VEHICLE CONTROL MODULES INCLUDING CONTAINERIZED ORCHESTRATION AND RESOURCE MANAGEMENT FOR MIXED CRITICALITY SYSTEMS

20240308533

18/121725

March 15, 2023

A vehicle control method includes defining a set of multiple workloads, each workload including a workload descriptor and at least one containerized image configured to execute at least one vehicle control process, the workload descriptor defining a safety level of the workload, one or more vehicle system resources used by the least one containerized image of the workload, and a vehicle system location for executing the containerized images. The method includes allocating vehicle system resources to each workload according to the workload descriptors, wherein the vehicle system resources include at least one of a central processor utilization, a graphics processor utilization, a memory size, an artificial intelligence accelerator, or a video codec, executing the vehicle control processes of the containerized images of the multiple workloads, and in response to a vehicle system resource conflict, assigning higher priority resource access to workloads having a critical safety level.

1. A vehicle control method comprising: defining a set of multiple workloads, each workload including a workload descriptor and at least one containerized image configured to execute at least one vehicle control process, the workload descriptor defining a safety level of the workload, a recovery mechanism for the workload, one or more vehicle system resources used by the at least one containerized image of the workload, and a vehicle system location for executing the containerized images of the workload; allocating vehicle system resources to each workload according to the workload descriptors, wherein the vehicle system resources include at least one of a central processor utilization, a graphics processor utilization, a memory size, an artificial intelligence accelerator, or a video codec; executing the vehicle control processes of the containerized images of the multiple workloads; and in response to a vehicle system resource conflict, assigning higher priority resource access to workloads having a critical safety level and assigning lower priority resource access to workloads having a non-critical safety level.

2. The method of claim 1, further comprising: assigning a first one of the vehicle system resources to a first one of the multiple workloads; and assigning a second one of the vehicle system resources to a second one of the multiple workloads, wherein the second one of the multiple workloads is inhibited from accessing the first one of the vehicle system resources.

3. The method of claim 1, further comprising: monitoring resource usage of each workload; comparing the monitored resource usage of each workload to a threshold resource usage value associated with the workload; and in response to the monitored resource usage of one of the multiple workloads exceeding the threshold resource usage value associated with the workload, restricting the workload from accessing at least one of the vehicle system resources.

4. The method of claim 3, wherein: monitoring resource usage of each workload is performed by an orchestrator module or a separate monitor module used by the orchestrator module; and the orchestrator module is configured to load the workload descriptor of each of the multiple workloads to determine the threshold resource usage value associated with each workload.

5. The method of claim 1, further comprising: inhibiting access to a vehicle system resource by the multiple workloads; receiving a request from one of the multiple workloads to access the vehicle system resource; comparing the one of the one of the multiple workloads to a resource permission list; allowing the one of the multiple workloads to utilize the vehicle system resource in response an indication in the resource permission list that the one of the multiple workloads is permitted to utilize the vehicle system resource; and denying the one of the multiple workloads from utilizing the vehicle system resource in response an indication in the resource permission list that the one of the multiple workloads is not permitted to utilize the vehicle system resource.

6. The method of claim 1, wherein each containerized image is configured to execute as at least one of a file, a binary format or a memory buffer.

7. The method of claim 6, wherein each containerized image includes a configuration file configured to specify an order of loading and unloading each process component associated with the containerized image.

8. The method of claim 1, further comprising: monitoring operation of each workload for an error condition; and in response to detecting the error condition for one of the multiple workloads: determining the safety level of the one of the multiple workloads having the error condition; automatically shutting down one or more vehicle control processes of the one of the multiple workloads having the error condition, in response to the safety level being a non-critical safety level; and requesting a managed shutdown of the one or more vehicle control processes of the one of the multiple workloads having the error condition in response to the safety level being a critical safety level.

9. The method of claim 8, further comprising: in response to the safety level being a non-critical safety level, automatically restarting the one or more vehicle control processes of the one of the multiple workloads having the error condition; and in response to the safety level being a critical safety level, requesting a managed restart of the one or more vehicle control processes of the one of the multiple workloads having the error condition.

10. The method of claim 1, further comprising: receiving, by an orchestrator module, the set of multiple workloads; and for each containerized image in the set of multiple workloads: loading the containerized image at a defined location when the workload descriptor associated with the containerized image specifies a loading location for the containerized image; and when the workload descriptor associated with the containerized image does not specify a loading location for the containerized image, identifying a system resource location where vehicle system resources are available and loading the containerized image at the system resource location.

11. The method of claim 1, wherein: one of the multiple workloads is an autonomous driving workload; and each vehicle control process associated with a containerized image of the autonomous driving workload is configured to control at least one autonomous driving feature of a vehicle.

12. The method of claim 1, wherein: at least one of the multiple workloads has a critical safety level and includes a vehicle braking control process; and at least one of the multiple workloads has a non-critical safety level and includes at least one of an infotainment system control process or a heating, air-conditioning and ventilation (HVAC) system control process.

13. The method of claim 1, wherein at least one of the multiple workloads includes two containerized images that are configured to execute on different operating systems.

14. The method of claim 13, wherein a hypervisor module is configured to control operation of the different operating systems via a same system-on-chip implementation.

15. A vehicle control system comprising: a motor configured to drive wheels of a vehicle; a braking module configured to inhibit rotation of the wheels of the vehicle; and a vehicle control module configured to: define a set of multiple workloads, each workload including a workload descriptor and at least one containerized image configured to execute a vehicle control process, the workload descriptor defining a safety level of the workload, a recovery mechanism for the workload, one or more vehicle system resources used by the at least one containerized image of the workload, and a vehicle system location for executing the vehicle control process of the containerized image of the workload; allocate vehicle system resources to each workload according to the workload descriptors, wherein the vehicle system resources include at least one of a central processor utilization, a graphics processor utilization, a memory size, an artificial intelligence accelerator, or a video codec; execute the vehicle control processes of the containerized images of the multiple workloads; and in response to a vehicle system resource conflict, assign higher priority resource access to workloads having a critical safety level and assign lower priority resource access to workloads having a non-critical safety level.

16. The vehicle control system of claim 15, wherein the vehicle control module is configured to: assign a first one of the vehicle system resources to a first one of the multiple workloads; and assign a second one of the vehicle system resources to a second one of the multiple workloads, wherein the second one of the multiple workloads is inhibited from accessing the first one of the vehicle system resources.

17. The vehicle control system of claim 15, wherein the vehicle control module is configured to: monitor resource usage of each workload; compare the monitored resource usage of each workload to a threshold resource usage value associated with the workload; and in response to the monitored resource usage of one of the multiple workloads exceeding the threshold resource usage value associated with the workload, restricting the workload from accessing at least one of the vehicle system resources.

18. The vehicle control system of claim 17, further comprising an orchestrator module configured to: monitor usage of each workload; and load the workload descriptor of each of the multiple workloads to determine the threshold resource usage value associated with each workload.

19. The vehicle control system of claim 15, wherein the vehicle control module is configured to: inhibit access to at least one of the vehicle system resources by the multiple workloads; receive a request from one of the multiple workloads to access the at least one of the vehicle system resources; compare the one of the one of the multiple workloads to a resource permission list; allow the one of the multiple workloads to utilize the at least one of the vehicle system resources in response an indication in the resource permission list that the one of the multiple workloads is permitted to utilize the at least one of the vehicle system resources; and deny the one of the multiple workloads from utilizing the at least one of the vehicle system resources in response an indication in the resource permission list that the one of the multiple workloads is not permitted to utilize the at least one of the vehicle system resources.

20. The vehicle control system of claim 15, wherein each containerized image is configured to execute as at least one of a file, a binary format or a memory buffer.

60; 60; 60; 60

edspap.20240308533