DE102018204433A1 - Prioritized control and / or operating device for vehicle systems - Google Patents

Abstract

Control and / or operating device (1) for at least one first vehicle system (50), comprising at least one processor (2), at least one interface (3) for exchanging information with the first vehicle system (50) and at least one mass memory (45) with a first file system (4), wherein the device (1) is set up so that the processor (2) activates the device (1) in a first start phase (100) from the first file system (4) an operating system kernel (6). and first program code (7) for driving the first vehicle system (50) reads (110) and executes (140) so as to make the first vehicle system (50) operable, wherein a second file system (5) with a second program code (9 ) is provided, the execution of which is subordinate to the operation of the vehicle (200) in comparison to the production of an operable state in the first vehicle system (50), wherein the device (1) is arranged so that in a second starting phase (150) starting after completion of the first startup phase (100), accessing (160) the second file system (5), and executing (170) the second program code (9).

Description

The invention relates to control and / or operating devices for systems of land, air and water vehicles.

In many current vehicles infotainment systems are installed, which unite, for example, in just one device, a navigation system, a radio, a CD or DVD player, a handsfree for a mobile phone and possibly even more functions.

Increasingly, these systems are no longer used only for pure infotainment, but also interlocked with essential systems of the vehicle. For example, it is advantageous to display the menu structure, via which, for example, the reset of the tire pressure monitoring can be called up, on the large screen of the infotainment system. The function will then be found easier and faster. Also, the large screen can be used, for example, when reversing to display the image of a rear view camera, so that the driver can fully see the area behind the vehicle.

Analogous to the development of operating systems and user software for PCs, the size and complexity of the software grows with increasing functionality of the infotainment systems. This increases the time the infotainment system needs to boot up when the vehicle is put into service. It is annoying for the driver if, after switching on the ignition, this start-up must first be awaited before, for example, the reversing camera is available. The driver may therefore be tempted to reset the vehicle even before the image of the reversing camera appears on the screen. This is associated with the risk of accidents.

From the WO 2015/150 871 A1 An infotainment system is known which prioritizes the functionality required for the start-up of the reversing camera and relocates it to an earlier start-up phase of the operating system in order to provide a camera image as quickly as possible.

In the context of the invention, a control and / or operating device for at least a first vehicle system has been developed. This device comprises at least one processor, at least one interface for exchanging information with the first vehicle system and at least one mass storage device with a first file system.

The device is set up so that the processor, upon activation of the device in a first start-up phase from the first file system reads in and executes an operating system kernel and first program code for driving the first vehicle system so as to make the first vehicle system operable.

There is further provided a second file system with a second program code, the execution of which is subordinate to the operation of the vehicle compared to establishing an operable state in the first vehicle system.

The device is set up to access the second file system and run the second program code in a second boot phase that begins after the first boot phase is completed.

It has been recognized that the increasing size of the software in infotainment systems for vehicles also increases the size of the file system on which the software operates. Furthermore, the constant increase in functionality in the infotainment systems causes the file system to process more and more user data, such as digital maps for navigation systems or entertainment media. However, the larger the file system, the longer it takes to boot the device until the file system is mounted and files can be read from it. This is especially true if the file system needs to be checked for consistency before being mounted.

For example, such a check may be triggered periodically after a certain number of uses, or after a certain time since the last check. However, a check can also be triggered on an ad-hoc basis, for example if the file system was not properly unmounted during the last shutdown. This can happen, for example, when the device is switched on before the engine is started and, when the starter is actuated, the on-board network voltage briefly drops to such an extent that the processor of the device is caused to restart.

By now reserving the first file system for those files which are necessary for the control of the first vehicle system, this may be many times smaller in relation to the second file system. Accordingly, the first file system can be checked much faster and finally hooked. A further increase in functionality in the infotainment system thus no longer means that it takes longer for the first vehicle system to be operational.

In a particularly advantageous embodiment, the first file system additionally contains configuration settings for the first Vehicle system. The first program code is set up to control the first vehicle system in accordance with these configuration settings.

In this way, a configuration that was persisted the last time the device was used in the configuration settings can be quickly recalled the next time the device is activated. Access to the second, larger file system, possibly with delays, is not required.

In a particularly advantageous embodiment, the first vehicle system is a system whose operable state is a necessary prerequisite for ensuring that the vehicle as a whole is roadworthy and / or that operation of the vehicle is permitted. The traffic-safe state, or the state in which the operation of the vehicle is permitted, is then reached faster. Since the commissioning of many essential vehicle systems is only possible when the engine is running, especially environmentally harmful waiting times are avoided with the engine running.

The first vehicle system may include, for example, a rear view camera, a tire pressure monitoring system, a steering system, a braking system, a restraint system, an automatic emergency call system, and / or an exhaust aftertreatment system. Especially with such systems, it may be directly or indirectly prescribed that the vehicle is only put into operation when these systems are working properly. If, for example, tires with run-flat properties are used, a functioning tire pressure monitoring is prescribed. In the case of non-functioning SCR catalytic converters for exhaust aftertreatment, it is even stipulated that it may no longer be possible to start the vehicle. A requirement that the area immediately behind the vehicle must be visible when reversing, implies in a hidden by the design of the vehicle direct line of sight that a rear view camera must be present and functional.

In a particularly advantageous embodiment, an interface for controlling an immobilizer or warning device of the vehicle is provided. The device is set up to release the immobilizer after completion of the first start phase, or to activate the warning device when the vehicle is moving before completion of the first start phase.

In this way, it is ensured that the vehicle is only moved when the operationally safe or regulatory compliant state is established by activation and control of essential for the operation vehicle systems.

The immobilizer can block the engine start, for example. Particularly advantageous, however, they can allow the engine to start and block the drive in other ways, such as by the release of a parking brake, the insertion of a gear in the automatic transmission, the disengagement or the gear change is blocked in the manual transmission. As mentioned above, it may happen that the vehicle battery is in a short state of charge when the starter motor is actuated, the vehicle electrical system voltage sags and the processor of the control and / or operating device is restarted. If this in turn causes the immobilizer to be reactivated and the engine to be stopped again, then an "infinite loop" may occur and a ride is not possible.

In particular, the warning device can be a warning device which can be acoustically and / or optically perceived by the driver and inform the driver that the movement of the vehicle is actually not safe or not legally compliant. This makes it clear to the driver that he alone is responsible for any accidents and damage and not the vehicle manufacturer. The warning device may in particular be designed so that it acts with increasing intensity in time to allow the driver, for example, a short maneuvering, but to obliterate him a longer ride.

In a particularly advantageous embodiment, the second program code is used to provide an extended functionality of the first vehicle system, the control of a navigation, information or Kommmunikationssystems, and / or the reproduction of image and / or sound of entertainment media. The second program code can also be used, for example, to control a second vehicle system, which assists the driver in coping with the driving task and / or improves ride comfort without compromising driving safety if this second vehicle system is not functional. As explained above, the functionality in this regard can be expanded as desired, without having to wait longer until the vehicle can be safely moved.

The control and / or operating device can also take over functions of a combination instrument of the vehicle in a further advantageous embodiment and display, for example, instrument displays on a screen of the infotainment system. These instrument displays can then include both displays that are essential to driving (such as the display of speed), as well as less important displays (such as the display of the engine speed or a normal cooling water temperature). According to these priorities, the associated program code can then be assigned to the first or second program code. For example, the display of the speed during the first starting phase and the display of the engine speed may then only appear during the second starting phase.

In a further particularly advantageous embodiment, the second program code is used to receive configuration settings for the first vehicle system via a man-machine interface. The device is set up to store these configuration settings in the first file system. In this way, a changed configuration can be persisted for the next activation of the device and then be available already in the first start-up phase.

The transfer of the new configuration settings to the first file system can be done in several ways. For example, the second program code may write these settings directly to the first file system when it is mounted. However, the settings can also be passed to the first program code, for example, so that it persists in the first file system. Then, for example, a check for plausibility can be made so that the first vehicle system is not inoperative by nonsensical settings.

As previously discussed, the first file system may be significantly smaller in size than the second file system. This not only speeds up the commissioning of the first vehicle system, but also makes it possible to hedge against possible corruption of the first file system.

In a particularly advantageous embodiment, a backup memory for the first file system is provided. The device is adapted to store the current state of the first file system in the backup memory in response to a successful completion of the first boot phase. The backup memory will then always contain the last known working configuration of the first file system.

Advantageously, the device is adapted to restore the state of the first file system from the backup memory in response to a failure of the first boot phase. In this way, for example, a failed update of the kernel that leaves the device in a non-bootable state, or a corrupted configuration file that can no longer be properly handled by the first program code, can be repaired.

Alternatively or in combination, a read-only memory may be provided with a factory configuration of the first file system. For example, in response to a failure of the first startup phase, and / or, for example, in response to the actuation of a reset device, the state of the first file system may be restored from the read only memory. In doing so, the factory configuration may have limited functionality over the normal configuration to maximize the likelihood that the first vehicle system can be put into service and the vehicle can continue. Thus, the vehicle can reach a workshop, at least on its own.

For example, the first and second file systems may be implemented in separate partitions on the same physical volume. But it can also be stored, for example, the first file system on a high-quality, particularly reliable flash memory and the second file system, which also serves to store large entertainment media, such as on a per unit capacity significantly cheaper SSD. The rugged flash memory for the first file system then ensures that the vehicle as a whole still works when the cheaper SSD fails. The same applies if the SSD is replaced by an even cheaper electromechanical hard disk per unit capacity. For example, a hard drive may be affected by vibration or may experience difficulty in cold temperatures.

In a particularly advantageous embodiment, the operating system kernel is a Linux kernel. This saves on the one hand license costs for supplied control and / or operating devices. On the other hand, the Linux kernel is particularly flexible in terms of which file system from which additional program code is reloaded.

For example, the first program code, and optionally the configuration settings for the first vehicle system, may be stored on the first file system in a container that is loadable by the Linux kernel as an initial ramdisk. An initial ramdisk can be processed by the Linux kernel without any additional drivers or other software. Furthermore, after completion of the first startup phase, the container can also be mounted directly with read and write access in order to directly persist changes to the configuration settings there.

The redistribution of the program code executed on the control and / or operating device described above can be implemented completely or partially in software without changing the hardware. For example, an upgrade kit may be distributed that repartitions a physical disk of the device, and then plays the first program code, the second program code, and the configuration settings.

Therefore, the invention also relates to a program element which, when executed on a computer and / or a device, upgrades the computer and / or the device to a control and / or operating device according to the invention, and / or causes the computer to upgrade a device to a control and / or operating device according to the invention. Likewise, the invention also relates to a machine-readable data carrier or a download product with the program element.

Furthermore, the invention also relates to a vehicle having at least a first vehicle system and a control and / or operating device according to the invention.

• 1: Beispielhaftes Fahrzeug 200 mit beispielhaftem Steuer- und/oder Bediengerät 1;
• 2: Beispielhafte Darstellung der ersten Startphase 100 und der zweiten Startphase 150.

The subject matter of the invention will be explained below with reference to figures, without the subject matter of the invention being limited thereby. It is shown:

• 1 Image: Exemplary vehicle 200 with exemplary control and / or operating device 1 ;
• 2 : Exemplary presentation of the first start phase 100 and the second starting phase 150 ,

1 schematically shows an exemplary vehicle 200 with an exemplary control and / or operating device 1 ,

The vehicle 200 has a reversing camera as the first vehicle system 50 and a second vehicle system 51 , The first vehicle system 50 and the second vehicle system 51 is from the control and / or HMI device 1 via its bidirectional interface 3 controllable.

In addition, the vehicle has 200 still about an immobilizer 52 , and / or via a warning device 53 , The immobilizer 52 , and / or the warning device 53 , is from the control and / or HMI device 1 over its further interface 10 controllable.

The control and / or operating device 1 has a processor 2 and a mass storage 45 on which a first file system 4 and a second file system 5 are stored. On the first file system 4 is a Linux kernel as operating system kernel 6 stored. In addition, there is a container 13 filed, the first program code 7 for the control of the first vehicle system 50 and related configuration settings 8th contains. The content of the container 13 can the kernel 6 after its start as an initial ramdisk 13 be supplied.

The second file system 5 contains second program code 9 for the control of the second vehicle system 51 and optionally associated configuration settings 9a and user data 9b , The user data 9b may be, for example, entertainment media.

It is a backup storage 4a intended. Run on the basis of the first file system 4 completed first start phase 100 successful, this will be the current state of the first file system 4 in the backup memory 4a deposited there and represents the last known as working configuration. Beat the first startup phase 100 later fails once, the state of the first file system from the backup memory 4a be restored.

It is still a read-only memory 4b with a factory configuration of the first file system 4 intended. Beat the first startup phase 100 fails, and / or becomes a reset button 12 pressed, this factory configuration can be on the first file system 4 written to restore at least basic functionality.

The control and / or operating device 1 also has a man-machine interface 11 , about the configuration settings 8th for the first vehicle system 50 can be entered.

2 explains schematically the first starting phase 100 and the second start phase 150 , In the first starting phase 100 be in step first 110 the Linux kernel 6 and the container 13 from the first file system 4 read. The container 13 is in the memory 14 copied. The Linux kernel 6 will be in step 120 starting with a reference to the place where the container 13 in memory 14 is deposited.

In step 130 binds the Linux kernel 6 the contents of the container 13 as an initial ramdisk 13a one. This gives him access to the first program code 7 and the associated configuration settings 8th , In step 140 becomes the first program code 7 Running to the first vehicle system 50 head for.

The steps 110 to 140 form the first starting phase 100 ,

Subsequently, in step 160 on the second file system 5 accessed. This will give access to the second program code 9 , the associated configuration settings 9a as well as the user data 9b receive. This can be done in step 170 the second program code 9 be executed to the second vehicle system 51 head for.

The steps 110 and 120 will be directed by the bootloader 301 of the device 1 carried out. The steps 130 to 170 are being directed by the operating system 302 of the device 1 carried out.

LIST OF REFERENCE NUMBERS

1

Control and / or HMI device

2

Processor of the device 1

3

Interface device 1 to systems 50 and 51

4

first file system

4a

Backup storage for first file system 4

4b

Read-only memory with factory version of the file system 4

5

second file system

6

Operating system kernel

7

first program code for vehicle system 50

8th

Configuration settings for program code 7

9

second program code for vehicle system 51

9a

Configuration settings for program code 9

9b

user data

10

Interface device 1 to lock 52 , Warner 53

11

Human machine interface for settings 8th

12

Reset device

13

Container

13a

initial ramdisk

14

random access memory

50

first vehicle system

51

second vehicle system

52

immobilizer

53

warning device

100

first start phase

110

Reading the container 13

120

Start the kernel 6 through the bootloader 301

130

Integration of the initial ramdisk 13a

140

Execute the first program code 7

150

second start phase

160

Access to second file system 5

170

Execution of the second program code 9

301

Bootloader of the device 1

302

Operating system of the device 1

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited patent literature

• WO 2015/150871 A1 [0005]

Claims (15)

Control and / or operating device (1) for at least one first vehicle system (50), comprising at least one processor (2), at least one interface (3) for exchanging information with the first vehicle system (50) and at least one mass memory (45) with a first file system (4), wherein the device (1) is set up so that the processor (2) activates the device (1) in a first start phase (100) from the first file system (4) an operating system kernel (6). and first program code (7) for driving the first vehicle system (50) reads (110) and executes (140) so as to make the first vehicle system (50) operable, wherein a second file system (5) with a second program code (9 ) is provided, the execution of which is subordinate to the operation of the vehicle (200) in comparison to the production of an operable state in the first vehicle system (50), wherein the device (1) is arranged so that in a second starting phase (150) starting after completion of the first startup phase (100), accessing (160) the second file system (5), and executing (170) the second program code (9). Control and / or operating device (1) after Claim 1 wherein the first file system (4) additionally includes configuration settings (8) for the first vehicle system (50), and wherein the first program code (7) is adapted to drive the first vehicle system (50) in accordance with those configuration settings (8). Control and / or operating device (1) according to one of Claims 1 to 2 wherein the first vehicle system (50) is a system whose operational condition is necessary to ensure that the vehicle (200) as a whole is roadworthy and / or that operation of the vehicle (200) is permitted. Control and / or operating device (1) after Claim 3 wherein the first vehicle system (50) comprises a reversing camera, a system for monitoring the tire pressure, a steering system, a brake system, a restraint system, an automatic emergency call system and / or an exhaust aftertreatment system. Control and / or operating device (1) according to one of Claims 3 to 4 in which an interface (10) is provided for activating an immobilizer (52) or warning device (53) of the vehicle (200) and wherein the device (1) is set up to activate the immobilizer (52) after completion of the first starting phase (150). to release or, upon movement of the vehicle (200) before the completion of the first start phase (150) to activate the warning device (53). Control and / or operating device (1) according to one of Claims 1 to 5 wherein the second program code (9) is for providing enhanced functionality of the first vehicle system (50), driving a navigation, information or communication system, and / or reproducing the image and / or sound of entertainment media. Control and / or operating device (1) according to one of Claims 1 to 6 wherein the second program code (9) is used to control a second vehicle system (51) that assists the driver in coping with the driving task and / or improves ride comfort without compromising driving safety when this second vehicle system (51) is inoperable is Control and / or operating device (1) according to one of Claims 1 to 7 wherein the second program code (9) is for receiving configuration settings (8) for the first vehicle system (50) via a man-machine interface (11), and wherein the device (1) is adapted to maintain these configuration settings (8) in FIG store the first file system (4). Control and / or operating device (1) according to one of Claims 1 to 8th in which a backup memory (4a) is provided for the first file system (4), and wherein the device (1) is adapted, in response to a successful completion of the first start phase (100), the current state of the first file system (4). in the backup memory (4a) to deposit. Control and / or operating device (1) after Claim 9 wherein the device (1) is adapted to restore the state of the first file system (4) from the backup memory (4a) in response to a failure of the first boot phase (100). Control and / or operating device (1) according to one of Claims 1 to 10 wherein a read only memory (4b) is provided with a factory configuration of the first file system (4) and wherein the apparatus (1) is adapted to respond to a failure of the first boot phase (100), and / or Response to the actuation of a reset device (12) to restore the state of the first file system (4) from the read-only memory (4b). Control and / or operating device (1) according to one of Claims 1 to 11 , wherein the operating system kernel (6) is a Linux kernel. Control and / or operating device (1) after Claim 12 wherein the first program code (7), and optionally configuration settings (8) for the first vehicle system (50), on the first file system (4) are stored in a container (13) which is loadable by the Linux kernel (6) as an initial ramdisk (13a). Program element that, when executed on a computer and / or a device, the computer, and / or the device, to a control and / or operating device (1) according to one of Claims 1 to 13 upgrades, and / or causes the computer, a device to a control and / or operating device (1) according to one of Claims 1 to 13 upgrade. Vehicle (200) having at least a first vehicle system (50) and a control and / or operating device (1) according to one of Claims 1 to 13 ,

Images