Method and device for generating an output data stream

• US 10,409,666 B2
• Filed: 09/21/2016
• Issued: 09/10/2019
• Est. Priority Date: 09/30/2015
• Status: Active Grant

• Current Assignee: Robert Bosch GmbH
• Original Assignee: Robert Bosch GmbH
• Inventors: Liisberg, Mikkel, Gebauer, Carsten, Schleser, Roland
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US15/271,496
• Publication Number:
  US 20170091011A1
• Time in Patent Office: 1,084 Days
• CPC Class Codes: G06F 11/0724 in a multiprocessor or a multi-core unit multiprocessors per se G06F15/80
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 11/079 Root cause analysis, i.e. error or fault diagnosis in a hardware test environment G06F11/22; in a software test environment G06F11/36
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/16 Error detection or correction of the data by redundancy in hardware
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: H04L 1/24 Testing correct operation

Abstract

A method for generating an output data stream from an input data stream, a processing unit receives a first input data stream including a first data set, and this processing unit receives, from a further processing unit, a second set of metadata, which describes a second data set of a second input data stream of this further processing unit, the processing unit outputs or does not output, as a function of the second set of metadata, an output data set of the output data stream generated from the first data set.

Claims

1. A method for generating an output data stream from an input data stream for an automated driving system of a vehicle, the method comprising:

receiving, by a processing unit, a first input data stream including a first plurality of data sets;

receiving, by the processing unit from a further processing unit, a second set of metadata, which describe a second plurality of data sets received by the further processing unit in a second input data stream of the further processing unit;

determining, by the processing unit, based on the second set of metadata, which data sets of the first plurality of data sets were received by the further processing unit in the second input data stream;

determining, by the processing unit, based on the second set of metadata, that at least one data set of the first plurality of data sets was not received by the further processing unit in the second input data stream;

outputting into a first output data stream, by the processing unit to a comparator, for each data set of the first plurality of data sets, a respective output data set generated from the data set, the outputting of the respective output data set being only for those data sets of the first plurality of data sets that were determined, in the determining step, to have been received by the further processing unit;

outputting nothing or an empty data set to the comparator into the first output data stream for each of the at least one data set of the first plurality of data sets that was not determined, in the determining step, to have been received by the further processing unit;

comparing, by the comparator, the first output data stream from the processing unit with a second output data stream from the second processing unit, the second output data stream being generated by the further processing unit based on the second plurality of data sets;

determining, based on the comparing, that the first output stream and the second output stream are not identical; and

based on the determining that the first output stream and the second output stream are not identical, transferring the automated driving system of the vehicle into a safe mode.

3. The method as recited in claim 1, wherein the processing unit transmits the first set of metadata to the further processing unit.

4. The method as recited in claim 1, wherein the processing unit and the further processing unit respectively receive the first data stream and the second data stream from the same source.

8. The method as recited in claim 1, wherein the transferring of the automated driving system of the vehicle into the safe mode includes deactivating a safety-critical function of the automated driving system.

9. The method as recited in claim 1, wherein the transferring of the automated driving system of the vehicle into the safe mode includes reducing a traveling speed of the vehicle.

10. The method as recited in claim 1, further comprising:

controlling the automated driving system using the first output data stream.

11. The method as recited in claim 1, wherein to generate first output stream by the processing unit, and to generate the second output stream by the further processing unit, the processing unit and the further processing unit perform redundant calculations, relative to one another.

2. A system for generating an output data stream from an input data stream for an automated driving system of a vehicle, comprising:

at least two processing units, wherein at least one of the processing units is configured to perform the following tasks;

(a) receive a first input data stream including a first plurality of data sets,

(b) receive from a further processing unit a second set of metadata, which describe a second plurality of data sets received by the further processing unit in a second input data stream of the further processing unit,

(c) determine, based on the second set of metadata, which data sets of the plurality of data sets were received by the further processing unit in the first plurality of data sets,

(d) output into a first output data stream to a comparator, for each data set of the first plurality of data sets, a respective output data set generated from the data set, the outputting of the respective output data set being only for those data sets of the first plurality of data sets that were determined, in (c), to have been received by the further processing, and

(e) output nothing or an empty data set to the comparator into the first output data stream for each of the first plurality of data sets that was not determined, in (c), to have been received by the further processing unit; and

a comparator that compares the first output data stream from the processing unit with a second output data stream from the further processing unit, the second output data stream being generated by the further processing unit based on the second plurality of data sets;

wherein, the system is configured to transfer the automated driving system of the vehicle into a safe mode if the first output stream is not identical to the second output stream based on the comparison by the comparator.

5. The system as recited in claim 2, wherein each of the processing units is designed to perform (a), (b), (c), (d) and (e).

6. The system as recited in claim 2, wherein the comparator outputs an error message and/or turns off the output data stream, when the first output data stream transmitted to it by the processing unit and the second output data stream transmitted to it by the further processing unit do not coincide.

7. The system as recited in claim 2, wherein the system includes a network over which the metadata are exchanged.

12. The system as recited in claim 2, wherein the transfer of the automated driving system of the vehicle into the safe mode includes deactivating a safety-critical function of the automated driving system.

13. The system as recited in claim 2, wherein the transfer of the automated driving system of the vehicle into the safe mode includes reducing a traveling speed of the vehicle.

14. The system as recited in claim 2, wherein the system controls the automated driving system using the first output data stream.

15. The system as recited in claim 2, wherein to generate first output stream by the processing unit, and to generate the second output stream by the further processing unit, the processing unit and the further processing unit perform redundant calculations, relative to one another.

16. A non-transitory machine-readable memory medium on which is stored a computer program, which is executable by a processor unit, comprising:

a program code arrangement having program code for generating an output data stream from an input data stream for an automated driving system of a vehicle, by causing the processing unit to perform the following;

receiving, by the processing unit, a first input data stream including a first plurality of data sets;

receiving, by the processing unit from a further processing unit, a second set of metadata, which describe a second plurality of data sets received by the further processing unit in a second input data stream of the further processing unit;

determining, by the processing unit, based on the second set of metadata, which data sets of the first plurality of data sets were received by the further processing unit in the second input data stream;

determining, by the processing unit, based on the second set of metadata, that at least one data set of the first plurality of data sets was not received by the further processing unit in the second input data stream;

outputting into a first output data stream, by the processing unit to a comparator, for each data set of the first plurality of data sets, a respective output data set generated from the data set, the outputting of the respective output data set being only for those data sets of the first plurality of data sets that were determined, in the determining step, to have been received by the further processing;

outputting nothing or an empty data set to the comparator into the first output data stream for each of the at least one data set of the first plurality of data sets that was not determined, in the determining step, to have been received by the further processing unit;

comparing, by the comparator, the first output data stream from the processing unit with a second output data stream from the second processing unit, the second output data stream being generated by the further processing unit based on the second plurality of data sets;

determining, based on the comparing, that the first output stream and the second output stream are not identical; and

based on the determining that the first output stream and the second output stream are not identical, transferring the automated driving system of the vehicle into a safe mode.