DE102014014858A1 - Control device for a motor vehicle, motor vehicle and method for safely performing a function - Google Patents

Abstract

Control unit (1) for a motor vehicle (6), designed to execute at least one sensor data at least one sensor (2) evaluating, in particular safety-relevant function, comprising at least one first, at least one safety criterion corresponding computing unit (5a, 5b), wherein the control unit (1 ) Furthermore, at least one second, not the safety criterion corresponding computing unit (4) which is more powerful than the first arithmetic unit (5a, 5b), wherein the second arithmetic unit (4) is designed to determine result data of the function by evaluating the sensor data and the first arithmetic unit (5a, 5b) is designed to validate the result data of the second arithmetic unit (4).

Description

The invention relates to a control unit for a motor vehicle, designed to carry out at least one sensor data of at least one sensor evaluating, in particular safety-relevant function, comprising at least one first, at least one safety criterion corresponding computing unit. In addition, the invention relates to a motor vehicle and a method for safely performing a performing at least one sensor data of at least one sensor evaluating, in particular safety-related function of a vehicle system of a motor vehicle in a control unit.

Driver assistance systems, safety systems and other vehicle systems for motor vehicles are now common and well known. Such vehicle systems generally realize certain functions to be provided by the vehicle system. Many of these functions, in particular functions of security systems and / or functions that control the execution of driver interventions, are to be regarded as more critical, since the errors could pose a security risk. If, for example, an object is not detected or incorrectly evaluated by a driver autonomously leading the motor vehicle partially autonomously and / or fully autonomously, a driving maneuver involving a collision with the object may occur.

It is therefore intended to evaluate functions of vehicle systems according to their safety relevance or the safety requirements and to implement corresponding additional safety measures at the hardware and software levels. Correspondingly, standards have been developed which make it possible, on the one hand, to classify risks or, more generally, the safety relevance, and on the other hand to define safeguards in order to avoid errors leading to safety problems. The norm to be taken into account in motor vehicles in this context is the ISO 26262 , which also defines the "Automotive Safety Integrity Level" (ASIL). ASIL is a risk classification scheme that is supported by ISO 26262 and essentially assesses the possibility and severity of injuries in the event of an error, but also takes into account the relative likelihood that a common driver can avoid the injuries.

In this case, typical security measures are the redundant calculation, additional verification algorithms and the like. Thus, a computing unit of a control unit of a motor vehicle that is to perform a function of a vehicle system, for example by ISO 26262 can fulfill defined security criteria, therefore, the function is realized in accordance with the safety standard, not only modifications in the software, and thus in particular the algorithms required, but it is in many cases, a specific hardware configuration of the computing units, which may be realized as a controller, for example necessary to perform the appropriate validation routines. For example, there are computation units which are embodied as multi-core processors, in which explicitly the hardware already provides for carrying out calculations redundantly and in parallel on several cores and then combining them in a comparative manner. Other hardware developments of computing units in order to meet safety requirements and safety criteria have already been described. For example, micro-controllers have already become known as arithmetic units, the one ISO 26262 safety certificate exhibit. In addition to these hardware adjustments to meet security criteria, special software development processes for such functional implementations must be adhered to.

The problem here is that security criteria fulfilling computing units, especially micro-controllers, are not available in all power levels, as is lost by the additional realization or enabling hedge routines basically performance. For example, there are no micro-controllers with more than 500 MHz clock frequency that complies with safety standards ISO 26262 fulfill. Powerful computing units, such as graphics processors (GPU), although have a significantly higher performance (computing power), but do not meet security criteria. This makes it difficult in the realization of safety-related functions to provide the required computing power available, especially if an execution in real time is needed. Conceivable, but complex and costly solutions are the use of multiple, compliant with safety criteria computing units or the implementation of safety-related functions on multiple ECUs.

Also with regard to the software components, in particular the algorithms, for security-related functions, there are difficulties, because the entire software as well ISO 26262 is developed and must therefore meet higher process standards. This requires a lengthy and costly implementation.

The invention is therefore based on the object, a control unit for performing safety-related functions that at least one Security requirement must specify, which is feasible despite lower security requirements, despite compliance with safety requirements.

To solve this problem is provided according to the invention in a control device of the type mentioned that the control unit further at least a second, not the safety criterion corresponding computing unit, which is more powerful than the first arithmetic unit, wherein the second arithmetic unit for determining result data of the function by Evaluation of sensor data is formed and the first arithmetic unit is designed to validate the result data of the second arithmetic unit.

Thus, the invention provides for a partial use of non-compliance with the safety criteria components, thus a partially non-specific safety criteria corresponding structure of a control unit, but such that for the function to be performed as a whole, the safety requirements are met. The controller architecture described here can thus represent safety-relevant functions that must meet certain safety requirements, but can also be implemented with high safety requirements for non-safety components (QM classification according to ASIL). This is based on the finding that many evaluations of sensor data contain partial evaluations which are carried out to check possibilities for which ultimately the operating strategy to be chosen, ie the result of the evaluation of the sensor data, is no longer relevant. It is therefore sufficient to check the result so that portions of the evaluation no longer affected by the result data are no longer relevant for the validation, so that this can be carried out with a reduced outlay. The core of the invention is therefore a two-stage calculation: The overarching problem of the complex interpretation of the sensor data, in particular an environment interpretation, is solved by components, in particular a computing unit, which does not have to comply with the normally necessary safety criteria and is therefore more efficient. However, securing the solution is ensured by conventional components that meet safety criteria, such as ASIL components. In this way, the invention combines, so to speak, the best of both worlds: The performance of non-safety components with the reliability of safety components.

The safety criterion may concern the fulfillment of a safety standard. For example, it can be provided that the first arithmetic unit ASIL A or higher according to ISO 26262 (at the time of filing this patent application) depending on the function fulfilled and the second arithmetic unit as a QM arithmetic unit according to ISO 26262 (at the time of filing this patent application) is formed. For example, is it a function that has to meet very high security requirements, such as ASIL D is fully sufficient, if the first arithmetic unit to fulfill ASIL D is formed, while in the second arithmetic unit typical QM components can be used without meeting the security criterion or for the function of the security requirement.

Of course, these general statements for the fulfillment of security criteria can also be transferred to the existing software components that use the arithmetic unit. Thus, preferably, the software corresponding to the and / or a further security criterion on the first arithmetic unit and / or software which does not correspond to the or the further security criterion can be executed on the second arithmetic unit. Consequently, the software is expediently divided as it were into a non-security-relevant portion and a security-relevant portion of the overall architecture, which ultimately decides at runtime on the basis of the current results data for which portions of the evaluation, the fulfillment of the security criteria must be established.

The evaluation can be subdivided into partial results that can be assigned to certain result data, wherein the first calculation unit is designed to perform only the partial evaluations that do not include the entire evaluation and that are assigned to the current result data. In the example of an environment interpretation, such sub-tasks can be represented, for example, in a parallelization of different subtasks of the environment interpretation per se, as can be realized, for example, on graphical processors (GPU) and other computation units that do not fulfill the safety criteria. For example, a plurality of environment objects may be calculated on corresponding parallelized cores. Not all of these objects and thus partial evaluations are relevant for the operating strategy ultimately resulting in the function, so that ultimately the "review room" for validation can be severely restricted and thus less computational power is required in the safety-critical part of performing the function.

Accordingly, it can also be provided that the first arithmetic unit for validation of the result data is used with the use of a reduced set of Sensor data as input data and / or a reduced compared to the second processing unit set of algorithms is formed. In the example just mentioned, which is selected by the function of a specific operating strategy from a plurality of fundamentally possible operating strategies, for example a specific trajectory to be traveled in the example of the environment interpretation, it can be said that the second arithmetic unit for selecting an operating strategy to be used from a plurality possible operating strategies is formed and the first arithmetic unit is designed to use only related to the selected operating strategy sensor data as input data and / or algorithms. In one example, if the function relates to a security system which determines an evasion trajectory on the basis of environmental data as sensor data as operating strategy, ultimately only the first computing unit is to validate all that concerns this evasion trajectory. If, for example, it has been established that a group of pedestrians is located at a completely different position, which is not affected by the trajectory, sub-evaluations or algorithms / sensor data related to this pedestrian group become relevant only if it is determined during the validation, thus checking the evasion trajectory that the pedestrian group is in fact in the area of avoidance trajectory; otherwise, a new calculation / validation in this regard is not necessary and does not occur.

It should be noted at this point generally that processors can be used as arithmetic units, in particular at least two processors cores comprehensive processors. Such processors used for controllers are often designed as so-called micro-controller. Especially with regard to the realization of the at least one second arithmetic unit, it makes sense to use high-performance arithmetic units, for example, graphic processors (GPU), which allow parallelized, effective calculations. Security units fulfilling computing units or processors are also already known and can be used as the first computing unit, in particular for the security standard used and the criterion to be met as a safety criterion, for example ASIL classification, certified products.

As already mentioned, the present invention can be used particularly advantageously if the second arithmetic unit is designed for a situation analysis, in particular an environment interpretation, on the basis of which, in particular, sensor data from environmental sensors comprises comprehensive sensor data. Precisely with regard to the interpretation of the environment, it is necessary to carry out many extremely complex calculations which are not always necessarily relevant to the result described by the result data, but which were necessary in order to explore the possibilities which exist for the further operation of the motor vehicle. In the context of the validation, the number of calculations and thus the effort is reduced to the relevant for the result data share, so that, for example, lying outside of a selected trajectory areas, in front of an object is braked, lying further objects and the like to fulfill the Security requirements for the function no longer need to be hedged.

In particular, the function may expediently be a function of a fully autonomous vehicle system directed to a completely autonomous operation of the motor vehicle. Especially in this context, the efficiency provided by the invention is extremely helpful in maintaining the security requirements for the function. However, partially autonomous functions are also conceivable, for example functions related to longitudinal guidance (brake assist) or even functions engaging in certain safety-critical situations (evasion assistant and the like).

In addition to the control unit, the present invention also relates to a motor vehicle, comprising at least one control unit according to the invention. All statements regarding the control device according to the invention can be analogously transferred to the motor vehicle according to the invention, with which also the advantages already mentioned can be obtained. In particular, a plurality of control devices according to the invention, which implement the described advantageous architecture, can be used in a motor vehicle.

Finally, the invention also relates to a method for the secure execution of an at least one sensor sensor of at least one sensor evaluating, in particular safety-relevant function of a vehicle system of a motor vehicle in a control unit, comprising at least a first, at least one safety criterion corresponding computing unit and at least one second, not the safety criterion corresponding arithmetic unit, which is more powerful than the first arithmetic unit, wherein the second arithmetic unit for determining result data of the function by evaluating the sensor data and the first arithmetic unit for validating the result data of the second arithmetic unit is used. It is also true for the method according to the invention that the statements relating to the control unit according to the invention can be transmitted analogously.

Further advantages and details of the present invention will become apparent from the The following described embodiments and with reference to the drawing. Showing:

1 a schematic diagram of a control device according to the invention,

2 a flowchart of an embodiment of the method according to the invention, and

3 a traffic situation.

1 shows in the form of a schematic diagram of an embodiment of a control device according to the invention 1 , With the control unit 1 a function of a vehicle system is to be realized, which after the ISO 26262 standard (at the time of the patent application) was classified as safety relevant, for example as ASIL D , This means that the realization of the function must meet certain safety requirements. The function evaluates sensor data from sensors 2 , For example, environment sensors, from, in the present embodiment, to perform a situation analysis, concretely an environment interpretation, and to choose a suitable operating strategy for the removal of a safety-critical situation. Consequently, the control unit receives at least the sensor data of the sensors as input data for the function 2 supplied, wherein further input data and / or other information about a vehicle bus of the motor vehicle, in which the control unit 1 used, can be exchanged, as is generally known. It should be noted that even cases are conceivable in which sensors 2 within the controller 1 can be located.

Inside the controller 1 , ie within the housing, in the present case are three arithmetic units realized as microcontrollers 4 . 5a . 5b provided, wherein first arithmetic units 5a and 5b in each case a safety criterion, for example the one required here ASIL D standard , fulfill. The second arithmetic unit 4 However, it does not meet any special security criteria, so it can be used as a QM arithmetic unit in the sense of ISO 26262 (at the time of the patent application).

It is now provided, the environment interpretation and the selection of an operating strategy completely on the second processing unit 4 perform. That means the arithmetic unit 4 considers all sensor data (and possibly other input data) necessary for the function, using the most powerful components that appear necessary for the function, without having to compromise on performance and real-time capability. The complex environment interpretation is therefore by the arithmetic unit 4 performed quickly and effectively and result data are calculated, the entire investigation, including the software used, does not meet security criteria, in particular not the security criteria ISO 26262 ,

The first computing units 5a and 5b are used by the second processor 4 to validate the delivered results data. Essential here is that, although the first arithmetic units 5a and 5b less powerful than the second processor 4 However, the result data only relate to a part of the sensor data and the algorithms used, and therefore only to partial evaluations of the entire evaluation of the sensor data, which is provided by the second arithmetic unit 4 is carried out. Therefore, not all the algorithms have to be recalculated taking into account the safety criteria, but the validation of the result data is carried out by omitting information and calculation processes which are not relevant for the result data, with a significantly reduced computation effort.

After the computing units used in the validation 5a and 5b and the software running on it complies with the safety criteria, fulfills the function provided by the control unit 1 provided, but overall the security requirements.

In other words, it can be said that the total calculation for the realization of the function takes place in two stages, as described in the flowchart of FIG 2 is indicated. In a step S1, without the observance of security criteria, the environment interpretation is carried out completely and effectively in order to obtain the result data. For this purpose, in step S2, which relates to the validation of the result data obtained in step S1, all safety criteria are taken into account by the first calculation units 5a . 5b with software that meets the security criteria. However, only the portion relevant for the result data has to be checked / recalculated, so that the computational effort is significantly reduced and the lower performance of the first arithmetic units adapted in their hardware to the security criteria 5a . 5b clearly less significant.

3 explains the method according to the invention even more precisely on the basis of a traffic situation. There is an inventive, thus with a control device according to the invention 1 equipped motor vehicle 6 with it, on another motor vehicle 7 to open up, which is not in motion. A third motor vehicle 8th drives behind the motor vehicle 1 ago. On a sidewalk to the right of the road are pedestrians 9 in larger numbers on the way.

A situation analysis, thus the environmental interpretation, is highly complex in this case, but can be due to the use of the second arithmetic unit 4 and corresponding non-safety-critical software can be performed extremely quickly and effectively. From this environment interpretation it is recognized that different operating strategies of the motor vehicle 6 are not possible. The by the arrow 10 indicated emergency braking is not possible because of the third vehicle 8th seam. An evasive action would be a conceivable reaction to the situation, although not to the right in the pedestrian 9 may be directed, cf. arrow 11 , Thus, as a safe driving maneuver in the result data is a dodge according to the arrow 12 on the left lane 13 determined as a solution. Thanks to the use of calculation environment created without consideration of safety criteria (second processing unit 4 , appropriate software), the high computing power is provided in real time.

The decision made here "Dodge to the left", arrow 12 , requires for validation, by the first calculation units fulfilling the security criteria 5a . 5b As well as corresponding security criteria fulfilling software is performed, a far smaller number of premises, because it only has to be determined whether the left lane 13 is actually free and whether the trajectory past the other motor vehicle 7 was calculated correctly. The pedestrians 9 as well as the third motor vehicle 8th sensor data, algorithms and / or sub-evaluations concerned need not be used in the validation. Thus, the validation is also due to the security components, that is, the first arithmetic units meeting the security criteria 5a . 5b as well as fulfilling the security criterion, there running software easily realizable in real time.

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• ISO 26262 [0003]
• ISO 26262 [0003]
• ISO 26262 [0004]
• ISO 26262 safety certificate [0004]
• ISO 26262 [0005]
• ISO 26262 [0006]
• ASIL A [0010]
• ISO 26262 [0010]
• ISO 26262 [0010]
• ASIL D [0010]
• ASIL D [0010]
• ISO 26262 standard [0023]
• ASIL D [0023]
• ASIL D standard [0024]
• ISO 26262 [0024]
• ISO 26262 [0025]

Claims (10)

Control unit ( 1 ) for a motor vehicle ( 6 ) configured to execute at least one sensor data at least one sensor ( 2 ) evaluating, in particular safety-relevant function, comprising at least one first, at least one safety criterion corresponding computing unit ( 5a . 5b ), characterized in that the control unit ( 1 ) at least one second, not the safety criterion corresponding computing unit ( 4 ), which are more powerful than the first processor ( 5a . 5b ), wherein the second arithmetic unit ( 4 ) for determining result data of the function by evaluation of the sensor data is formed and the first arithmetic unit ( 5a . 5b ) for the validation of the result data of the second arithmetic unit ( 4 ) is trained. Control unit according to claim 1, characterized in that the safety criterion relates to the fulfillment of a safety standard. Control device according to claim 1 or 2, characterized in that on the first arithmetic unit ( 5a . 5b ) a corresponding to the and / or another security criterion software and on the second processing unit ( 4 ) a not the or the further safety criterion corresponding software is executed. Control unit according to one of the preceding claims, characterized in that the evaluation in certain result data assignable partial evaluations can be divided, wherein the first arithmetic unit ( 5a . 5b ) is formed during the validation only for carrying out the partial evaluations which do not include the entire evaluation and which are assigned to the current result data. Control unit according to one of the preceding claims, characterized in that the first arithmetic unit ( 5a . 5b ) for validating the result data using a comparison with the second processing unit ( 4 ) reduced set of sensor data as input data and / or one compared to the second arithmetic unit ( 4 ) reduced set of algorithms is formed. Method according to Claim 4, characterized in that the second arithmetic unit ( 4 ) is configured to select an operating strategy to be used from a plurality of possible operating strategies, and the first arithmetic unit ( 5a . 5b ) is designed as input data and / or algorithms for the use of sensor data related only to the selected operating strategy. Method according to one of the preceding claims, characterized in that the function corresponds to a completely autonomous operation of the motor vehicle ( 6 ) directed function of a fully autonomous vehicle system. Control unit according to one of the preceding claims, characterized in that the second arithmetic unit ( 4 ) is designed for a situation analysis based on the particular sensor data from environment sensors comprehensive sensor data. Motor vehicle ( 6 ), comprising at least one control device ( 1 ) according to one of the preceding claims. Method for reliably performing at least one sensor, in particular a safety-relevant function of a vehicle system of a motor vehicle in a control unit, having at least one first, at least one safety criterion corresponding computing unit and at least one second, not the safety criterion corresponding computing unit, the more efficient than the first arithmetic unit is, wherein the second arithmetic unit for determining result data of the function by evaluating the sensor data and the first arithmetic unit for validating the result data of the second arithmetic unit is used.

Images