission takes place between the respective main functional part and the associated main virtual machine on the one hand and a data transmission takes place between the respective additional functional part and the associated additional virtual machine on the other hand. The data transmission can take place, for example, by means of a bus.The motor vehicle expediently has hardware which, during operation, provides, in particular supplies, data for at least one of the at least one main applications. The hardware is also referred to below as application hardware and the provided data is also referred to below as input data. The application hardware thus generates input data during operation, which is provided to at least one of the at least one main applications.The input data are preferably also provided at least partially to the validation application. This makes it possible, in particular, to compare the evaluation and / or execution of the hup application and of the validation application for validating the validation application on the basis of the same input data. For example, it can thus be compared whether the validation application delivers comparable or better results than the corresponding main application. It is accordingly preferred if results of the validation application are compared with results of at least one of the at least one main applications for validation of the validation application.The input data are preferably provided to the validation application taking into account the division of the resources of the computing system. If, for example, one third of the resources are assigned to the at least one additional function part and two thirds to the at least one main function part, a corresponding proportion of the input data can be provided to the validation application.The input data may be processed prior to provision. For example, the input data can be filtered and / or authorized and / or converted and / or merged, for example in the manner of a fusion. It is conceivable to carry out the processing in the context of at least one such main application.The application hardware may be of any type.For example, the application hardware may be a sensor or may include a sensor that provides sensor data as input data during operation.The sensor can be a camera which, during operation, provides images and thus image data as input data.The sensor can likewise be a lidar sensor, radar sensor or ultrasonic sensor.Also, the application hardware may include two or more such sensors.In particular, taking into account the resources, for example, all sensor data, for example all image data, of at least one main application and only a part of the sensor data, for example a part of the image data, can be provided to the validation application.Any type of virtualization may be used to subdivide the computing system.For example, so-called "single-root input / output virtualization", which is also familiar under the abbreviation "SR-IOV", can be used. This means that the computing system can be divided into the at least one virtual main function part and the at least one virtual auxiliary function part by means of SR-IOV.It is understood that two or more validation applications can also be carried out by means of the method according to the invention. This means that at least one validation application is executed by means of the at least one additional functional part. This also means that, when the hypervisor is provided on the at least one additional virtual machine, the at least one validation application is executed.To execute the method, a corresponding computer program product is advantageously used. The computer program product as such is also within the scope of this invention.The computer program product comprises instructions which, when the computer program product is executed by a motor vehicle, cause the motor vehicle to execute the method.Further important features and advantages of the invention are evident from the dependent claims, from the drawings and from the associated description of the figures with reference to the drawings.It is understood that the features mentioned above and those still to be explained below can be used not only in the respectively specified combination, but also in other combinations or alone, without departing from the scope of the present invention.Preferred exemplary embodiments of the invention are illustrated in the drawings and are explained in more detail in the following description, wherein the same reference numerals refer to the same or similar or functionally the same components.They show, in each case schematically FIG. 1 shows a greatly simplified, schematic diagram-like illustration of a motor vehicle having a computing system, FIG. 2 shows a schematic diagram for dividing the computing system into virtual functional parts, FIG. 3 shows a flow chart for operating the motor vehicle.A motor vehicle 1 shown by way of example in FIG. 1 has a computing system 2 for executing applications 100, 200 (compare FIG. 3 ). In the exemplary embodiment shown in FIG. 1, data are processed by the computing system 2, which data the computing system 2 receives from a hardware 3 of the motor vehicle 1. The hardware 3 is also referred to below as application hardware 3 and the data is also referred to below as input data. In the exemplary embodiments shown, the application hardware 3 is, purely by way of example, a sensor 4 which, during operation, delivers data, for example of the environment of the motor vehicle 1, that is to say sensor data, as input data. In the following, purely by way of example, it is assumed that the sensor 4 is a camera which, during operation, provides image data as sensor data and thus input data. By means of the computing system 2, applications 100 are executed which are used for the current operation of the motor vehicle 1. These applications 100 are also referred to below as main applications 100. The respective main application 100 thus executes at least one step of a function required for the current operation of the motor vehicle 1. At least one application 200 for validating a function of motor vehicle 1 is also executed with computing system 2. The function may be a new function or a modified version of an existing function. This application 200 is also referred to below as a validation application 200. The respective at least one validation application 200 can be wirelessly transmitted to the motor vehicle 1 from an external source. The respective validation application 200 therefore does not serve for the current operation of the motor vehicle 1.For this purpose, as shown in FIG. 2, for example, the computing system 2 is divided by means of virtualization into at least one virtual function part 5 for executing the at least one main application 100 and at least one virtual function part 6 separate therefrom for executing the at least one validation application 200. For example, the computing system is divided into the virtual functional parts 5, 6 by means of "single-root input / output virtualization", also known under the abbreviation "SR-IOV". The respective virtual function part 5 is also referred to below as main function part 5 and the respective virtual function part 6 is also referred to below as additional function part 6. In this case, as will be explained below by way of example with reference to FIG. 3, the at least one main application 100 is executed by means of the at least one main function part 200 and the at least one validation application 200 is executed by means of the at least one additional function part 200 and without the use of the at least one main function part 200, that is to say exclusively by means of the additional function part 200.In the exemplary embodiments shown in FIGS. 2 and 3, a single main functional part 5 and a single additional functional part 6 are assumed purely by way of example.In the exemplary embodiments shown, the computing system 2 is statically divided into the at least one main function part 5 and the at least one additional function part 6. This means that the resources of the computing system 2 are statically assigned to the at least one main function part 5 and the at least one additional function part 6. For example, the at least one main function part 5 can be statically assigned two thirds of the resources and the at least one additional function part 6 can be statically assigned one third of the resources of the computing system 2. The virtualization is carried out accordingly.As is schematically shown in FIG. 2, in the exemplary embodiments shown, a hypervisor 7 is additionally provided, which has at least one virtual machine 8 for the at least one main application 100 and at least one virtual machine 9 for the at least one validation application 200. The respective at least one virtual machine 8 for the at least one main application 100 is also referred to below as main virtual machine 8, and the respective at least one virtual machine 9 for the validation application 200 is also referred to below as auxiliary virtual machine 9. In the exemplary embodiments shown, a single main virtual machine 8 and a single additional virtual machine 9 are assumed purely by way of example. In this case, the main virtual machine 8 is assigned to the main functional part 5 and is separated from the at least one additional functional part 6. This means that the resources of the additional function part 6 of the main virtual machine 8 are not available. In addition, the auxiliary virtual machine 9 is assigned to the auxiliary functional part 6 and is separated from the main functional part 5. This means that the resources of the main function part 5 of the auxiliary virtual machine 9 are not available. As can be seen from FIG. 3, the at least one main application 100 is executed in the main virtual machine 8 and the at least one validation application 200 is executed in the auxiliary virtual machine 9. As indicated in FIG. 2, a data transmission 10 takes place between the main virtual machine 8 and the main function part 5 and between the auxiliary virtual machine 9 and the auxiliary function part 6.In the exemplary embodiments shown, the computing system 2 is, purely by way of example, a system-on-a-chip 12 or "SoC" 12 for short. In the exemplary embodiments shown, the SoC 12 has a hardware accelerator 13. The hardware accelerator 13 comprises, for example, an AI accelerator (not shown), also known as an "AI accelerator", which has, for example, a neuromorphic processor (not shown), or is such an AI accelerator. In the exemplary embodiment shown in FIG. 3, the hardware accelerator 13 is likewise divided by means of virtualization and therefore has a virtual part as a constituent part of the main function part 5 and a virtual part as a constituent part of the additional function part 6. The SoC 12 can also have a control unit or "ECU" for short and / or accelerators and / or memories, which are in each case not shown and are likewise divided by means of virtualization as described. In the exemplary embodiments shown, both the main virtual machine 8 and the auxiliary virtual machine 9 are executed in the SOC 12.FIG. 3 shows an example operation of the motor vehicle 1 with regard to the input data provided by the application hardware 3 during operation. In the exemplary embodiment shown, the camera 4 is thus used as application hardware 3, which provides images and thus image data as input data during operation.As indicated in FIG. 3, the image data are fed to a main application 100, 100 a, by means of which the image data present as raw data is converted. The main application 100, 100 ais also referred to as conversion application 100, 100 ain the following. The image data converted by the conversion application 100, 100a is supplied to a main application 100, 100b which performs an equalization of the images. This main application 100, 100 bis also referred to below as an equalization application 100, 100 b. The conversion application 100, 100 aand the equalization application 100, 100 btherefore carry out processing and / or preparation of the image data. The image data thus processed is supplied to a main application 100, 100c and a 200, 200a which are executed by the respective constituent elements of the hardware accelerator 13. With the main application 100, 100 c, objects in the images are detected by means of the virtual part of the hardware accelerator 13 associated with the main function part 5. The main application 100, 100 cis also referred to below as detection application 100, 100 c. In addition, objects in the images are likewise detected by means of the virtual part of the hardware accelerator 13 associated with the additional function part 6 using the validation application 200, 200 a. In the exemplary embodiment shown, the validation application 200, 200 adversaries, for example, a modified version of the detection application 100, 100 c. The validation application 200, 200 ais therefore, for example, an update or an upgrade of the detection application 100, 100 c. The validation application 200, 200 ais also referred to below as an update application 200, 200 a. Due to the different distribution of the resources, it is possible to provide only a part of the processed and / or prepared image data to the update application 200, 200 a. For example, it is conceivable to provide all processed and / or prepared images to the update application 200, 200 aof each third and the detection application 100, 100 c. The objects detected by the detection application 100, 100 care provided to a main application 100, 100 d. For example, the main application 100, 100 dmay be used to fuse and track the detected objects. The main application 100, 100 dis also referred to below as a tracking application 100, 100 d. The objects detected by means of the update application 200, 200 aare provided to a validation application 200, 200 b. In addition, the objects detected by means of the detection application 100, 100 care provided to the validation application 200, 200 b. In the validation application 200, 200 b, the results of the update application 200, 200 aare compared with corresponding results of the detection application 100, 100 c. By means of this comparison, it can then be evaluated whether the update application 200, 200 ais released as a future main application 100, that is to say for example as a future detection application 100, 100 c. The validation application 200, 200 bis also referred to below as evaluation application 200, 200 b.The results of the tracking application 100, 100 dare provided to a main application 100, 100 ein the exemplary embodiment shown. The main application 100, 100 emay be part of a driver assistance of the motor vehicle 1, not otherwise shown, and is also referred to below as assistance application 100, 100 e. By means of the assistance application 100, 100 e, for example, an autonomous braking function of the motor vehicle 1 can be executed.The method is advantageously executed with a computer program product that comprises corresponding instructions.

Claims

Method for operating a motor vehicle (1), - with a computing system (2) of the motor vehicle (1), by means of which at least one main application (100) for operating the motor vehicle (1) is executed, - wherein the computing system (2) is divided into at least one virtual main function part (5) and at least one virtual additional function part (6) by means of virtualization, - wherein the at least one main application (100) is executed by means of the at least one main function part (5), - wherein at least one validation application (200) is provided for validating a function of the motor vehicle (1), - wherein the at least one validation application (200) is executed in the computing system (2) exclusively by means of the at least one additional function part (6).Method according to Claim 1, characterized in that the computing system (2) is statically divided into the at least one main function part (5) and the at least one additional function part (6).Method according to Claim 1 or 2, characterized in that the computing system (2) is divided by means of virtualization in such a way that more resources of the computing system (2) are assigned to the at least one main function part (5) than to the at least one additional function part (6).Method according to Claim 3, characterized in that the computing system (2) is divided by means of virtualization in such a way that at least twice as many resources of the computing system (2) are assigned to the at least one main function part (5) as the at least one additional function part (6).Method according to one of Claims 1 to 4, characterized - in that a hypervisor (7) is provided which comprises at least one main virtual machine (8) and at least one additional virtual machine (9), - in that the at least one main virtual machine (8) is assigned to the at least one main function part (5) and is separated from the at least one additional function part (6), - in that the at least one additional virtual machine (9) is assigned to the at least one additional function part (6) and is separated from the at least one main function part (5), - in that the at least one main application (100) is executed in the at least one main virtual machine (8) and the at least one validation application (200) is executed in the at least one additional virtual machine (9).Method according to one of Claims 1 to 5, characterized - in that motor vehicle (1) has application hardware (3) which generates input data during operation, the input data being provided to at least one of the at least one main applications (100), - in that the input data is provided at least partially to at least one of the at least one validation applications (200).Method according to Claim 6, characterized in that at least one sensor (4) which provides sensor data as input data is used as the application hardware (3).Method according to Claim 6 or 7, characterized in that, for the purpose of validation, results of at least one of the at least one validation applications (200) are compared with results of at least one of the at least one main applications (100).Method according to one of Claims 1 to 8, characterized in that the computing system (2) has at least one hardware accelerator (13) which is divided by means of virtualization, such that the at least one hardware accelerator (13) forms part of at least one such virtual main function part (5) and part of at least one such virtual additional function part (6).Method according to one of Claims 1 to 9, characterized in that the computing system (2) is divided into the at least one virtual main function part (5) and the at least one virtual additional function part (6) by means of single-root input / output virtualization.A computer program product comprising instructions which, when the computer program product is executed by a motor vehicle (1), cause the motor vehicle (1) to carry out the method according to any one of the preceding claims.

Images