DE102020215565A1 - Method for bringing a vehicle into a safe condition - Google Patents

Abstract

In a method for transferring a vehicle (9) to a safe state, the vehicle (9) is transferred to the safe state by an FPGA (2) arranged in the vehicle (9) in the event of a failure of a vehicle computing component (4.1, 4.2) performs emergency arithmetic operations.

Description

technical field

The invention relates to a method for bringing a vehicle into a safe state according to the preamble of claim 1. The invention also relates to a control device, a vehicle, a computer program and a computer-readable medium according to the independent claims.

State of the art

Modern vehicles (cars, vans, trucks, motorcycles, etc.) include a large number of systems that provide the driver with information and partially or fully automatically control individual vehicle functions. For example, data relating to the surroundings of the vehicles and other road users is recorded using various sensors. Based on the recorded data, a model of the vehicle environment can be generated and changes in this vehicle environment can be reacted to. Due to the progressive development in the field of autonomous and semi-autonomous vehicles, the influence and scope of such driver assistance systems (Advanced Driver Assistance Systems, ADAS) are increasing. Thanks to the development of ever more precise sensors, it is also possible to record the surroundings and the traffic better and to control individual functions of the vehicle completely or partially without the driver having to intervene. Driver assistance systems, including autonomous driving systems, can contribute to increasing traffic safety and improving driving comfort.

In the area of autonomous driving, especially for the SAE autonomy levels 3, 4 and 5, the safety requirements are typically very high and it is essential that functionality is guaranteed even in the event of a failure or partial failure of a technical vehicle system (we also speak of the so-called "Fail operational design").

A solution known from the prior art in cases where processor cores or SoCs (that stands for system on chip or in German "Ein-Chip-System") fails in whole or in part is to use a safety mechanism called "decomposition". , in which two processor cores or SoCs perform the same arithmetic operations and compare the results with each other to check whether the arithmetic operations are performed as desired. With this solution, however, the possible actions are limited in cases where problems are identified, especially if the SoCs or processor cores involved are physically the same and/or so-called "common cause" problems are present, i.e. failures due to common causes that affect both SoCs or equally affect processor cores.

The typical ways to solve these problems are usually complex and expensive, for example adding additional SoCs or processor cores to an electronic processing unit or connecting a fully redundant additional electronic control unit to a system.

General Description of the Invention

The object of the invention is to eliminate or at least reduce the disadvantages of the prior art.

The object is achieved by a method for bringing a vehicle into a safe state, the vehicle being brought into the safe state by an FPGA arranged in the vehicle carrying out emergency computing operations in the event of a failure of a vehicle computing component.

The term "vehicle" typically includes any type of vehicle, in particular motor vehicles such as cars, trucks, buses, motorcycles, military vehicles or agricultural vehicles.

A “safe state” is to be understood in particular as a state in which the vehicle cannot endanger the vehicle occupants or other road users. In particular, the “safe state” is to be understood as stopping the vehicle or driving the vehicle slowly, typically at a maximum of 15 km/h, preferably a maximum of 10 km/h, advantageously a maximum of 5 km/h.

The abbreviation "FPGA" stands for "Field Programmable Gate Array" or in German "in the field programmable logic gate array". FPGAs are used in various electronic computing units and are frequently used in autonomous driving applications in particular. In typical embodiments, the FPGA is part of a central vehicle controller.

A "failure" is understood to mean both a complete failure and a partial failure.

A “vehicle computing component” is to be understood in particular as a processor core or an SoC.

An “emergency arithmetic operation” is to be understood in particular as a arithmetic operation which is carried out as a backup to normal arithmetic operations, in particular typical arithmetic operations of processor cores or SoCs in vehicle controls.

The invention solves the above-mentioned problem in that an FPGA, which is available in many vehicle controllers anyway, is used to transfer the vehicle to the safe state. This results in resource savings.

In typical embodiments, the FPGA is transitioned from a normal mode to an emergency mode when the failure occurs. Such switching between a normal mode and an emergency mode has the advantage that the FPGA can perform typical functions of an FPGA, such as a gateway function, in the normal mode and is transferred to an emergency mode when the failure occurs. Such a separation between normal mode and emergency mode is advantageous because it entails a clear structuring of the tasks of the FPGA. In principle, however, it is also conceivable that the FPGA does not include different gateway modes, but rather is generally suitable for carrying out emergency computing operations in addition to gateway functions.

In typical embodiments, the FPGA works essentially exclusively as a gateway in normal mode and/or the FPGA carries out the emergency computing operations in emergency mode. In typical embodiments, the FPGA works in normal mode in particular as a communication gateway and mediates, for example, communication between vehicle buses such as CAN/CAN-FD, Ethernet, MIPI/CSI or other bus systems and internal components of a vehicle controller, for example a memory or different processor cores or SoCs. the switching is typically accomplished with the help of corresponding backbone translations, in particular according to the PCIe standard.

In typical embodiments, a reconfiguration function of the FPGA is performed to transition the FPGA from its normal mode to its emergency mode. Such a transfer of the FPGA from its normal mode to its emergency mode is advantageous because FPGAs typically include such reconfiguration functions and thus existing capabilities of the FPGA are used efficiently for the purposes of the invention. Alternatively, however, it would also be possible not to use a reconfiguration function already created in the FPGA, but to separately program the transition of the FPGA from its normal mode to its emergency mode. In typical embodiments, the reconfiguration function is performed in less than 10 milliseconds.

In typical embodiments, the emergency arithmetic operations lead to a safe standstill of the vehicle. A safe standstill of the vehicle is a particularly safe embodiment of the safe state, because such a state typically no longer poses a risk to vehicle occupants and/or general traffic. In particular, a “safe standstill” is to be understood as meaning a standstill that takes place in an area of a traffic infrastructure in which there are normally no means of transport, at least not quickly. Such areas can be hard shoulders, lay-bys, parking lots or the like. Alternatively, however, the emergency arithmetic operations can also lead to other safe conditions, such as slow travel.

In typical embodiments, the emergency computing operations include processing information from a sensor subgroup of the vehicle. A “sensor subgroup” is to be understood as meaning a group of vehicle sensors of a vehicle which, however, does not include all vehicle sensors of this vehicle. In typical embodiments, the sensor subgroup includes particularly important vehicle sensors, in particular those vehicle sensors that already supply object data and/or pre-processed data, but not raw data. In other words, in typical embodiments, the sensor subgroup exclusively includes sensors that are suitable for supplying object data and/or preprocessed data. Because only such object data and/or preprocessed data are used, the load on the FPGA during the emergency mode is kept small. This typically has a positive effect on reaching the safe state quickly. The sensor subgroup typically includes a radar sensor and/or a camera sensor, in particular a short-range radar sensor and/or a medium-range radar sensor and/or a front camera and/or a rear camera. As an alternative to this, however, it is also possible for the emergency computing operations to include processing of information from all of the vehicle's sensors.

In typical embodiments, the emergency computing operations include image processing and/or sensor data fusion and/or a route planning function and/or an emergency driver assistance system function and/or an emergency pilot function. "Image processing" is understood to mean the processing of data that is sent to the FPGA by the vehicle's camera sensors. A "sensor data fusion" is typically understood to mean a combination of data from different sensors. “Route planning” is to be understood in very general terms as a calculation of a route taken by the vehicle, in particular until the vehicle is safely at a standstill. An “emergency driver assistance system function” is to be understood as an arithmetic operation which maintains one or more driver assistance systems, in particular particularly safety-related driver assistance systems such as ABS, EPS, emergency braking or the like, and/or typically shuts down less safety-related driver assistance systems, for example by using resources of the FPGA and to essentially focus completely on reaching the safe state as quickly as possible. An “emergency pilot function” is to be understood as meaning a function which, for example, configures an autopilot function of the vehicle in such a way that the autopilot does everything it can to transfer the vehicle to the safe state as quickly and safely as possible. For example, the emergency pilot function can include safe braking and/or safe turning and/or a request for sensor data from the vehicle at certain intervals.

In typical embodiments, the transition of the FPGA from the normal mode to the emergency mode is accomplished in that when the failure is detected, an emergency mode configuration bit series is read from a memory and executed. In this case, the memory typically includes a normal mode configuration bit series and an emergency mode configuration bit series. Such a reading out of an emergency mode configuration bit series from a memory, in particular a memory of a central vehicle controller or an electronic processing unit in general, has the advantage that the emergency mode is reached in a standardized, fast and efficient manner.

In typical embodiments, the method includes a failure detection step, during which the failure of the vehicle computing component is detected, a reconfiguration step, during which the FPGA is switched from normal mode to emergency mode, a computing step, during which the FPGA performs the emergency computing operations , and a stopping step during which the vehicle is stopped. In typical embodiments, the failure of the vehicle computing component is detected by a watchdog, which is typically set up in the FPGA or in its periphery, receiving a warning message.

The object is also achieved by a control device comprising means for carrying out one of the aforementioned methods. Such a control device achieves the object according to the invention in that it efficiently transfers a vehicle to a safe state in the event of a failure of a vehicle computing component. In typical embodiments, the control device includes an FPGA or is an FPGA. In a typical embodiment, the control device comprises a vehicle controller or is a vehicle controller.

In typical embodiments, the controller includes an FPGA, a vehicle computing component, a memory, and a reconfiguration component, where the memory typically includes a normal mode configuration bit stream and/or an emergency mode configuration bit stream, where the reconfiguration component is appropriate to transfer the FPGA from a normal mode to an emergency mode in the event of a failure of the vehicle computing component, typically by loading the emergency mode configuration bit series from memory and executing it. The vehicle computing component typically includes a processor core or SoC, typically multiple processor cores or SoCs. In typical embodiments, the vehicle computing component is a processor core and/or an SoC.

In typical embodiments, the control device includes an image processing component and/or a sensor data fusion component and/or a route planning component and/or an emergency driver assistance system component and/or an emergency pilot component.

In typical embodiments, one or more of the aforementioned components and/or devices and/or systems is/are implemented at least in part using computer program code. In particular, in typical embodiments, the reconfiguration device and/or the image processing component and/or the sensor data fusion component and/or the route planning component and/or the emergency driver assistance system component and/or the emergency pilot component is/are implemented using computer program code.

The object is also achieved by a vehicle suitable for carrying out a method according to at least one of the aforementioned aspects guidlines, wherein the vehicle typically includes an aforementioned control device.

In one embodiment of the invention, a computer program comprises instructions which, when the computer program is executed by a computer, cause the latter to execute one of the aforementioned methods. The computer program can also be referred to as a computer program product.

In one embodiment of the invention, a computer-readable medium comprises computer program code for carrying out one of the aforementioned methods. The term “computer-readable medium” is to be understood in particular, but not exclusively, as hard drives and/or servers and/or memory sticks and/or flash memories and/or DVDs and/or Blu-rays and/or CDs. In addition, the term “computer-readable medium” also means a data stream, such as that created when a computer program and/or a computer program product is downloaded from the Internet.

• - Da ein FPGA in vielen Fahrzeugsteuerungen bereits vorhanden ist, wird keine zusätzliche Hardware benötigt.
• - Die Fehleranfälligkeit des Gesamtsystems kann so gering gehalten werden.
• - Es kann eine gute Kosteneffizienz erreicht werden.
• - Die Lösung ist eine besonders vorteilhafte Möglichkeit, ein Fail-Operational-Design zu erreichen.
• - Die notfallmässigen Rechenoperationen können sehr schnell eingeleitet werden, weil eine Rekonfiguration des FPGA typischerweise 10 Millisekunden bis 100 Millisekunden schneller ist, als es eine Aktivierung eines externen Geräts wäre.
• - Bei Steuergeräten, welche bereits einen FPGA als Gateway umfassen, ist keine bauliche Veränderung nötig.

With the help of the invention it is possible in particular to achieve one or more of the following advantages:

• - Since an FPGA is already present in many vehicle controls, no additional hardware is required.
• - The susceptibility to errors in the overall system can be kept to a minimum.
• - Good cost efficiency can be achieved.
• - The solution is a particularly advantageous way to achieve a fail-operational design.
• - The emergency computing operations can be initiated very quickly because a reconfiguration of the FPGA is typically 10 milliseconds to 100 milliseconds faster than activating an external device.
• - No structural changes are necessary for control units that already include an FPGA as a gateway.

character list

• 1: eine schematische Ansicht eines erfindungsgemässen Verfahrens zum Überführen eines Fahrzeugs in einen sicheren Zustand als Flussdiagramm,
• 2: eine schematische Ansicht einer erfindungsgemässen Steuervorrichtung als Blockdiagramm,
• 3: die Steuervorrichtung aus 2, umfassend einen FPGA in seinem Normalmodus,
• 4: die Steuervorrichtung aus 2, umfassend den FPGA in seinem Notmodus,
• 5: eine schematische Darstellung eines erfindungsgemässen Fahrzeugs mit erfindungsgemässer Steuervorrichtung, umfassend den FPGA in seinem Normalmodus, und
• 6: eine schematische Darstellung eines erfindungsgemässen Fahrzeugs mit erfindungsgemässer Steuervorrichtung, umfassend den FPGA in seinem Notmodus.

The invention is explained briefly below with reference to drawings, which show:

• 1 : a schematic view of a method according to the invention for transferring a vehicle into a safe state as a flowchart,
• 2 : a schematic view of a control device according to the invention as a block diagram,
• 3 : the control device off 2 , comprising an FPGA in its normal mode,
• 4 : the control device off 2 , comprising the FPGA in its emergency mode,
• 5 : a schematic representation of a vehicle according to the invention with a control device according to the invention, comprising the FPGA in its normal mode, and
• 6 1: a schematic representation of a vehicle according to the invention with a control device according to the invention, comprising the FPGA in its emergency mode.

Description of preferred embodiments

1 shows a schematic view of a method according to the invention for transferring a vehicle into a safe state as a flowchart. The method begins with a failure detection step S1, during which the failure of a vehicle computing component is detected. Such a detection can take place, for example, in that a monitoring device, for example a watchdog, registers in a vehicle controller that there is a failure of a vehicle computing component. The vehicle computing component can be a processor core or a SoC, for example. If such a failure was detected, then in a reconfiguration step S2 an FPGA of the vehicle is transferred from a normal mode to an emergency mode. This transition is typically accomplished by reading a failsafe mode configuration bitstream from memory, which is then executed to place the FPGA in its failsafe mode. This is followed by a computing step S3, during which the FPGA carries out the emergency computing operations. In 1 an image processing S5, a sensor data fusion S6, a route planning S7, an emergency driver assistance system function S8 and an emergency pilot function S9 are shown as part of the calculation step S3 as substeps of the calculation step S3. All of these arithmetic operations or sub-steps can be carried out as part of the arithmetic step S3. However, it is also possible that only one of these sub-steps or some of these sub-steps are carried out. In typical methods, a decision is made, for example based on an existing error type and/or a current vehicle status, which of the 1 Schematically illustrated arithmetic operations S5, S6, S7, S8 and/or S9 are executed in arithmetic step S3. in 1 shown embodiment of the invention the aim of the procedure is a safe state in which the vehicle comes to a safe standstill. In the calculation step S3 in 1 working towards this safe state. For example, the vehicle is braked and/or steered in such a way, in particular with the aid of the emergency arithmetic operations which are carried out by the FPGA in arithmetic step S3, that a safe standstill of the vehicle can be achieved as a safe state. When all of the arithmetic operations necessary for this have been carried out in arithmetic step S3, the vehicle is finally stopped in a stop step S4 and the safe state is reached.

2 shows a schematic view of a control device 1 according to the invention as a block diagram. The control device 1 can typically be a central vehicle control. In the 2 The control device 1 shown comprises an FPGA 2, a memory 3, two SoCs 4.1, 4.2, which can also be referred to as processor cores 4.1, 4.2, a CAN/CAN FD interface 5, an Ethernet interface 6, a MIPI/CSI Interface 7 and another interface 8. The interfaces 5, 6, 7, 8 are used for data exchange between the control device 1 and an in 2 not explicitly shown sensor system of an in 2 also not explicitly shown vehicle. The control device 1 is part of this in 2 vehicle not shown. The mode of operation of the control device 1 and in particular its FPGA 2, which can be configured either in a normal mode or in an emergency mode, is explained below with reference to FIG 3 until 6 described in more detail.

3 shows the control device 1 2 , comprising the FPGA 2 in its normal mode. In this normal mode, the FPGA 2 works as a gateway between the interfaces 5, 6, 7, 8, which in turn are connected to the description 2 said sensor system vehicle interact, the memory 3 and the two SoCs 4.1 and 4.2. The FPGA 2, which is configured as a gateway in this normal mode, thus controls communication between the interfaces 5, 6, 7, 8, the memory 3 and the two SoCs 4.1, 4.2. The SoCs 4.1, 4.2 are, for example, performance SoCs or processor cores. The communication between the FPGA 2 and the other components of the control device 1 mentioned is in 3 represented by double arrows between the components.

4 now shows the control device 1 again 2 , but the FPGA 2 does not move as in 3 in its normal mode but is now in its emergency mode. As already explained, this means that the FPGA 2 no longer functions, or at least no longer exclusively, as a gateway, but carries out emergency computing operations. this is in 4 represented in that the image processing S5, the sensor data fusion S6, the route planning S7, the emergency driver assistance system function S8 and the emergency pilot function S9 are represented within the FPGA 2. In the present exemplary embodiment, the emergency mode of the FPGA 2 was initiated because the two SoCs 4.1, 4.2 have failed. The FPGA 2 therefore now only communicates with the memory 3 and the interfaces 5, 6, 7, 8. Communication between the FPGA 2 and the SoCs 4.1, 4.2 no longer takes place since these have failed. Accordingly, double arrows are no longer drawn in between the FPGA 2 and the SoCs 4.1, 4.2.

5 now shows a schematic representation of a vehicle 9 according to the invention with a control device 1 according to the invention, the control device 1 including the FPGA 2 in its normal mode. The vehicle 9 also includes a front camera 10, a rear camera 11, a short-range radar sensor 12, a medium-range radar sensor 13 and three raw data sensors 14, 15, 16. The cameras 10, 11 and the radar sensors 12, 13 pre-process the data they collect . Therefore, these components transmit pre-processed data to the control device 1. This is in 5 represented by the fact that the communication between the cameras 10, 11 and the radar sensors 12, 13 and the control device 1 is represented by solid double arrows. For their part, the raw data sensors 14, 15, 16 do not carry out any pre-processing of the data they have recorded and accordingly transmit raw data to the control device 1. This is in 5 represented by dashed double arrows. in the in 5 In the situation shown, the FPGA 2 works in its normal mode because there is no failure of SoCs or processor cores in the control device 1.

In 6 the vehicle 9 is now shown again with its control device 1 and its FPGA 2, which was already shown in 5 was shown. In contrast to the situation in 5 the FPGA is located 2 in 6 but in its emergency mode. This emergency mode was initiated because a failure, for example, of one or more SoCs in control device 1 was detected. As already in 5 are also in 6 the cameras 10, 11 and the radar sensors 12, 13 are shown.

Also are in 6 again the raw data sensors 14, 15, 16 are shown. Since the arithmetic operations, which would normally run the failed SoCs in the control device 1, now at least partially in the context of notfallmäs Significant arithmetic operations must be carried out by the FPGA 2 in its emergency mode and since the FPGA 2 is typically significantly less powerful than the failed SoCs, only the cameras 10, 11 and the radar sensors 12, 13 now communicate with the control device 1. The FPGA 2 is working Thus, in the case of emergency computing operations, which he carries out in his emergency mode in order to bring the vehicle into a safe state, now exclusively with already pre-processed data from a sensor subgroup, the sensor subgroup being the front camera 10, the rear camera 11, the short-range radar sensor 12 and the medium-range radar sensor 13 includes. The raw data, which are recorded by the raw data sensors 14, 15, 16, are stored in the 6 situation shown is no longer taken into account. This results in the advantages that the FPGA 2 only has to communicate with the sensor subgroup mentioned and not with all the sensors of the vehicle 9 . In addition, the FPGA 2 is provided with pre-processed data from this sensor subgroup, so it does not have to use any computing power to process raw data. This enables the FPGA 2 to quickly and efficiently carry out those emergency computing operations which are necessary to bring the vehicle 9 into the safe state, ie for example to bring it to a standstill on a hard shoulder of a roadway.

The invention is not limited to the exemplary embodiments described. The scope of protection is defined by the patent claims.

In principle, all methods described in the description or in the claims can be carried out by devices which include means for carrying out the respective method steps of these methods.

Reference List

1

control device

2

FPGA

3

Storage

4.1, 4.2

SoCs

5

CAN/CAN FD interface

6

Ethernet interface

7

MIPI/CSI interface

8th

other interface

9

vehicle

10

front camera

11

rear camera

12

short-range radar sensor

13

medium-range radar sensor

14, 15, 16

raw data sensors

S1

failure detection step

S2

reconfiguration step

S3

calculation step

S4

stop step

S5

image processing

S6

Sensor data fusion

S7

route planning

S8

Emergency driver assistance system function

S9

emergency pilot function

Claims (15)

Method for transferring a vehicle (9) to a safe state, characterized in that the vehicle (9) is transferred to the safe state by an FPGA (2) arranged in the vehicle (9) in the event of a failure of a vehicle computing component ( 4.1, 4.2) performs emergency arithmetic operations. procedure after claim 1 , characterized in that the FPGA (2) is transferred from a normal mode to an emergency mode when the failure occurs. procedure after claim 2 , characterized in that the FPGA (2) works essentially exclusively as a gateway in the normal mode and/or that the FPGA (2) in the emergency mode carries out the emergency arithmetic operations. Procedure according to one of claims 2 until 3 , characterized in that a reconfiguration function of the FPGA (2) is carried out to transfer the FPGA (2) from its normal mode to its emergency mode. Method according to one of the preceding claims, characterized in that the emergency arithmetic operations lead to the vehicle (9) coming to a safe standstill. Method according to one of the preceding claims, characterized in that the emergency computing operations include processing of information from a sensor subgroup (10, 11, 12, 13) of the vehicle (9). Method according to one of the preceding claims, characterized in that the emergency arithmetic operations are an image processing processing (S5) and/or sensor data fusion (S6) and/or route planning (S7) and/or an emergency driver assistance system function (S8) and/or an emergency pilot function (S9). Procedure according to one of claims 2 until 7 , characterized in that the transfer of the FPGA (2) from the normal mode to the emergency mode is accomplished in that when the failure is detected from a memory (3) an emergency mode configuration bit series is read out and executed. Procedure according to one of claims 2 until 8th , comprising: - a failure detection step (S1), during which the failure of the vehicle computing component (4.1, 4.2) is detected, - a reconfiguration step (S2), during which the FPGA (2) transfers from normal mode to emergency mode - a computing step (S3) during which the FPGA (2) carries out the emergency computing operations, and - a stopping step (S4) during which the vehicle (13) is stopped. Control device (1), comprising means for carrying out one of the aforementioned methods. Control device (1), after claim 10 , comprising an FPGA (2), a vehicle computing component (4.1, 4.2), a memory (3) and a reconfiguration component, the memory (3) typically having a normal mode configuration bit series and/or an emergency mode configuration Includes bit series, characterized in that the reconfiguration component is suitable, in the event of a failure of the vehicle computing component (4.1, 4.2) to convert the FPGA (2) from a normal mode to an emergency mode, typically in that the emergency mode configuration bit series is loaded from memory (3) and executed. Control device (1) according to one of Claims 10 until 11 , characterized in that the control device (1) comprises an image processing component and/or a sensor data fusion component and/or a route planning component and/or an emergency driver assistance system component and/or an emergency pilot component. Vehicle (9) suitable for carrying out a method according to one of Claims 1 until 9 , Wherein the vehicle (9) typically has a control device (1) according to one of Claims 10 until 12 includes. Computer program, comprising instructions which, when the computer program is executed by a computer, cause the latter to carry out a method according to one of Claims 1 until 9 to execute. Computer-readable medium, characterized in that the computer-readable medium contains computer program code for carrying out a method according to one of Claims 1 until 9 includes.

Images