WO2018127394A1

WO2018127394A1 - Scalable control system for a motor vehicle

Info

Publication number: WO2018127394A1
Application number: PCT/EP2017/083274
Authority: WO
Inventors: Desoky Abdelqawy; Karim Gomaa; Ahmed Darwish; Hussein Hesham; Ruba Noureldin
Original assignee: Connaught Electronics Ltd.
Priority date: 2017-01-04
Filing date: 2017-12-18
Publication date: 2018-07-12
Also published as: DE102017100118A1

Abstract

The invention relates to a control system (2) for a motor vehicle (1), with a processing device (3) which is configured to execute at least two function applications (4a, 4b) and with a storage device (5) in which the at least two function applications (4a, 4b) are stored, wherein the processing device (3) features a hypervisor (20) and at least two separate processing units (3a, 3b) and each processing unit (3a, 3b) comprises a hypervisor control component (23a, 23b) by which the processing unit (3a, 3b) is controllable by the hypervisor, wherein the hypervisor (20) is configured in accordance with a stored rule to assign to a respective function application (4a, 4b) to be executed a respective one or more of the processing units (3a, 3b) on which the function application (4a, 4b) is then executed, in order to reduce and/or manage more efficiently complexity in the control system (2).

Description

Scalable control system for a motor vehicle

The invention relates to a control system for a motor vehicle, with a processing device which is configured to execute at least two function applications and with a storage device in which at least two function applications are stored.

In current architectures for control systems in a motor vehicle, a plurality of autonomous control devices, so-called stand-alone control devices or electronic control units (ECU), are used. They are coupled to each other via a network. Besides a processing unit (e.g. Central Processing Unit, CPU), in such a control device typically there is also a storage unit available in addition to appropriate sensors or actuators integrated into or coupled to the control device. Therein, hardware and software are very accurately adapted to each other in the control device to efficiently execute a respective function application. Each control device is typically a self-contained unit which controls a function or functionality in the motor vehicle according to a stored function application.

Such control devices are provided and installed in a motor vehicle by different manufacturers. To solve a prespecified or given task and to provide the assigned functionality in a desired manner, the different control devices may have to communicate with each other via different networks, so that in current motor vehicles in such a network with a plurality of control devices provided by different manufacturers a high degree of complexity has to be managed.

Due to the sharp increase of new functionalities in motor vehicles it is necessary to manage this increase in complexity in a reliable and scalable manner.

In this context, in the automobile sector Autosar (Automotive System Architecture) is currently used. However, it mainly aims at respective microcontrollers of the control device within a control device and not at the algorithms underlying the respective functionalities which, for example, have to be adjusted to computing units with a plurality of cores or to different operating systems.

In this context, DE 10 2014 209 592 A1 describes a method for creating a hypervisor unit for a control device. The hypervisor unit is herein configured to execute two applications on the control device during one runtime. The hypervisor unit is created during a compilation time in dependency on a first property of a first application, in dependency on a second property of a second application and in dependency on a third property of the control device.

DE 10 2014 210 529 A1 deals with a method for operating a control unit for controlling a machine with a multi-core processor with at least two processor cores. Therein, a first number of processor cores are assigned to one or more first operating systems and a second number of processor cores are assigned to one or more second operating systems.

From DE 10 2012 208 753 A1 a microcomputer is known which comprises a single core, which is used in distributed manner to provide a plurality of virtual cores. The core provides a core activating element and a core deactivating element. By the core activating element a virtual core can be activated and by the core deactivating element such core can be stopped.

DE 10 2014 221 972 A1 discloses a system for transmitting software updates to a motor vehicle.

It is the object of the present invention to reduce and/or manage more efficiently the complexity in a control system for a motor vehicle.

This object is solved by the subject matter of the independent claims. Advantageous embodiments are apparent from the dependent claims, the description and the figures.

The invention relates to a control system for a motor vehicle with an electronic processing device which is configured to execute at least two, preferably more than two, function applications. The function applications are in particular different function applications. A function application may also be referred to herein as function application program. Such a function application may be a software which provides a desired functionality in the motor vehicle, e.g. automatic parking.

The control system also comprises a storage device in which the at least two function applications are stored. The function applications can, for example, be stored in a nonvolatile, permanent or persistent memory such as a flash memory as storage unit of the storage device. The control device in particular also comprises a sensor device which is configured to provide sensor data to the processing device. The sensor device preferably features at least one sensor and accordingly provides the sensor data of the at least one sensor. The provided sensor data can also be preprocessed sensor data. The sensor data can also be provided within the control system in the form of a service, e.g. as a so- called service in a data network.

It is important here that the processing device features at least two, preferably a plurality of, i.e. more than two, separate processing units. These processing units can in particular be structurally separated and preferably feature a respective housing of their own. They can, for example, be assigned to different control devices of the motor vehicle or they can be part of different control devices of the motor vehicle. Moreover, the processing device features a hypervisor, i.e. a hypervisor is implemented or available in said processing device. Thus, a hypervisor is implemented on or in the processing device. The hypervisor can also be referred to as virtual machine monitor (VMM). The hypervisor enables to define and provide a virtual environment with corresponding virtual processing units independently of the actually available hardware, i.e. the actually available processing units of the processing device.

For this to function, each processing unit features a hypervisor control component by which the processing unit is controllable by the hypervisor. By the hypervisor control component each processing unit can thus be centrally controlled as part of the processing device. The hypervisor control component is a software component. For example, via the hypervisor control component a service of the respective processing unit, e.g. a computing capacity, can be provided. Thus, via the hypervisor and the hypervisor control component the respective processing unit can be managed as a generic computing unit and, for example, be utilized for different function applications. Accordingly, it can be provided that via the hypervisor control component a function application is dynamically configured, loaded into an available processing unit and executed there. For example, the function application may be stored in the form of a binary file and provided to the processing unit via a network. In addition, statistical information about the processing unit, e.g. about a utilization rate of the processing unit, may optionally be retrieved in real time via the hypervisor control component. Thus, if for example a processing unit is part of a particular control device in which in known systems only one or more fixedly predefined specific function applications are executable, presently, in contrast to the prior art, in the particular control device dynamically predefinable or presettable function applications can be executed. For example, a control device which is mainly used for the functionality of automatic parking, can thus be utilized for a different functionality, e.g. automatic lane keeping during a drive on the motorway in which automatic parking is not required.

The hypervisor is configured to assign one or more respective processing units on or in which a respective function application is to be executed to the function application to be executed according to a stored rule (e.g. stored in the hypervisor). The stored rule can comprise a generalized assignment condition such as "Assign the function application to be executed to a processing unit with sufficient free computing capacity" or an assignment process in which, for example, a search process for a suitable processing unit, e.g. a processing unit with sufficient free computing capacity, is specified in the control system.

Thus, a software oriented architecture is realized for the control system, in which the software, i.e. the function applications, is completely separated from the hardware on which it runs or on which it is executed, i.e. the processing units. Thus, via the hypervisor the processing units are provided in the control system as a single scalable computing cluster, a coherent cluster of processing units. The processing units thus serve as a "processing farm" of the control system. Each processing unit is moreover embedded in the hypervisor and provided with the hypervisor control component to render it capable of being identified and controlled as part of said processing farm. For a respective function application to be executed the hypervisor can thus provide (preferably in real time) a virtual processing unit which can be formed by one or more processing units. Thus, overall, a scalable cloud computing platform is provided within the motor vehicle by the control system with the processing device including the hypervisor. Therein, a computing capacity in the form of the virtual processing unit with one or more respective assigned processing units can be provided in the control system in a dynamic and needs-oriented way. In dependency on the respective function application further resources, e.g. a memory of the storage device or respective sensors and/or actuators e.g. of the sensor device, can also be dynamically assigned to the respective function application. In this connection, the control system can feature a service-oriented architecture (SOA), as described below, in which information and/or capacities of the control system can be requested and/or provided as a service which is retrievable by the respective function applications.

This has first of all the advantage that a computing capacity which is available in the control system is utilized in an improved manner. In modern vehicles high-performance processing units are installed, for example, for automatic parking, i.e. in particular control devices with high-performance processing units, which, however, are used only during parking and which are idle otherwise. This applies in similar manner to many processing units or control devices in the motor vehicle. With the proposed control system, such an idle processing unit or control device can execute a different function application, e.g. in the absence of a parking manoeuvre. Besides, the available computing capacity can easily be increased and scaled through addition of respective processing units to the processing device. In similar manner, via the service-oriented architecture a new sensor and/or a new function application can be added to the system, i.e. connected to the system or stored therein, and the new sensor data can, for example, be provided as service and/or the new functionality can in corresponding manner be realized on any available processing unit.

Thus, for example, a new functionality, e.g. an emergency brake functionality, can be fed into the control system in the form of a new function application via an update. This new functionality can for example place specific demands on the sensor device. It can for instance require a laser sensor for distance measuring. If an appropriate sensor is implemented in the system, i.e. if for example an appropriate sensor provides the desired highly precise distance measurement as service, the function application can, for example, be stored in the storage device and be loaded into a suitable processing unit upon activation by a user and be activated there without taking into consideration further hardware requirements.

Further, the separation of hardware level and software level enables a needs-oriented design of the software in which hardware restrictions play a lesser role than before, since the hypervisor compensates for respective limitations of the available processing units or control devices, e.g. a limited computing capacity of a particular processing unit.

Moreover, enhanced safety is achieved, since, for example, incorrectly executed function applications can be migrated or transferred from a defective processing unit or a defective control device to an intact processing unit or an intact control device unit and be executed there. Besides, development time is reduced since no redundant hardware configuration is required.

In an advantageous embodiment it is provided that the processing units are each part of a control device, that is, of an electronic control unit (ECU) or of an electronic control module (ECM). Alternatively, the respective processing units can also comprise (or feature) or be the respective control device. In particular, the processing units or control devices in particular each feature a housing of their own. This has the advantage that the known control units can be integrated into the control system and that thus the described advantageous control system can be realized with minimal adjustments of existing control devices known from the prior art.

In a further advantageous embodiment, it is provided that according to the stored rule a computing capacity required for the function application to be executed is compared with a respective computing capacity currently available in the processing units to be assigned or in the available processing units, and that the processing unit is assigned to the function application in dependency on a result of the comparison. The computing capacity required for a function application can, for example, be indicated by the function application itself or it can be stored in the control system, e.g. in the form of a table. It can be provided that the computing capacity available in the processing unit meets the required computing capacity as closely as possible. Alternatively, however, a capacity buffer of e.g. 10 or 20 percent may be provided by which the available computing capacity has to exceed the required computing capacity in order that the respective processing unit is assigned to the function application to be executed.

It can also be provided that a plurality of processing units are assigned to the function application such that the function application is executed in a distributed manner. This can, for example, be envisaged in case no single processing unit is available whose computing capacity is sufficient for the function application. For this purpose, in the control system, e.g. in the processing unit, a broker component can be provided as software which plans activation and deactivation of a respective function application in dependency on a situation or an operating state of the control system and/or of the motor vehicle, e.g. in dependency on a driving situation. Also, for a specific function application a specific processing unit can be scheduled. In particular, the control system features only one such broker component which thus centrally manages, i.e. compares and assigns, specifically requested and available resources, e.g. the computing capacity. The scheduling can also take into account future requirements. Thus, for one or more specific function applications also a future resource such as a computing capacity can be scheduled and e.g. reserved.

This has the advantage that in the assigned processing unit there is always sufficient computing capacity available for the function application to be executed. Moreover, the function application can be flexibly executed on different processing units, whereby efficiency and reliability of the control system are increased. Advance scheduling as performed by the broker component enables particularly efficient resource management. Specifically, in this regard, function applications which are not required can be deactivated and thus the computing capacity which is not required can be made available to other function applications.

In a further advantageous embodiment it is required that the sensor device features a smart sensor with an integrated computing unit, which provides preprocessed sensor data to the processing device. The provision may in particular be realized in the form of a (software) service within a network, which may also be part of the control system. The sensor data may thus be provided as "sensor data as service" and they may be retrieved within the network by components of the control system, also e.g. by the function applications. Herein, the term "components of the control system" refers to all hardware and software components of the control system, whereas the term devices of the control system only refers to hardware components, in particular to a storage device and/or a processing device and/or a sensor device and/or a gateway device as described below.

In a further advantageous embodiment, it can be provided that the sensor device features at least one control device which is coupled to one or more sensors and which

preprocesses sensor raw data of the sensor or sensors and provides the preprocessed sensor data to the processing device. Here, also, the providing of the preprocessed sensor data to the processing device may in particular be realized in the form of a service within the network as described in the previous paragraph.

This has the advantage that the sensor data can be provided as service and thus scalable sensor management can be realized. Thus, for example, sensor detection, in particular addition or removal of a sensor, can be particularly easily managed in the sensor device through automatic provision of the corresponding preprocessed sensor data in retrievable manner as service upon coupling of the smart sensor or of the control device, which is coupled to the sensor or sensors, with the network. Thereby, management of a connection or logical coupling between the respective sensors and the respective function application which requires the sensor data of the respective sensors is also enabled. A sensor monitoring component or sensor node which offers such service may be provided. This monitoring component is also a software component. The smart sensors offer the advantage that, without further components, they may be integrated, in the manner of a plug-and-play functionality, into the control system and used directly. Thus, seamless integration of the sensors into the control system is enabled. With regard to the sensors coupled to a control device, it is thus possible for the present control system to continue to use the sensors and control devices known from the prior art in the described control system. Further, the conventional other sensors are also rendered quasi smart sensors by the control device and can thus be integrated seamlessly.

There can also be provided a system monitoring component which monitors the control system and in particular provides an overview of active or loaded function applications and/or access information and/or utilization of the respective processing units. The overview can also be provided as service in the (data) network. The system monitoring component can be implemented in the processing device. Also, in the storage device a service for data management can be implemented which is used to manage the files, e.g. respective binary files, of the function applications. Thus, the function applications can be stored particularly efficiently, especially if a file system is available in the storage device. Thus, with the file system, the storage device is also easily scalable and adjustable to current requirements or demands in the control system.

In a further advantageous embodiment it is provided that a so-called gateway device or gateway, e.g. a router, is part of the control system. Via the gateway device the control system is capable of being coupled to at least a further control system or a further network, i.e. a motor vehicle network. Via the gateway device the control system can thus provide data and/or information to an external environment or receive it therefrom.

This has the advantage that the control system can also be used in a subsection, a so- called domain, of the motor vehicle, namely for instance only for engine control or only for a driver assistance system. Thus, for example, a gradual changeover from the previously known control device architecture to the proposed architecture can be realized.

In a further advantageous embodiment it is provided that the processing device and the storage device and in particular also the sensor device and/or the gateway device are coupled with each other via a data network. The data network can in particular be a realtime capable data network, e.g. a so-called deterministic Ethernet such as TT Ethernet. Thus, information can also be transmitted in time-critical function applications via the data network without safety risk. The described control system is thus also usable in critical applications or for critical function applications.

In a further advantageous embodiment it is provided that the control system features a register in which each addressable component of the control system, i.e. for example also available services, is stored. In particular, the register is automatically updated when a component is added and/or removed. Thus, a plug-and-play functionality can be implemented in the control system. The addressable component can in particular comprise the processing units and/or the at least one smart sensor and/or the at least one control device coupled to the sensor and/or at least one storage unit of the storage device.

This has the advantage that each available service and/or each function application and any other software component has information about other components available and addressable in the control system, namely in particular hardware components and/or software components. Thus, in the control system a plurality of services can be provided in a particularly efficient manner. By means of such a register, in particular in combination with a service-oriented architecture, a maximum degree of flexibility is achieved and software and hardware are completely decoupled from each other. Thus, for example, the computing power or the computing capacity of the processing units and/or storage space in the storage device and/or sensor data of the sensor device and/or information data from the gateway device can be retrieved and provided as a service.

In a further advantageous embodiment it is provided that the control system features a service-oriented architecture. Thus, in the control system a service-oriented architecture is implemented. Specifically, one or more of the following services are implemented in the control system, i.e. for example implemented in the respective relevant device of the control system and thus retrievable und/or registered in the register: a detection service for the detection of added and/or removed components of the control system, for example of added or removed hardware such as a processing unit and/or a storage unit and/or a sensor and/or a control device, and/or also of software such as a function application and/or a service. When a new sensor and/or a new processing unit, generally speaking a new component, is added to the control system and/or coupled thereto, it is detected by the detection service and, for instance, registered in the register. The detection service may also serve as an index or record for finding a service and/or a hardware and/or for communicating with said service and/or hardware.

A further service can be a monitoring service for monitoring at least one component of the control system. The monitoring service may monitor the status of each component, i.e. of each hardware or software, in particular the status of currently active, i.e. running, function applications. Thus, in the monitoring service information about utilization of the respective processing units and/or utilization of the control system may be stored.

Another service is a data service for management of the data communication between function applications and the at least one sensor and/or a storage unit of the storage device and/or a stored configuration for the function application, in particular of a load level and/or memory status of the respective function application.

A further service is a gateway service for transmitting data into or out of the control system. The gateway service can serve as a bridge to an external network. A further service is a sensor service for needs-oriented provision of sensor data to the function applications. A function application can, for example, register here in order to receive sensor data coming from a sensor if the data are required and/or if the data are available. Further, a hypervisor control service for controlling the respective processing unit can be provided. This can be a software extension for the hypervisor by which the processing unit can be controlled, i.e. by which a virtual running environment can be created on the processing unit and execution of the function application on the processing unit can be controlled. This service can here be provided by the hypervisor control component.

A broker service for disposition, or scheduling, of the processing units for the function applications is a further possible service. Thereby, it is possible to control on which of the processing units of the available processing units a respective function application is executed, in particular also when it is executed. A further service is an update service for updating one or more software components of the control system. Thus, for example, via a wireless connection, a wireless update functionality, an over-the-air (OTA) update, may be provided for the control system. Thus, for example, updating may also be enabled or possible in a driving mode of the motor vehicle. A communication service can be provided here for abstracting the communication between the hardware, in particular between the sensor device and/or the processing device and/or the storage device and/or the gateway device, and the respective active function applications and/or one or more further software components, in particular of one or more services. Through abstraction or detachment, the communication may, for example, take place according to a general protocol here which is not specific for the respective software component, e.g. the respective function application, and/or for the respective hardware component.

Besides flexibilisation of the system through the implementation of the services, said services have proven to be particularly advantageous in the realization of the scalable control system.

The invention also relates to a motor vehicle with a control system or a plurality of control systems according to one of the described embodiments. Particularly in the case of a plurality of control systems the described advanced control system can thus, island-like, progressively be utilized in different subsections (domains) of the motor vehicle. This enables progressive modernisation of the control device architecture in motor vehicles and thus reduces error susceptibility resultant from a changeover.

The invention also relates to a method for operating a control system of a motor vehicle, wherein the control system features a processing device for executing at least two function applications and a storage device in which the at least two function applications are stored. The control system in particular also features a sensor device with at least one sensor for providing sensor data of the at least one sensor to the processing device.

In this context it is important that one or more of at least two processing units of the processing device are assigned to a respective function application to be executed by a hypervisor of the processing device according to a stored rule. It is also critical that the one or more processing units to which the respective function application has been assigned are controlled by the hypervisor. The hypervisor controls the processing unit by means of a respective hypervisor control component of the processing unit. Finally, the function application is executed in the processing unit or processing units that are controlled by the hypervisor and assigned to the function application.

Advantages and advantageous embodiments of the method correspond to advantages and advantageous embodiments of the control system here.

Further features of the invention are apparent from the claims, the figures and the description of figures. The features and feature combinations mentioned above in the description as well as the features and feature combinations mentioned below in the description of figures and/or shown in the figures alone are usable not only in the respectively specified combination, but also in other combinations without departing from the scope of the invention. Thus, implementations are also to be considered as encompassed and disclosed by the invention, which are not explicitly shown in the figures and explained, but arise from and can be generated by separated feature combinations from the explained implementations. Implementations and feature combinations are also to be considered as disclosed, which thus do not have all of the features of an originally formulated independent claim. Moreover, implementations and feature combinations are to be considered as disclosed, in particular by the implementations set out above, which extend beyond or deviate from the feature combinations set out in the relations of the claims. Below, embodiments of the invention are explained in more detail based on schematic drawings. These show in:

Fig. 1 a motor vehicle with an exemplary embodiment of a control system; and

Fig. 2 an exemplary embodiment of a control system with corresponding software components.

In the figures, identical or functionally identically elements are provided with the same reference characters.

Fig. 1 shows a motor vehicle 1 with an exemplary embodiment of a control system 2. The control system 2 features a processing device 3 which is configured to execute at least two function applications 4a, 4b. The two function applications 4a, 4b are stored in a storage device 5 of the control system 2. The control system 2 further features a sensor device 6 which is configured to provide sensor data to the processing device 3 and thus presently to the active function applications 4a, 4b which are executed by the processing device 3.

In the illustrated example, the sensor device 6 features a smart sensor 7 which provides preprocessed sensor data to the processing device 3. The providing is presently performed as a service via a data network 8 which is likewise part of the control system 2 and to which the storage device 5, the processing device 3 and the sensor device 6 are connected here. In the present example, the sensor device 6 also features a control device 9 which in its turn is coupled to a sensor 10 and preprocesses sensor raw data of the sensor 10 prior to providing the preprocessed sensor data as service within the data network 8. The data network 8 is presently a real-time capable data network and may, for example, be realized as deterministic Ethernet according to the TT Ethernet standard.

The processing device 3 presently features at least two separate processing units 3a, 3b which can, for example, be part of a respective control device with a respective own housing. Moreover, the processing device 3 also features a hypervisor 20 (Fig. 2) and each processing unit 3a, 3b features a hypervisor control component 23a, 23b by which the processing units 3a, 3b are controllable by the hypervisor 20. The hypervisor 20 is configured to assign one or more of the respective processing units 3a, 3b on which the function applications 4a, 4b are then executed to the respective function application to be executed according to a stored rule. Thus, instead of being idle, an available suitable processing unit 3a, 3b can respectively be utilized for execution of the function application 4a, 4b so that the available resources are utilized in an improved manner.

In the illustrated example, a gateway device 1 1 is also part of the control system 2, via which the control system 2 can be coupled to a further control system 12 or a motor vehicle network 13. The control system 2 can thus be integrated into an existing network infrastructure of the motor vehicle 1 .

Fig. 2 shows an exemplary embodiment of a control system 2 with corresponding software components. As in Fig. 1 , the control system 2 presently features a processing device 3, a sensor device 6, a storage device 5 and a gateway device 1 1 . Each of the devices 3, 5, 6, 1 1 features a respective hardware layer 14-3, 14-5, 14-6 and 14-1 1 . Besides, the devices each feature a software layer 15-3, 15-5, 15-6 and 15-1 1 .

In the software layers 15-5, 15-6 and 15-1 1 a respective operating system 16-5, 16-6 and 16-1 1 is available. Additionally, corresponding services are provided. For the gateway device 1 1 this is a gateway service 17 for transmitting data from another control system 12 (Fig. 1 ) or external network 13 (Fig. 1 ) into the control system 2 or for transmitting data from the control system 2 into e.g. the further control system 12 or the external network 13. For the sensor device 6 this is a sensor service 18 via which sensor data of the sensors 7, 9 of the sensor device 6 can be provided to the function applications 4a, 4b (Fig. 1 ) or the processing device 3. For the storage device the service is a data storage service for managing the stored data, e.g. the binary files of the function applications 4a, 4b.

In the software layer 15-3 of the processing device 3 the hypervisor 20 and a

communication service 21 is provided, which are presently arranged between further software components of the processing device 3 and the hardware layer 14-3. The communication service 21 presently serves to abstract the communication between the different software components, e.g. the active function applications, and the hardware layer 14-3, which can, for instance, be formed by the processing units 3a, 3b (Fig. 1 ) and/or corresponding control devices. The hypervisor 20 serves to define a virtual environment which serves as a basis for the function applications independently of the actually available hardware layer 14-3, e.g. the processing units 3a, 3b. Thus, virtual processing units 22a to 22m are presently defined which are realized in one or more real processing units of the processing device 3 by the hypervisor 20. For this purpose, a hypervisor control component 23a, 23b (Fig. 1 ) is implemented in the respective processing units 3a, 3b (Fig. 1 ), by which in the software layer 15-3 a hypervisor control service 24 for controlling the respective processing unit 3a, 3b can be realized.

Further, presently, in the software layer 15-3 of the processing device 3 a detection service 25 for the detection of added and/or removed components of the control system 2 is available. This detection service 25 detects newly added or removed components and presently manages the same in a register so that function applications and/or other services and/or other components such as the hypervisor 20 can access said

components, in particular the services. Moreover, presently, there is also a monitoring service 26 for monitoring at least one component of the control system 2 available. By said monitoring service a respective status of hardware and/or software components, e.g. of active function applications, and/or utilization of the respective processing units 3a, 3b as well as, for instance, total utilization of the control system 2 can be monitored. A further important service is presently implemented in the form of the broker service 27. The broker service 27 schedules utilization of the processing units 3a, 3b (Fig. 1 ), i.e. it provides the hypervisor 20 and accordingly a respective function application with a processing unit 3a, 3b which meets the requirements of the respective function application 4a, 4b. Finally, an update service 28, presently a wireless update service 28, is presently implemented for updating software components of the control system 2.

Thus, the control system 2 can presently be updated independently of the gateway service 17 and, in particular, new function applications can be loaded into the control system 2, for instance if a new sensor in the sensor device 6 is connected to the control system 2.

Claims

1 . Control system (2) for a motor vehicle (1 ), with

- a processing device (3) which is configured to execute at least two function applications (4a, 4b);

- a storage device (5) in which the at least two function applications (4a, 4b) are stored;

characterized in that

- the processing device (3) features a hypervisor (20) and at least two separate processing units (3a, 3b) and each processing unit (3a, 3b) comprises a hypervisor control component (23a, 23b) by which the processing unit (3a, 3b) is controllable by the hypervisor (20); wherein

the hypervisor (20) is configured to assign to a respective function application (4a, 4b) to be executed one or more of the respective processing units (3a, 3b) on which the function application (4a, 4b) is then executed according to a stored rule.

2. Control system (2) according to claim 1 ,

characterized in that

the processing units (3a, 3b) respectively comprise a control device or are part of a control device and in particular feature a housing of their own.

3. Control system (2) according to any one of the preceding claims,

characterized in that

according to the stored rule a computing capacity required for the function application to be executed is compared with a respective computing capacity currently available in the processing units (3a, 3b) to be assigned, and the processing unit (3a, 3b) is assigned to the function application (4a, 4b) in dependency on a result of the comparison.

4. Control system (2) according to any one of the preceding claims,

characterized in that the control system (2) features a sensor device (6) which is configured to provide sensor data to the processing device (3).

5. Control system (2) according to claim 4,

characterized in that

the sensor device (6) features a smart sensor (7) which provides preprocessed sensor data to the processing device (3), in particular in the form of a service within a data network (8).

6. Control system (2) according to claim 4 or 5,

characterized in that

the sensor device (6) features a control device (9) which is coupled to one or more sensors (10) and preprocesses sensor raw data and provides the preprocessed sensor data to the processing device (3), in particular in the form of a service within the data network (8).

7. Control system (2) according to any one of the preceding claims,

characterized in that

a gateway device (1 1 ) is part of the control system (2) via which the control system (2) can be coupled with at least a further control system (12).

8. Control system (2) according to any one of the preceding claims,

characterized in that

the processing device (3) and the storage device (5) and in particular also the gateway device (1 1 ) and/or the sensor device (6) are coupled with each other via the data network (8), in particular a real-time capable data network.

9. Control system (2) according to any one of the preceding claims,

characterized in that

the control system (2) features a register in which each addressable component of the control system (2) is stored, in particular the processing units (3a, 3b) and/or the at least one smart sensor (7) and/or the at least one control device (9) coupled to the sensor (10) and/or the at least one storage unit of the storage device (5), wherein in particular the register is automatically updated upon addition and/or removal of a component.

10. Control system (2) according to any one of the preceding claims, characterized in that

the control system (2) features a service oriented architecture and in particular one or more of the following services are implemented in the control system (2): a detection service (25) for the detection of added and/or removed components of the control system (2), a monitoring service (26) for monitoring at least one element of the control system (2), a data service for managing data communication between function applications (4a, 4b) and the at least one sensor (7, 10), a gateway service

(17) for transmitting data into and out of the control system (2), a sensor service

(18) for providing sensor data to the function applications (4a, 4b), a hypervisor control service (24) for controlling the respective processing unit (3a, 3b), a broker service (27) for distributing the processing units (3a, 3b) to the function applications, an update service (28) for updating software elements of the control system (2) and a communication service (21 ) for abstracting the communication between the hardware and respective active function applications (4a, 4b).

1 1 . Motor vehicle (1 ) with a control system (2) or a plurality of control systems (2)

according to any one of the preceding claims.

12. Method for operating a control system (2) of a motor vehicle (1 ), wherein the control system (2) features a processing device (3) for executing at least two function applications (4a, 4b) and a storage device (5) in which the at least two function applications are stored,

characterized by

- assigning one or more of at least two processing units (3a, 3b) of the processing device (3) to a respective function application (4a, 4b) to be executed by a hypervisor (20) of the processing device (3) in accordance with a stored rule;

- controlling of the one or more processing units (3a, 3b) to which the function application (4a, 4b) has been assigned by the hypervisor (20), wherein the hypervisor (20) controls the processing unit (3a, 3b) by a hypervisor control component (23a, 23b) of the processing unit (3a, 3b); and

- execution of the function application (4a, 4b) in the processing unit (3a, 3b) or processing units (3a, 3b) controlled by the hypervisor (20).