Control device and method for testing and / or updating a program element of a vehicle function

Abstract

The present invention relates to a control device and method for testing and / or updating a program element of a vehicle function. The control device comprises two partitions wherein the first partition is designed to operate a control program for controlling at least one vehicle function and the second partition is designed to operate a test program to test and / or update at least one program element of a vehicle function. The control program comprises a program interface designed to integrate and run at least one machine learning algorithm and to calculate features of said machine learning algorithm. The second partition further comprises a data collection algorithm which uses as input at least a subset of the features calculated by the control program for collecting new data

Description

[0001] Description

[0002] Control device and method for testing and / or updating a program element of a vehicle function.

[0003] The invention relates to a control device for a vehicle, to a method for testing and / or updating a program element of a vehicle function and to a motor vehicle with such control device.

[0004] Software play an important role in modern vehicles, solving various and complexed tasks. Modern vehicles comprise sophisticated architecture, wherein a control device hosts at least one software (also known as control program) to control at least one function of a vehicle. A control program may control safety relevant vehicle functions, such as for example the braking system of a vehicle. To guarantee the vehicle’s safety, the control program must then be continuously verified, tested and kept up-to-date by using real data and conditions. However, the environment in which the vehicle operates changes frequently. For this reason, it is important to both collect new training data to update the control program, and to test it in new situations.

[0005] The collection of new data has a particular relevance in machine learning algorithms. Nowadays several control programs in vehicles involve the use of machine learning algorithms. As it is known a machine learning algorithm maps a set of data inputs to a prediction. In order to do this, the machine learning algorithm must be trained. The training can be supervised or unsupervised.

[0006] During supervised learning a machine learning model is trained with annotated (labeled) data sets: this allows the models to learn mappings from a defined set of inputs to a defined set of outputs. The data are usually annotated by a human. During unsupervised learning a machine learning algorithm tries to analyze unlabeled datasets and discover hidden patterns in the datasets without the need for human intervention.

[0007] Once that the machine learning algorithms are trained (whether supervised or unsupervised) they are able to take input data, for example vehicle sensors data, and extract features from them. Those features are stored in tensors and contains several information about the input data, like for example colors, dimensions, forms, positions, distance from other objects and so on. Those features are further used by the machine learning algorithms to make inference on the input data. Inference is the process of calculating output (“drawing conclusions”) with respect to the input data.

[0008] Machine learning algorithms perform reasonably well when input sample is drawn from training distribution but exhibit a poor performance on samples outside the training distribution.

[0009] By collecting new data, it is possible then to extend the training distribution and to retrain the machine learning algorithms: in this way the machine learning algorithm will be able to learn new scenarios.

[0010] If new input data became available, the machine learning algorithms can be tested and / or updated by re-training them with those new data.

[0011] In general, when testing and / or updating machine learning algorithms, software or applications, it should be kept in mind that the system on which the tests or updates are performed, must not be changed, disturbed or damaged in any way during the testing and / or updating. This applies especially to the automotive field, where safety plays a critical role and any interference could have potentially disastrous consequences.

[0012] For this reason, control devices in modern vehicles mostly comprise two partitions: a partition where the regular applications for the control functions of the vehicle are run and a partition, also known as Sandbox or protected area partition, where the said regular applications can be tested and updated. A partition is to be understood as part of a suitable physical or logical volatile or non-volatile memory and compute device (CPU, GPU etc). The second partition (protected area partition) usually contains microcontroller and microprocessor-based electronic control units (ECUs). Those ECUs allows software, programs, algorithms, and services to operate passively, without having effects or influencing or compromising the control program running on the first partition. For this reason, the second partition must have a "Freedom from interference" with respect to the rest of the system. The second partition has therefore usually restricted rights, in particular read only rights, with respect to the first partition. This means that the second portion can read the data of the first partition but cannot apply modifications on them within the first partition.

[0013] Such a system is described in DE102020110271 . The document describes a controller for a vehicle having a first partition, comprising a control program, and a second partition, comprising a test environment. The control program to be tested runs in the test environment, the second partition, as well in parallel to the first partition. The test program has access to the exact same information / data as the first partition; and it can so test those information / data in nearly real time.

[0014] A disadvantage of the known state of the art is that the control program and in particular the machine learning algorithm present in the control program needs to be duplicated in the test program in the second partition. This means the calculations, in particular the feature extraction, that have been already performed in the first partition must be repeated on the second partition as well. This is computational expensive and redundant.

[0015] The present invention overcomes the disadvantage of the known state of the art with a control device according to claim 1 and a method according to claim 10. The present invention discloses a control device for a vehicle comprising a computer device having at least two partitions, wherein the first partition is designed to operate a control program for controlling at least one vehicle function and the second partition is designed to operate a test program to test and / or update at least one program element of a vehicle function. Further the control program has a program interface designed to integrate and run at least one machine learning algorithm and to calculate features of said machine learning algorithm. The second partition further comprises a data collection algorithm, which uses as input at least a subset of the features calculated by the control program for collecting new data.

[0016] By transferring at least, a subset of intermediate features of the control program from the first partition to the second partition, it is then avoided that the calculation already operated in the control program in the first partition is repeated in the second partition.

[0017] The present invention has several advantages with respect to the state of the art. Because the test program in the second partition do not need to repeat all the computational steps which already took place in the control program in the first partition, the compute resources of the second partition are not outspent on said calculation and can be used for other tasks. Those tasks could be run in parallel, bringing a higher computational efficiency.

[0018] Another advantage is that one could use algorithms which use a large amount of computational resources in the first partition and still keep the computational resources requirement in the second partition small. This means, it would be possible to use sophisticated and complex software / control programs in the first partition and use their results in the second partition without the need to use sophisticated and complex software / control programs in the second partition too. In this way the computational resource requirements in the second partition can be kept smaller, as well as the computational efficiency of the algorithm on the second partition can be maintained high as they are based on features calculated by the software / control programs in the first partition. Further the limited resource requirement on second partition could allow using more sophisticated or resource hungry testing / or update methods.

[0019] It is important to stress that although at least a subset of features calculated by the control program in the first partition is transferred to the second partition, the “freedom from interference” between the first and the second partition is kept intact. The first partition communicates with the second partition by means of known parallel computing techniques, such as for example remote direct memory access (RDMA) or shared memory.

[0020] The known parallel computing techniques allow a device to access the memory of another computer without changing, disturbing or damaging it. This clearly complies with the requirements of “freedom from interference”, as it guarantees the independence of the first partition from the second partition.

[0021] In a preferred embodiment, the features, that the machine learning algorithm present in the control program calculates, are stored in a tensor. The features contain several information about the input data, like for example pixels, colors, dimensions, forms, positions, distance from other objects and so on.

[0022] The subset of the calculated features are sent to a data collection algorithm also known as in-situ intelligent data collection algorithm, which is located in the second partition. This algorithm analyses in real time the data, especially the features, transmitted by the first partition to detect any samples containing novel and useful information. The data collection algorithm will then collect those data: such data may be used to improve the data available for corner case, anomaly detection and out of distribution objects.

[0023] Preferably the collected data can be used for retraining the machine learning model. Once that the machine learning model is retrained, it can handle such new scenarios, allowing a higher safety for the system.

[0024] In a preferred embodiment the test program comprises a program interface designed to receive the data collected by the collection algorithm and to calculate test data and / or update data based on the data collected by the data collection algorithm.

[0025] Preferably, the collection algorithm can be integrated in the test program present in the second partition, or it can be an independent program inside the second partition, optionally in communication with the test program and / or an external computing unit.

[0026] In a preferred embodiment the collection algorithm can be triggered by intelligent triggers or by at least one predetermined rule. In case of intelligent triggers, specific scenarios may be detected via a set of sensitivity-based information, which comprise out of distribution information. In the case of triggers based on at least one predetermined rule, an event detector may, for example, read in the data of the vehicle functions, and compare them with a predetermined condition or rule, which may, for example, comprise a threshold value. If one of the values of the data of the vehicle functions exceeds or falls below the predetermined threshold value, then the collection algorithm may be started. For example, the predetermined condition may be a maximal speed of the vehicle.

[0027] As a way of example, the trigger condition may be the presence of fog. If fog is detected, the event detector can start the control program element, which may comprises, for example, a program for object recognition from camera data of the vehicle camera, in order to check how well the algorithm of the program element recognizes objects in a foggy environment. The collected data determined in this way can then be sent to the test program of the second partition and / or via the communication device to an external computing unit for evaluation.

[0028] In another embodiment, the data collection algorithm will receive continuously at least a subset of calculated features directly from the machine learning algorithm present in the control program in the first partition without the need of a trigger event.

[0029] After receiving the features, the data collection algorithm analyses them and assigns an uncertainty score or anomaly score to each sample. The uncertainty score represents the degree of confidence of the machine learning model in its prediction. This score is calculated based on the machine learning model’s output using uncertainty quantification algorithm. Example of those algorithms are Monte Carlo Dropout, Deep Ensemble, Deep Bayesian Active Learning.

[0030] A sample may have a high uncertainty score if it was underrepresented in the training set, such that the model’s prediction on it is no longer reliable. This kind of uncertainty is known as epistem ic uncertainty. Another type of uncertainty is the aleatoric uncertainty: this type of uncertainty depends on the quality of the training data: training data with poor quality (for example too noisy) will result in a high uncertainty score of the model. Some features may present a high uncertainty score with respect to the other data and / or they may results out of distribution. If the uncertainty score is above a certain predefined threshold, then the data collection algorithm will collect such data.

[0031] In a preferred embodiment, the so collected data may be sent to a further computing unit for evaluation, such unit may be external to the vehicle. The external computing unit may be a cloud, a backend, a server or a data center. For this purpose, the collected data can be transmitted, for example, wirelessly to the external computing unit. The collected data may be pre-processed in the second partition, particularly in the test program, before being transmitted to the external computing unit. For example, the data may be transferred into a suitable format, which allows the further analysis of the collected data in the external computing unit, as well as simultaneously reducing the data stream required for the transfer.

[0032] In one embodiment the control device further comprises a wireless communication apparatus for providing a wireless communication link for the first and / or the second partition.

[0033] In a preferred embodiment the second partition is designed to provide the collected data and / or the test data and / or the updated data to the wireless communication apparatus for transmission to the external computing unit.

[0034] In the external computing unit the collected data would be further analyzed. The collected data may be for example analyzed by further machine learning algorithms. The data may be also clustered and / or entered in simulation programs. In one embodiment the data may be labelled by a human or in an unsupervised manner. The data processed in the external computing unit may then be sent back to the first partition and / or to the second partition.

[0035] In one embodiment the processed data may be sent back to the second partition. Preferably the test program present in the second partition will compute test and / or update data based on the processed data. The test and / or the updated data may be sent back to the external computing unit and preferably be used to update the control program present in the first partition, particularly the machine learning system present there.

[0036] In addition, or alternatively the test data and / or the processed data and / or the updated data may be used for updating the data collection algorithm itself. The present invention also discloses a motor vehicle according to claim 10.

[0037] Preferably the motor vehicle presents at least one sensor for sensing the environment around the vehicle and one or more vehicle functions. Examples of sensors are camera(s), LiDAR, RADAR, ultrasonic or a combination thereof. Example of vehicle functions are braking systems, light systems, steering systems, driving systems like automatic cruise control or lane changing system and so on.

[0038] The data from the vehicle sensors are then sent to the first partition, in particular to the control program present there. In one embodiment the data from the vehicle sensors may be fused together before being transmitted to the control program. The control program takes as input the data from the vehicle sensors and control according one or more vehicle functions.

[0039] Description of the figures.

[0040] Special embodiments of the present invention are described below.

[0041] Fig. 1 presents a schematic view of the motor vehicle and the external computing unit according to a preferred embodiment of the invention.

[0042] Fig. 2 presents a schematic view of the control device according to a preferred embodiment of the invention.

[0043] In Figure 1 the motor vehicle 100 is schematic represented.

[0044] The motor vehicle comprises at least one sensor 101 to detect the environment around the motor vehicle 100. The sensor 101 may be a video perception sensor like a camera. The vehicle sensor data would be two-dimensional images of the environment. In other embodiments of the present invention, the sensor 101 may be a three-dimensional sensor like a LiDAR and the sensor data be point cloud data. In yet another embodiment the sensor data maybe a combination of three- dimensional data and two-dimensional data.

[0045] The motor vehicle further comprises a control device 110. The control device comprises a first partition 111 and a second partition 112. The first partition receives as input the vehicle sensor data. The first partition comprises a control program for controlling a least a vehicle function 102. The control program usually comprises at least one machine learning algorithm.

[0046] The vehicle’s sensor data may be images containing objects like for example pedestrian, bicycles, traffic signs, traffic lights, other vehicles and so on, for which the machine learning present in the control program was trained. As a consequence, the control program can recognize the objects detected by the sensors and can control a function of the vehicle, like for example a lane change system , accordingly. For example, the control program may require the braking system to change lane for overtaking a second vehicle detected by the vehicle sensors.

[0047] The control device 110 further comprises a second partition 112. The second partition may be wireless linked to an external computing unit 105. The external computing unit may be a cloud or a data center. The external computing unit may comprise software and / or application to analyze data. For example, the external computing unit may comprise simulation programs and / or machine learning algorithms.

[0048] The second partition comprises a test program. The second partition further comprises a data collection algorithm. The data collection algorithm could be integrated in the test program or be a separate program in the second partition, optionally linked to the test program and / or the external computing unit. The data collection algorithm may be triggered by particular events or conditions.

[0049] The second partition may receive data from the vehicle sensors. In addition, or alternatively the second partition has a read only access to the data of a vehicle function. The first partition transmits by means of parallel computing techniques data, in particular features from the machine learning algorithm present in the first portion, to the second partition.

[0050] In Figure 2 the control device 110 is further explained. The first partition 200 and the second partition 300 both comprises CPU (201 , 301 ), dynamic random-access memory (202,302) and vector processor (203,303). The first partition further comprises a control program having an interface for running a machine learning program. The second partition comprises a test program. The second partition further comprises a data collection algorithm, which takes as input the output of the machine learning model in the first partition. The data collection algorithm may be integrated in the test program or be a separate program in connection with the test program. The data collection algorithm receives at least a subset of features by the control program. In one embodiment the subset of features may be optionally received by the test program as well.

[0051] The data collection algorithm will then start to analyze the features received, looking in particular for the uncertainty values. Data having uncertainty values over a predetermined threshold will be collected and eventually used for various tests and update inside the test program and / or inside the external computing unit. The test program may contain a copy of the machine learning model present in the control program of the first unit and may re-train it by using the data collected by the collection algorithm. The new re-trained data may be sent to the external unit for further analysis.

[0052] In another embodiment the data collected by the data collection algorithm can be sent to the external computing unit. The external computing unit may contain a copy of the collection algorithm and / or of the control program and may retrain and update them.

[0053] After the safety of the retrained model has been tested, the new model may be sent back to the first partition, in particular to the control program there in.

[0054] Additionally, an updated version of the collect algorithm may be sent back to the second partition.

[0055] In this way both programs may be updated.

[0056] An exemplary embodiment of the present invention will now be explained.

[0057] One or more cameras in the motor vehicle take images of the vehicle environment. The control program in the first partition comprises a machine learning algorithm for classifying traffic lights. The machine learning algorithm will then scan the raw images date for the object “traffic lights”. During this calculation the machine learning will calculate features relative to the object “traffic lights” for example color, form, position, state (red / green / orange) and so on. Those features are collected in tensors.

[0058] The data collection algorithm may continuously receive those features, or it may be triggered in special situation like for example when the vehicle is located near an intersection. In this case the trigger event is the position of the vehicle, which may be determined by GPS and / or localization methods and / or maps.

[0059] The data collection algorithm will then receive the features about the object “traffic lights” from the first partition by means of parallel computing techniques.

[0060] The data collection algorithm will then analyze the features by looking for high value of uncertainty and / or for out of distribution objects. Data in one or both those categories will be collected and sent to the test program in the second unit and / or to the external computing unit for further analysis. The collected data may be then further processed, for example labeled and / or clustered and used for retraining a copy of the machine learning model of the control program. Usually, such a copy is contained in the test program and / or in the external computing unit.

[0061] After testing the retrained copy of the machine learning model can be uploaded in the external computing unit and from there sent to the first partition for replacing the version of the control program present there.

[0062] Additionally, the data collection algorithm present in the second partition may be updated as well.

[0063] Various features, aspects, and embodiments have been described herein. The features, aspects, and embodiments are susceptible to combination with one another as well as to variation and modification, as will be understood by those having skill in the art.

Claims

CLAIMS1. Control device for a vehicle comprising:- a computer device (110) having at least two partitions (111 ,200, 112,300)- wherein the first partition (111 ,200) is designed to operate a control program (204) for controlling at least one vehicle function (102) and the second partition (112, 300) is designed to operate a test program to test and / or update at least one program element of a vehicle function (102)- wherein the control program (204) comprises a program interface designed to integrate and run at least one machine learning algorithm and to calculate features of said machine learning algorithm- wherein the second partition further comprises a data collection algorithm (304) which uses as input at least a subset of the features calculated by the control program for collecting new data2. Control device according to claim 1 , wherein the data collection algorithm (304) is integrated in the test program and / or communicates with the test program3. Control device according to claim 1 or 2, wherein the test program comprises a program interface designed to receive the data collected by the collection algorithm (304) and to calculate test data and / or update data based on the data collected by the data collection algorithm (304)4. Control device according to claim 3, wherein the test program tests and / or updates at least one program element of a vehicle function based on the data collected by the collection algorithm and / or on the test data and / or on the updated data5. Control device according to any of the previous claims, wherein the data collection algorithm is triggered by an intelligent trigger or by a predetermined rule6. Control device according to any of the previous claims, wherein the first partition and the second partition communicate by means of parallel computing techniques.

7. Control device according to any of the previous claims wherein the second partition has a read-only access to the first partition.

8. Control device according to any of the previous claims, further comprising a wireless communication apparatus for providing a wireless communication link for the second partition.

9. Control device according to claim 8, wherein test data and / or the update generated by the test program can be stored in the second partition, and wherein the second partition is designed to provide the test data and / or the updated data to the wireless communication apparatus for transmission to an external computing unit (105).

10. A method for testing and / or updating at least one program element, such method being adapt to run in a control device according to any of claims 1 to 9.11 . Motor vehicle having at least one sensors and a control device according to any of claims 1 to 9.

Images