METHOD FOR REPRESENTING GRAPHIC ELEMENTS, COMPUTER PROGRAM PRODUCT, STORAGE MEDIUM, DATA CARRIER SIGNAL, DEVICE AND VEHICLE

Abstract

A computer-implemented method for displaying graphic elements on a vehicle display device, wherein the graphic elements are assigned safety criticality and dynamics, comprises a step of monitoring 104 of a first computing unit with respect to a reduction condition. Furthermore, a step of generating 106 of the graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 is performed by the first computing unit and the graphic elements are displayed on the display device 120. Additionally, at least one reduced graphic element is generated by a second computing unit 158, wherein each reduced graphic element is assigned to a graphic element, and the representation of a reduced graphic element is based on the safety criticality and dynamics of the graphic element assigned to it.Upon occurrence of the reduction condition, the reduced graphic elements are displayed on the display device instead of their associated graphic elements, generating a snapshot of low dynamics graphic elements, and the reduced graphic element corresponds to the snapshot, where low dynamics means that the graphic element is generated at most every 500ms.

Description

Technical field

[0001] The present invention relates to the reliability of graphic display devices. In particular, the present invention relates to a computer-implemented method for displaying graphic elements of a vehicle display device. Furthermore, the present invention relates to a device, a computer program product, a computer-readable storage medium, a data carrier signal, and a vehicle. Technical background and task

[0002] Increasingly, vehicles are using fewer generic central processing units (CPUs) instead of many small, specialized electronic units. These CPUs typically employ generic standard computing units (SoCs; Systems-on-a-Chip). SoCs typically offer numerous connection options for various inputs and outputs, particularly for display devices such as monitors and cameras.

[0003] These SoCs are often not specifically designed for safe applications with regard to functional safety, which is a crucial requirement, especially for the automotive industry. Conversely, SoCs with extended safety features are frequently limited to software environments not designed for safe functions, such as Linux. Due to the high development costs associated with multimedia functions, these less secure software environments are still used.

[0004] Therefore, in typical, safety-critical automotive applications, specialized, highly secure, but less powerful microcontrollers with specially qualified software are used. However, the graphical representation of safety-relevant information requires increasingly significant computing power, as modern display devices place ever higher demands in this regard, for example, due to increasingly higher resolutions. The small, specialized microcontrollers are not designed for the high graphics processing power and correspondingly high data rates required for this.

[0005] While solutions exist that can guarantee safety, or at least detect violations of safety requirements, by monitoring the correct display of safety-relevant indicators, these solutions also necessitate a significant restriction of the display to allow for reliable verification within the microcontroller. Furthermore, in the event of a fault, these solutions implement safety measures that are noticeably disruptive to the driver, such as a system restart or a display showing only minimal information. High safety and availability of the indicators can be achieved through redundant central processing units, but this leads to significantly increased costs.

[0006] US Patent 2024 / 0123825 A1 concerns a method and device for controlling vehicle displays. It describes two transmission states: In the first state, when the reception of the first image data is normal, this data is received and corresponding third image data is sent to the display. In the second state, when the reception of the first image data is abnormal, previously stored second image data, corresponding to the vehicle status, is received and corresponding fourth image data is sent to the display. Both the first and second image data represent vehicle status information.

[0007] US 2021 / 0 279 835 A1 concerns a method for initializing rendering on a graphics processing unit (GPU) designed for safety-critical rendering. The process involves sending an instruction to the GPU to start rendering safety-critical graphics data and requesting a response. A timer is initialized to wait for the GPU's response within a specified time period. If no response is received before the timer expires, an external safety controller determines that an initialization failure has occurred.

[0008] It is therefore an object of the present invention to provide computer-implemented methods for displaying graphic elements of a vehicle's display device, which overcomes at least one of the aforementioned disadvantages. Furthermore, it is an object of the invention to provide a device, a computer program product, a computer-readable storage medium, a data carrier signal, and a vehicle. Disclosure of the invention

[0009] The problem is solved according to the invention by the features of the independent claims. Advantageous embodiments can be found in the dependent claims.

[0010] According to a first aspect of the invention, a computer-implemented method for displaying graphic elements on a vehicle display device includes a step of monitoring a first computing unit with respect to a reduction condition. The graphic elements are assigned a safety criticality and a dynamic behavior.

[0011] The display device can be a screen, for example a head-up display (HUD), a liquid crystal display (LCD), an organic light-emitting diode display (OLED display), or the like. The display device can also be a touch-sensitive screen. The vehicle can be a motor vehicle, truck, motorcycle, bicycle, scooter, airplane, helicopter, train, or the like.

[0012] The display device shows graphical elements. These can consist of characters or geometric shapes, for example. Typically, information regarding the vehicle's status or the journey undertaken is displayed to a passenger or driver using these graphical elements. For example, arrows are displayed to indicate a navigation route. A time or temperature is often displayed in text form. Digital graphical representations of a speedometer show the current speed. Speed ​​limits can be represented as a combination of characters and geometric shapes, for example, by replicating the corresponding traffic sign (e.g., black lettering on a white, round background with a red border). These are just a few examples of graphical elements.

[0013] Each graphic element is assigned a safety criticality and a dynamic level. The safety criticality indicates how important the graphic element is for the safe operation of the vehicle. Safety criticality can be specified, for example, as a numerical value, with higher numbers corresponding to higher safety criticality. For instance, the graphic element for a speed limit might have a higher safety criticality value than one for the time.

[0014] The dynamics assigned to each graphical element describe how frequently the corresponding graphical element is updated, or how frequently the information represented by the graphical element changes. For example, a graphical element displaying hours and minutes can be updated once per second. This is sufficient to accurately represent the time. However, a graphical element displaying speed must be updated more frequently, for example, five times per second.

[0015] Furthermore, in this step, a first processing unit is monitored with respect to a reduction condition. This first processing unit can be a separate physical unit or, for example, within a software system, separated from other parts of the software system by a hypervisor or a container environment. The first processing unit generates the graphical elements that are to be displayed during normal, i.e., unrestricted, operation without any errors (such as a frozen image).

[0016] However, malfunctions can occur, preventing the timely or error-free display of graphical elements. This can happen, for example, if the system components involved (display device, memory, central processing unit, etc.) are overloaded or if the system is attacked. Programming errors or system damage can also lead to incorrect rendering of the graphical elements. Furthermore, transient errors, such as bit errors in data storage caused by electromagnetic interference or during data communication, can result in faulty, delayed, or missing rendering. The reduction condition is a measure of the point at which the first processing unit is no longer able to render the graphical elements correctly.For example, the reduction condition may consist of a checksum being incorrect over a range of the display device.

[0017] Furthermore, the method includes a step in which the first processing unit generates the graphical elements and displays them on the display device. Through this step, the first processing unit fulfills its purpose of generating the graphical elements necessary for proper driving operation and making them available to the display device for display.

[0018] Furthermore, the method includes a step in generating at least one reduced graphical element by a second processing unit, with each reduced graphical element being assigned to a graphical element. The representation of a reduced graphical element is based on the safety criticality and dynamics of the graphical element to which it is assigned.

[0019] The second processing unit can be a separate physical unit or, for example, separated from other parts of a software system by a hypervisor or a container environment. The second processing unit generates the simplified graphical elements that are displayed in the event of restricted driving operation due to an error. The first and second processing units can be implemented as partitions on a hypervisor or in containers. They can be implemented on physically separate CPU clusters in a system-on-a-chip (SoC) or as separate processes within an operating system.

[0020] For every graphic element, a reduced graphic element can be generated. A reduced graphic element is characterized by the fact that less computational effort is required to generate and display it than the graphic element to which it is assigned.

[0021] In this process, a simplified graphical element is generated, taking into account the safety criticality and dynamics of the graphical element it is associated with. A graphical element with high safety criticality and a simple representation, such as warning lights or turn signals, can be generated unchanged and in its entirety by the second processing unit. The simplified graphical element then corresponds to the graphical element. A graphical element with high safety criticality and a complex representation, such as a speedometer, can be generated in a less complex representation by the second processing unit, for example, as a simple text display.

[0022] Graphical elements displaying information that changes slowly, such as a fuel gauge, time, or temperature reading, can be generated less frequently. For example, if the first processing unit generates graphical elements every 100 ms, graphical elements with low dynamics can be generated only every 1 second. The most recent generation of the reduced graphical element is then used for display on the screen. Graphical elements with low safety criticality can also be omitted entirely.

[0023] Upon fulfillment of the reduction condition, the process includes a step in displaying the reduced graphical elements on the display device instead of their corresponding graphical elements. In other words, the complex graphical elements generated by the first processing unit are replaced by the less complex reduced graphical elements generated by the second processing unit in the event of a malfunction. The reduced graphical elements display the same information as their corresponding graphical elements (unless they are omitted entirely due to low safety criticality), but in a less computationally intensive form.

[0024] A snapshot is generated from graphical elements with low dynamic range, and the reduced graphical element corresponds to this snapshot. For graphical elements with low dynamic range, such as a temperature display, the reduced graphical elements can be generated less frequently. Instead of generating a new snapshot, the previously taken one is used. In this case, the original graphical element is even perceived without any reduction in its appearance. Low dynamic range means that the graphical element is updated at most every 500ms.

[0025] In an optional embodiment, the reduced display can also be shown even if the reduction condition is not met. For example, a vehicle driver can select a corresponding setting via an infotainment system.

[0026] In an advantageous implementation, for graphic elements with high safety criticality, the reduced graphic element corresponds to the graphic element. This is useful when the graphic element is already simple in design, but the information it conveys is highly safety-relevant. A warning light is an example of such a graphic element.

[0027] In an advantageous embodiment, the display of the reduced graphical elements generated by the second processing unit continues until the first processing unit restarts. In other words, the display of the reduced graphical elements persists only until the original graphical elements can be reliably generated again by the first processing unit. This is particularly advantageous because a driver of the vehicle might not even notice that a malfunction has occurred.

[0028] Snapshots of the graphic elements can be generated and stored at regular intervals, for example, every 2 seconds. These snapshots can then be used, in whole or in part, to generate the reduced graphic elements, for example, to display slowly changing or static but complex graphic elements unchanged even during and after switching in the display device.

[0029] In an advantageous implementation, the reduction condition corresponds to a safety level, readability, a checksum over an image area, or the correctness of the image area. For example, if readability is deemed unacceptable, the first processing unit should be restarted. In the meantime, the second processing unit takes over the rendering of critical graphical elements. Furthermore, a cyclic redundancy check can provide a test value in the form of a checksum, which must be correct. Otherwise, the reduction condition is considered to have been met. The safety level can, for example, be defined by the Automotive Safety Integrity Level (ASIL).

[0030] According to a second aspect of the invention, a computer program product includes instructions that, when executed by a computer, cause the computer to perform a method as described above. The computer program product can be written in a programming language, for example, Python or C++.

[0031] According to a third aspect of the invention, a computer-readable storage medium comprises instructions that, when the program is executed by a computer, cause it to perform a method as described above. The computer-readable storage medium can, for example, be implemented as an SSD (solid-state disk) or as flash memory. The computer-readable storage medium can also store other data, such as sensor data and / or data that is (temporarily) stored during the execution of the method.

[0032] According to a fourth aspect of the invention, a data carrier signal transmits the computer program product as described above. The data carrier signal can be transmitted via cable, for example using a CAN (Controller Area Network), FlexRay, Ethernet, LIN (Local Interconnect Network), or MOST (Media Oriented Systems Transport). It can also be transmitted wirelessly, for example using Wi-Fi, Bluetooth, mobile networks, or the like.

[0033] According to a fifth aspect of the invention, a device for displaying graphic elements on a display device of a vehicle has a first computing unit which is configured to generate graphic elements.

[0034] Furthermore, the device has a second computing unit which is designed to generate reduced graphic elements.

[0035] The first and second processing units can be separated from each other in various ways. For example, through different partitions on a hypervisor, as separate processes within an operating system, on physically separate processors, or in different containers.

[0036] Furthermore, the device has a display output which is communicatively connected to the first and second processing units. The display output can be implemented, for example, as HDMI, VGA, DVI, DisplayPort, USB, or similar.

[0037] Furthermore, the device includes a display unit which is communicatively connected to the display output. The device itself is designed to perform a procedure as described above. The display unit receives an image to be displayed via the display output, which is composed of the graphic elements in normal operation and the reduced graphic elements in faulty operation.

[0038] In an advantageous embodiment, the first computing unit and the second computing unit are implemented within a computing system using a hypervisor.

[0039] In an advantageous embodiment, the first computing unit and the second computing unit within a computing system are implemented on different processors.

[0040] In an advantageous embodiment, at least a first graphics layer and a second graphics layer are provided to the display output. The first graphics layer is provided by the first processing unit and assigned a high priority before the reduction condition is met. The second graphics layer is provided by the second processing unit and assigned a low priority before the reduction condition is met. Upon meeting the reduction condition, the first graphics layer is assigned a low priority and the second graphics layer a high priority. The display output always provides the graphics layer with the high priority to the display device for display.

[0041] Many typical SoCs have a display output that reads multiple graphics layers from memory and combines them into a single image before displaying them. The invention utilizes this by initially storing the graphic elements on a high-priority graphics layer and the reduced graphic elements on a low-priority graphics layer. During normal operation, only the high-priority graphics layer is used for display. If the reduction condition is met in the event of a fault, it is sufficient to swap the priorities of the graphics layers.

[0042] The overall image can also be assembled using software called a compositor. The compositor can, for example, be part of the second processing unit.

[0043] In an advantageous embodiment, the first computing unit is assigned to the display output until the reduction condition occurs, and the second computing unit is assigned to the display output once the reduction condition occurs.

[0044] The display output must therefore be exclusively assigned to either the first or the second processing unit at any given time. This assignment can remain with the first processing unit until the reduction condition is met, thus displaying the graphical elements. Upon meeting the reduction condition, the assignment is then switched to the second processing unit, so that the simplified representation in the form of the reduced graphical elements is now displayed.

[0045] In an advantageous embodiment, monitoring of the first computing unit with respect to the reduction condition is implemented by means of at least one of the following possibilities: - Monitoring of a computer program executed on the first computing unit with a third computing unit, wherein the third computing unit is implemented in a computing system together with the first computing unit and the second computing unit, - Monitoring of a computer program executed on the first computing unit with a fourth computing unit, wherein the fourth computing unit is not implemented in a computing system with the first computing unit and the second computing unit, - Monitoring of a display area with a fifth computing unit, wherein the fifth computing unit is implemented with the first computing unit and the second computing unit in a computing system.

[0046] According to a sixth aspect of the invention, a vehicle has a device as described above.

[0047] An advantage of the present invention is that a user, such as a driver of a vehicle, does not perceive the switch between the normal display mode and the reduced display mode as an error. Summary of the characters

[0048] The invention is explained in more detail below using exemplary embodiments and the accompanying figures. The figures show: Fig. 1: A flowchart of an embodiment of a computer-implemented method for displaying graphic elements on a vehicle display device; Fig. 2: A display device with an application example of the method from Fig. 1; and Fig. 3: An embodiment of a device for displaying graphic elements on a vehicle display device; and Fig. 4: A vehicle with the device made of Fig. 3. Detailed description of the figures

[0049] Fig. Figure 1 shows a flowchart of an embodiment of a computer-implemented method 100 for displaying graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 on a display device 120 of a vehicle 160.

[0050] In a first step of procedure 100, startup step 102, a device 140 with all components required for procedure 100 is initialized and started.

[0051] In the next step, monitoring step 104, the monitoring of a first computing unit 150 with regard to a reduction condition is initiated. This step is executed continuously, as indicated by the circular arrow at monitoring step 104. The reduction condition can, for example, be the result of a cyclic redundancy check over a defined area of ​​the display device 120. Alternatively, the reduction condition can be met if a limit value of a safety level calculated according to ASIL (Automotive Safety Integrity Level) or ISO 26262 is exceeded.

[0052] In a first generation step 106, graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are generated. These are, for example, geometric shapes such as circles, rectangles, lines, points, and the like, or shapes composed of these, which represent, for example, a road, a road sign, a hazard warning light, a speedometer, vehicle parts, or the like. The graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 can also be characters used to represent information such as speed, temperature, engine speed, time, or the like.

[0053] The graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are then displayed on a display device 120 in a first display step 112. A driver of the vehicle 160 is informed of important information via this display.

[0054] Furthermore, in a second generation step, 108 snapshots of the graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are generated at regular intervals (e.g., every 500 ms). A snapshot can simply correspond to a redundant copy of a graphic element 122, 124, 126, 128, 130, 132, 134, 136, 138 at a specific point in time. In the event of a malfunction of the first processing unit 150, these snapshots are used to display graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 without having to regenerate them.

[0055] Validation step 110 checks whether the reduction condition is met. In other words, it checks whether the first processing unit 150 correctly generates the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138. If the reduction condition is not met, meaning the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are correctly generated, then the first display step 112 can be executed as planned (f-branch in validation step 110).

[0056] However, if the reduction condition is met, the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are not correctly generated by the first processing unit 150 (t-branch at validation step 110). In this case, reduced graphical elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are generated in a third generation step 114.

[0057] The simplified graphical elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are based on the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138, as they contain the same information / input information (e.g., speed, fuel level, navigation instructions), but in a simplified or less complex representation. This can be achieved by adjusting both the generation frequency (e.g., every 2 seconds instead of every 0.1 seconds) and the representation itself (omitting complex graphics, replacing graphics with text).

[0058] In the example of Fig. 1. Some graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are at least partially replaced by the snapshots generated in the second generation step 108. For example, a graphical element 122, 124, 126, 128, 130, 132, 134, 136, 138, which displays a time as text with a clock as a symbol, can simply be replaced by the latest snapshot of this graphical element 122, 124, 126, 128, 130, 132, 134, 136, 138. To do this, it only needs to be read from a memory 146 instead of being generated by the second processing unit 158.

[0059] In a second display step 116, the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are now displayed on the display device 120 instead of their respective corresponding graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138. Ideally, a driver of the vehicle 160 will not notice the malfunction at all.

[0060] To rectify the malfunction of the first computing unit 150, the first computing unit 150 is restarted in a restart step 118. Once this has occurred, the first computing unit 150 can again assume the generation of the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138, which can then be displayed on the display device 120 in full complexity.

[0061] Fig. Figure 2 shows a display device 120 with an application example of the method 100 from Fig. 1.

[0062] In the example of Fig. 2a) A variety of graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are shown: A speed indicator 122 with text and animated geometric shapes (needle, scale), a speed limiter 124 with text elements, a tachometer 126, a time display 128, a gear indicator 130, a range indicator 132, a display 134 with general information such as fuel consumption, distance traveled and driving time, a navigation display 136 and a temperature display 138.

[0063] The respective graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are shown with a border which symbolizes how frequently the respective graphic element 122, 124, 126, 128, 130, 132, 134, 136, 138 is updated, i.e., how high the dynamics of the graphic element 122, 124, 126, 128, 130, 132, 134, 136, 138 is. A dotted line (see, for example, speed limit 124) correlates with high dynamics; the graphic element 122, 124, 126, 128, 130, 132, 134, 136, 138 is updated, i.e., regenerated for display, every 33 ms. A dashed line (see, for example, navigation display 136) correlates with lower dynamics; the graphic element 122, 124, 126, 128, 130, 132, 134, 136, 138 is updated, for example, every 500 ms.

[0064] Fig. 2b) The display device 120 now shows the following in the event of a malfunction, when the reduction condition has occurred. Reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are now displayed on the display device 120 instead of their respective corresponding graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138. The speed indicator 122' is now displayed only as text. This is far less complex to generate than the animated needle with the scale. However, the dynamics remain unchanged, as the speed indicator 122, 122' is highly critical for safety, since it is important for the driver to know the current speed of the vehicle 160. The speed limit 124' is displayed completely unchanged, as it already had a very simple representation.

[0065] The tachometer 126' was also reduced in its complex representation to purely textual displays. Furthermore, the tachometer 126,126' is not as safety-critical and therefore its dynamics are reduced; that is, the reduced graphic element 126' of the tachometer 126' is generated less frequently, for example, once per second (the semicolon outline symbolizes the reduced dynamics).

[0066] The time display (128') and the temperature display (138') have been replaced by the latest snapshots (symbolized by a dash-dot outline). They do not need to be regenerated for the time being, but only read from memory (146). The gear indicator (130') has been completely omitted (symbolized by a long dash-dot outline).

[0067] In the range display 132', the symbol was omitted, and only the text was retained. Display 134', containing general information, is identical in appearance, but its dynamic response has been reduced. Navigation display 136' remains unchanged; it is generated by the second processing unit 158 ​​in the same way as navigation display 136 by the first processing unit 150. The appearance and generation frequency of the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are thus adapted to the dynamic response and safety criticality of the respective graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138.

[0068] Fig. Figure 3 shows an embodiment of a device 140 for displaying graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 on a display device 120 of a vehicle 160.

[0069] The device 140 includes a system-on-a-chip (SoC) 142, i.e., an integrated circuit in which a multitude of functions of a programmable electronic system are implemented. The SoC 142, in turn, includes a processor 144, a memory 146, and a display output 148. The device also includes a display device 120.

[0070] In the example of Fig. In Figure 3, a first computing unit 150 is separated from a second computing unit 158 ​​on the processor 144 by a hypervisor. This separation, which can be important for the functionality of the procedure 100 to reduce its susceptibility to errors, can also be achieved in other ways. For example, the first computing unit 150 and the second computing unit 158 ​​could be implemented on different processors 144 or in different containers on the processor 144.

[0071] Furthermore, the SoC 142 has an image layer unit 152. The first processing unit 150 and the second processing unit 158 ​​each transmit the graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 or the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' to the image layer unit 152. In this process, graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 and the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are stored separately on different layers. Typically, individual graphic elements 122, 124, 126, 128, 130, 132, 134, 136, 138 or their reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are no longer stored, but rather an overall image composed of these elements. Each layer is assigned a priority.In normal operation, the layer on which the graphical elements 122, 124, 126, 128, 130, 132, 134, 136, 138 are stored has a higher priority than the layer on which the reduced graphical elements 122', 124', 126', 128', 130', 132', 134', 136', 138' are stored.

[0072] In a snapshot unit, 154 snapshots are generated from the graphic elements 122, 124, 126, 128, 130, 132, 134, 136, and 138, and then stored in memory 146. The graphic elements 122, 124, 126, 128, 130, 132, 134, 136, and 138 themselves are also stored in memory 146. The display output 148 can then read the graphic elements 122, 124, 126, 128, 130, 132, 134, 136, and 138 from memory and make them available to the display device 120 for display.

[0073] A checksum unit 156, implemented as a computer program on processor 144, calculates checksums across image areas of the overall image. The result is forwarded to the second processing unit 158, which, in addition to generating 114 of the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138', also monitors 104 of the first processing unit 150. If an incorrect checksum is determined by the checksum unit 156, the second processing unit 158 ​​initiates a restart of the first processing unit 150 after the layer priorities on the image layer unit 152 have been swapped.

[0074] If the priorities are reversed, the layer with the reduced graphic elements 122', 124', 126', 128', 130', 132', 134', 136', 138' and, if applicable, the snapshots are displayed on the display device 120. After the first processing unit 150 is restarted, the device can return to normal operation.

[0075] Fig. Figure 4 shows a vehicle 160 with the device made of Fig. 3. The display device 120 is designed as a display. However, it is also possible that the display device 120 corresponds, for example, to a head-up display. The SoC 142 is installed in the instrument panel of the vehicle 160 and is therefore shown with a dashed outline. Reference symbol list 100 procedures 102 Startup Steps 104 Monitoring step 106 First generation step (gr. elements, 1st computing unit) 108 Second generation step (snapshots) 110 Validation step (of the monitoring, is there an error?) 112 First display step (no error) 114 Third generation step (reducing large elements, 2nd processing unit in case of error) 116 Second display step 118 Restart Step 120 Display device 122 First graphic element 122' First reduced graphic element 124 Second graphic element 124' Second reduced graphic element 126 Third graphic element 126' Third reduced graphic element 128 Fourth graphic element 128' Fourth reduced graphic element 130 Fifth graphic element 130' Fifth reduced graphic element 132 Sixth graphic element 132' Sixth reduced graphic element 134 Seventh graphic element 134' Seventh reduced graphic element 136 Eighth graphic element 136' Eighth reduced graphic element 138 Ninth graphic element 138' Ninth reduced graphic element 140 Device 142 System-on-a-Chip 144 processor 146 storage 148 Display output 150 First computing unit 152 image layer unit 154 Momentary Unit 156 checksum units 158 Second computing unit 160 vehicles

Claims

[1] Computer-implemented method (100) for displaying graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) on a display device (120) of a vehicle (160), wherein the graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) are assigned a safety criticality and a dynamic, wherein the method (100) comprises the following steps: a) Monitoring (104) a first computing unit (150) with respect to a reduction condition, b) Generating (106) the graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) by the first computing unit (150) and displaying (112) the graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) on the display device (120), c) Generating (114) at least one reduced graphic element (122', 124', 126', 128', 130', 132', 134', 136', 138') by a second computing unit (158), wherein each reduced graphic element (122', 124', 126', 128', 130', 132', 134', 136', 138') is associated with a graphic element (122, 124, 126, 128, 130, 132, 134, 136, 138), wherein a representation of a reduced graphic element (122', 124', 126', 128', 130', 132', 134', 136', 138') is based on the safety criticality and dynamics of the graphic element assigned to it (122, 124, 126, 128, 130, 132, 134, 136, 138), and upon fulfillment of the reduction condition, d) Display (116) of the reduced graphic elements (122', 124', 126', 128', 130', 132', 134', 136', 138') instead of their associated graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) on the display device (120), wherein a snapshot of graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) with low dynamic range is generated and the reduced graphic element (122', 124', 126', 128', 130', 132', 134', 136', 138') corresponds to the snapshot, where a low dynamic range means that the graphic element (122, 124, 126, 128, 130, 132, 134, 136, 138) is generated at most every 500ms. [2] Method according to claim 1, characterized in that for graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) with a high safety criticality, the reduced graphic element (122', 124', 126', 128', 130', 132', 134', 136', 138`) corresponds to the graphic element (122, 124, 126, 128, 130, 132, 134, 136, 138). [3] Method according to claim 1 or 2, characterized in that the display (116) of the reduced graphic elements (122', 124', 126', 128', 130', 132', 134', 136', 138') generated by the second computing unit (158) is carried out until a restart of the first computing unit (150). [4] Method according to one of the preceding claims, characterized in that the reduction condition corresponds to a security level, a readability, a checksum over an image area or a correctness of an image area. [5] Computer program product comprising instructions which, when the program is executed by a computer, cause it to execute a method (100) according to any of the preceding claims [6] Computer-readable storage medium (146) comprising instructions which, when the program is executed by a computer, cause it to execute a method (100) according to any one of claims 1 to 4. [7] Data carrier signal which transmits the computer program product according to claim 5. [8] Device (140) for displaying graphic elements (122, 124, 126, 128, 130, 132, 134, 136, 138) on a display device (120) of a vehicle (160), comprising: a) A first computing unit (150) which is designed to generate graphical elements (122, 124, 126, 128, 130, 132, 134, 136, 138), b) A second computing unit (158) which is designed to generate reduced graphical elements (122', 124', 126', 128', 130', 132', 134', 136', 138'), c) A display output (148) which is communicatively connected to the first computing unit (150) and the second computing unit (158), and d) A display device (120) which is communicatively connected to the display output (148), wherein the device (140) is configured to perform a method (100) according to any one of claims 1 to 4. [9] Device according to claim 8, characterized in that the first computing unit (150) and the second computing unit (158) are implemented within a computing system with a hypervisor. [10] Device according to claim 8 or 9, characterized in that the first computing unit (150) and the second computing unit (158) are implemented on different processors (144) within a computing system. [11] Device according to one of claims 8 to 10, characterized in that at least a first graphics layer and a second graphics layer are made available to the display output (148), wherein the first graphics layer is made available by the first computing unit (150) and is assigned a high priority before the reduction condition occurs, wherein the second graphics layer is made available by the second computing unit (158) and is assigned a low priority before the reduction condition occurs, wherein, upon the occurrence of the reduction condition, a low priority is assigned to the first graphics layer and a high priority is assigned to the second graphics layer, wherein the display output (148) makes the graphics layer with high priority available to the display device (120) for display. [12] Device according to one of claims 8 to 11, characterized in that the first computing unit (150) is assigned to the display output (148) until the reduction condition occurs and the second computing unit (158) is assigned to the display output (148) when the reduction condition occurs. [13] Device according to one of claims 8 to 12, characterized in that the monitoring (104) of the first computing unit (150) with respect to the reduction condition is realized by means of at least one of the following possibilities: a) Monitoring of a computer program executed on the first computing unit (150) with a third computing unit, wherein the third computing unit is implemented in a computing system with the first computing unit (150) and the second computing unit (158), b) Monitoring of a computer program executed on the first computing unit (150) with a fourth computing unit, wherein the fourth computing unit is not implemented in a computing system with the first computing unit (150) and the second computing unit (158), c) Monitoring of a display area with a fifth computing unit, wherein the fifth computing unit is implemented with the first computing unit (150) and the second computing unit (158) in a computing system. [14] Vehicle (160) comprising a device (140) according to any one of claims 8 to 13.

Images