Classifications

• • B—PERFORMING OPERATIONS; TRANSPORTING
  • B60—VEHICLES IN GENERAL
  • B60W—CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT
  • B60W50/00—Details of control systems for road vehicle drive control not related to the control of a particular sub-unit, e.g. process diagnostic or vehicle driver interfaces
  • B60W50/02—Ensuring safety in case of control system failures, e.g. by diagnosing, circumventing or fixing failures
  • B60W50/023—Avoiding failures by using redundant parts
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/14—Error detection or correction of the data by redundancy in operation
  • G06F11/1479—Generic software techniques for error detection or fault masking
  • G06F11/1487—Generic software techniques for error detection or fault masking using N-version programming
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/16—Error detection or correction of the data by redundancy in hardware
  • G06F11/1629—Error detection by comparing the output of redundant processing systems
  • G06F11/1641—Error detection by comparing the output of redundant processing systems where the comparison is not performed by the redundant processing components
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
  • G06F2201/82—Solving problems relating to consistency
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
  • G06F2201/83—Indexing scheme relating to error detection, to error correction, and to monitoring the solution involving signatures

Definitions

• Systems for driver assistance or automated driving consist of many individual software units, which can usually be described with graphs with regard to the data flow. These software units (often also called runnables, nodes or data processing components) are characterized by the fact that a quantity of input data is processed and a quantity of output data is generated from it.
• the various software units regularly form a complex data processing network with which sensor data is processed in order to carry out actions based on the sensor data. Such actions can be, for example, control tasks within the scope of autonomous ferry operation of a vehicle.
• Data processing in the data processing network usually includes a plurality of data processing steps or data processing tasks that build on one another and are executed with the data processing components.
• the probability of systematic and sporadic hardware errors must not exceed a specified frequency that is related to the risk and the expected damage to the system functions. Because newly developed driver assistance systems are regularly used in parallel in a large number of vehicles and the risk has to be assessed in relation to the entire vehicle fleet equipped accordingly, the acceptable probability of the occurrence of hardware errors is extremely low. Compared to today's high-end processors, the computing power of commonly available microcontrollers that meet these security levels is very limited. Their maximum clock rate is around 10% (300 MHz vs. 3 GHz) and there are no internal optimizers, which are standard with off-the-shelf microprocessors (pP) and play a large part in their performance.
• a data processing network is described here for the redundant and validated implementation of a plurality of successive data processing steps, each of which is used to generate output data from input data, with output data from a first data processing step being at least partially simultaneously input data for a further data processing step, with at least one first data processing step being required for the implementation of each data processing step
• Data processing module and a second data processing module are provided, wherein the data processing network further has a comparator module, wherein the first data processing modules and the second data processing modules are set up to transmit control parameters of the individual data processing steps to the comparator module and the comparator module is set up to carry out at least one comparison of corresponding control parameters, those of the first data processing modules and d en second data processing modules, and based on this comparison to provide at least one synchronized control parameter, which includes control information regarding at least one performed data processing step.
• the basic approach is that separate hardware (separate cores) is used for the first data processing module and the second data processing module, which has a high computing power and both carry out the same calculation.
• the comparator module compares the calculations and only if the calculation result is the same is it used for further data processing in the data processing network. The equality is monitored by the data processing module using the control parameters, and the synchronized control parameter is used in the data processing network to control the control flow of the data processing.
• the points at which the first data processing module and the second data processing module provide the control parameters in order to then forward them to the comparator module are also regularly referred to as synchronization points.
• a software lockstep is to be distinguished from a hardware lockstep.
• a hardware lockstep requires significantly more complex hardware.
• the hardware lockstep not claimed here is regularly implemented in such a way that hardware is used which executes each calculation step of the software programs operated on it twice. This means that the software program itself only runs once on the hardware. An operating system sees only one instance of the respective software program. Below the one operating system level, the hardware executes each step of the software twice.
• the software lockstep described here means that the program is executed twice, twice at the operating system level. If necessary, two independent operating systems (a first operating system on the first data processing module with a first hardware/core and a second operating system on the second data processing module with a second hardware/core) can be operated, which each (and thus twice) execute the respective data processing steps .
• a software lockstep can also be operated on an operating system, in which case the instruction may then be given at the operating system level to use different hardware (two different cores) for double execution.
• a hardware lockstep always means that additional hardware (circuits, transistors, etc.) must be required for an additional redundant design, which is located below the operating system level and which the operating system cannot recognize as being separate from one another, but is different from the point of view of the operating system Operating system like a piece of hardware.
• first data processing module and the second data processing module are designed with identical software and hardware that is identical in terms of its specification (identical cores) is also used. As long as the respective data processing module or the underlying hardware is functioning correctly, the same input data also produce the same output data in both data processing modules.
• the next data processing step is carried out ad hoc, The exact process does not have to be known a priori, which means that there is a high level of flexibility.
• the order of execution is dictated by the primary engine.
• the dependent secondary modules calculate “blindly” so to speak. Therefore, the order of execution - if at all - can only be checked using invariants or general rules. This results in the same security classification for the control flow as for the respective hardware used individually.
• a high ASIL-D level cannot be achieved with such architectures. In other words: by recalculating with the secondary modules, it can be determined later that the calculations in the primary module could have been incorrect - but then it is already too late, because the results of the calculations would have been needed beforehand.
• the comparison of the calculations can only take place after the end of the redundant calculation step and the subsequent communication of the results.
• the time until an error is noticed in the calculation has doubled due to the principle. This results in an increased error latency, possibly also an unnecessary latency in the regular process.
• the data processing network presented and the data processing methods implemented with it enable sufficient performance for highly autonomous driving.
• the presented data processing network enables a combined time- and data-driven architecture. This means that, compared to approaches with an a priori fixed execution order, a flexible execution order is possible in the software lockstep.
• a software lockstep approach that is carried out in parallel but is not based on time slices is selected, which is implemented on at least two microprocessors (the first data processing module and the second data processing module) as computing units and a control component that is based on additional, trustworthy hardware (the comparator module) is running.
• This control unit which corresponds to the safety target standard, synchronizes the process on the computing units and compares their results.
• the structure of the data processing network described corresponds to the decomposition of a security-critical task. This results in a reduced ASIL requirement for the individual computing units, so that an ASIL-D classification of the overall system can already be achieved with the high-performance processors that exist today.
• Every calculation step that is started by a control event is data-deterministic. This means that identical input data always lead to the same output data given the same initial state. It is particularly advantageous if the comparison of the control parameters includes an identity check and a synchronized control parameter requires an identity of the control parameters from the first data processing module and the second data processing module.
• the data processing network is set up to use synchronized control parameters provided by the comparator module in order to control further data processing of the output data with further data processing steps of the data processing network.
• the synchronized control parameter is a validity parameter which contains validity information relating to at least one data processing step that has been carried out.
• the data processing network has at least one sequencing module which is set up in each case to sort and synchronize control parameters from the data processing modules and/or the data processing steps and then to forward these to the comparator module with a sorting, so that the comparator module can process synchronized control parameters independently of can determine the order in which the data processing modules have executed the data processing steps.
• the sequencing module is used in particular to understand the order in which data processing steps are completed in the individual data processing modules and in particular on the hardware that is available in each case. In this way, availability of the hardware for carrying out further data processing tasks can be determined.
• the sequencing module is assigned to the data processing module and transmits the control parameters to the comparator module or the (third) hardware component on which the comparator module is operated.
• control parameters of the two data processing modules are synchronized with one another and, if necessary, form control parameter tuples that are supplied to the comparator module.
• the synchronizer and the comparator module preferably together form a central unit that is operated on a (third) hardware component.
• the synchronizer achieves flexibility in the execution order of the data processing steps.
• the hardware of the respective data processing module can (if this hardware has finished carrying out a data processing step) also be used to carry out further data processing steps.
• the same data processing step is carried out on the first data processing module and the second data processing module, if the process is successful, the same control and data events are generated on each as on the other, but can be generated in a different order due to the parallel processing on the units.
• the central unit (consisting of the comparator module and synchronizer) now temporarily stores events (control parameters) until the appropriate event (the corresponding control parameter) has arrived from all data processing modules.
• the associated control parameters can then be compared and evaluated if they are the same, or the synchronized control parameter can be output.
• an additional task distribution module which then plans and commissions the starting of the individual (next) data processing steps on the respective hardware when synchronized control parameters are available from the hardware module, so that a particularly good utilization of the hardware can be achieved.
• the task distribution module preferably sends a type of stimulus to the individual data processing modules in order to activate them.
• the use of the central processing unit or the third hardware component and the comparator module does result in a slight increase in the latency between the execution of two data processing tasks. Overall, however, this increase in latency is acceptable, especially when compared to common primary/secondary module architectures.
• an error can be determined. Depending on the application, this can entail recalculation or an abort of data processing with the data processing network.
• Stimuli are found by the central processing unit in a certain way. Whenever a correct calculation result was determined by the comparator module by comparing control parameters and a synchronized control parameter could be calculated, a stimulus was found, so to speak, which triggers further data processing, the output data calculated with the respective first data processing module and the respective second data processing module required as input data.
• the central unit In order to find any stimuli for the execution of further calculation steps, the central unit not only evaluates all received data events (control parameters), but also events that indicate the end of a previous calculation step ('End' or 'DistributeSamples'). In addition, time events can be generated as stimuli for a time-driven execution.
• the central unit manages the timeline (common logical timeline) of data processing already described above.
• first data processing modules are implemented with first hardware components and second data processing modules with second hardware components, with first hardware components and second hardware components being physically separate from one another.
• At least one of the data processing modules has a hardware component that does not conform to ASIL-D. It is particularly advantageous if both hardware components of the data processing modules are not ASIL-D compliant.
• comparator module is implemented using third hardware components that are physically separate from the first hardware components and the second hardware components.
• the third hardware component conforms to ASIL-D.
• the comparator module has a data memory in which determined control parameters are stored with time information, so that a logical timeline is created which depicts the sequence in which the data processing steps are processed with the data processing modules of the data processing network.
• a hardware component of the data processing module is significantly more powerful than a hardware component of the comparator module.
• the possible performance differences between the third hardware component of the comparator module and the (first and second) hardware components of the data processing modules depend on the respective application of the data processing network. For example, it is usual for a processor clock of the first and second hardware component to be at least 5 times, possibly even 10 times, the processor clock of the third hardware component.
• control parameters can be calculated as the checksum (CRC) for large amounts of data as output data, if necessary, and only these are used together with the unique packet identification ( alias Meta-Sample) is sent to the comparator module as a control parameter.
• CRC checksum
• the actual flow of output data from a data processing step as input data to the next data processing step can take place on the first hardware component and the second hardware component (and possibly also on other hardware components) independently of one another or in parallel, with data transmission interfaces between different hardware components exist, which are also independent of the central processing unit or the comparator module.
• the central processing unit or the comparator module then does not check the original data but, for example, their checksums, which leads to a bit-by-bit comparison of the original content. It should be noted here that the first hardware component and the second hardware component must temporarily buffer the original data packets until they have been confirmed by the comparator and can be delivered.
• the comparison of the control parameters includes a check as to whether an error that has occurred during data processing in the first data processing module and/or in the second data processing module is below a tolerance limit and the synchronized control parameter is generated in this case. This means in particular that in such cases the synchronized control parameter may be generated even though an error has occurred which is below the tolerance limit.
• a method for operating a described data processing network having at least the following steps: a) carrying out a data processing step with a first data processing module and generating a first control parameter which is suitable for checking the carrying out of the data processing step with the first data processing module, b) independently of step a), performing the same data processing step with a second data processing module and generating a second control parameter which is suitable for checking the performance of the data processing step with the second data processing module; c) performing a comparison of corresponding control parameters from the first data processing module and the second Data processing module were transmitted with a comparator module and based on this comparison, providing at least one synchronized control parameter, which contains control information regarding at least one data processing step carried out.
• the 1 shows a described data processing network 1 in a motor vehicle 23. It is shown here by way of example that the data processing network 1 is used to process data from sensors 19 and that an output data receiver 20 is supplied with data by the system. Such an output data receiver 20 can be, for example, a system for autonomous ferry operation or a similar system.
• the data processing network 1 is used, for example, to reduce the sensor data to decision-relevant parameters, which can be output data 4 from the data processing network 1 .
• the data processing network 1 also includes hardware components on which the data processing network 1 or its components and modules can be operated.
• the data processing network 1 carries out individual data processing steps 2 which build on one another.
• Output data 4 from a data processing step 2 can be input data 3 from a further data processing step 2 .
• Each data processing step 2 is implemented here with a plurality of data processing modules 5, 6 that are executed as independently as possible.
• a first data processing module 5 and a second data processing module 6 are shown here. More than two data processing modules can also be provided, which carry out a data processing step 2 (in parallel).
• the data processing network 1 also includes other components which will be explained in more detail with reference to the other figures. This includes, in particular, the comparator module 7 and possibly also a synchronizer 27, which are only indicated schematically here.
• FIG. 2 chooses a different representation of the described data processing network 1.
• three arrows are shown one below the other, which define the individual hardware components and at the same time also reflect the individual method steps a), b) and c) of the method described.
• the arrows offer a representation of the processes on the respective hardware components on a logical timeline 17.
• the upper arrow is a first hardware component 12 on which first data processing modules 5 are implemented.
• the lower arrow is a second hardware component 13 on which second data processing modules 6 are implemented.
• the middle arrow is a third hardware component 14 on which the comparator module 7 is implemented.
• Data processing steps 2 of the data processing network 1 are carried out in first data processing modules 5 and second data processing modules 6 .
• a control parameter 8 is transmitted to the comparator module 7, which then, by comparing the control parameters 8, detects whether the data processing step 2 was carried out correctly (ie error-free).
• the comparator module 7 then generates synchronized control parameters 9, which are used to trigger further data processing steps 2, which then further process output data from previous data processing steps 2 (not shown here).
• the comparator module 8 and the associated components can also be used as the central unit 24 of the described Data processing network 1 are understood.
• the synchronized control parameters 9 can be understood as stimuli 25 for triggering further data processing steps 2 .
• FIG 3 shows the parallel processing of a data processing step 2 by a first data processing module 5 and by a second data processing module 6 in even more detail. It can be seen that the first data processing module 5 is implemented on a first hardware component 12 , while the second data processing module 6 is implemented on a second hardware component 13 . The first data processing module 5 and the second data processing module 6 each process the same input data 3 and should also generate the same output data 4 in each case.
• a data processing step 2 or a data processing module 5, 6 can be further subdivided into a plurality of individual data processing components 18, each of which relates to sub-steps of data processing.
• the data processing step 2 or the data processing module 5 , 6 as they are defined here therefore relate to pre-groupings of sub-steps that have been sensibly selected or specified depending on the application and are executed with the data processing components 18 .
• the pre-grouping of sub-steps is preferably selected in such a way that no data storage is required within a data processing step 2 or a data processing module 5.6 and that, in particular, no data other than the input data is accessed for the execution.
• the first data processing module 5 and the second data processing module 6 each generate control parameters 8 which are evaluated by the comparator module 7 .
• the comparator module 7 is implemented on a third hardware component 14, which is independent of the first hardware component 12 and the second hardware component 13, which forms a central unit 24 and which preferably offers the higher security (higher ASIL level) of the execution already described above.
• each data processing module 5, 6 is preceded by a sequencing module 11 for obtaining the control parameters 8 from the data processing and the comparator module 7 is preceded by a synchronizer 27 here.
• the comparator module 7 can be followed by a task distribution module 22, which outputs synchronized control parameters 9 or stimuli 25 for triggering further data processing steps 2.
• Synchronizer 27, comparator module 7 and task distribution module 22 can be implemented together on the third hardware component 14 as the central unit 24 described.
• the data processing network 1 described is preferably operated in such a way that data processing steps 2 are carried out on the hardware that is available and not fully utilized.
• the task distribution module 22 can cause this distribution of the data processing steps 2 to the available hardware.
• the execution of the data processing steps 2 carried out takes a different amount of time on each piece of hardware.
• the synchronizer 27 achieves a sorting of the incoming control parameters 8 so that the comparator module 7 then compares the correct control parameters 8 with one another, even when the hardware is heavily loaded, in order to generate correct synchronized control parameters 9 .
• control parameters 8 are transferred from the synchronizer 27 to the comparator module 7 as control parameter tuples 28 . It is not necessary for input data 3 and output data 4 to be transferred from one data processing step 2 to the next data processing step 2 via the central processing unit 24 or the comparator module 7 .
• FIG. 4 Another illustration of the method described is selected in FIG. 4, in which method steps a), b) and c) are carried out for each data processing step 2.
• the actual data processing steps 2 are always executed redundantly in relation to one another with the first data processing module 5 and with the second data processing module 6.
• a check is then carried out with the comparator module 7 as to whether the data processing step 2 has been carried out correctly before the next data processing step 2 is started.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Automation & Control Theory (AREA)
• Quality & Reliability (AREA)
• Physics & Mathematics (AREA)
• General Engineering & Computer Science (AREA)
• General Physics & Mathematics (AREA)
• Human Computer Interaction (AREA)
• Transportation (AREA)
• Mechanical Engineering (AREA)
• Hardware Redundancy (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=78302755

Family Applications (1)

Country Status (6)

Families Citing this family (1)

Family Cites Families (4)

• 2020
  • 2020-10-22 DE DE102020213323.9A patent/DE102020213323A1/de active Pending
• 2021
  • 2021-10-15 CN CN202180087011.6A patent/CN116635832A/zh active Pending
  • 2021-10-15 EP EP21794795.1A patent/EP4232905A1/de active Pending
  • 2021-10-15 JP JP2023524603A patent/JP7512529B2/ja active Active
  • 2021-10-15 WO PCT/EP2021/078590 patent/WO2022084176A1/de active Application Filing
  • 2021-10-15 US US18/249,480 patent/US20230415757A1/en active Pending

Also Published As

Similar Documents

Legal Events