Error-tolerant data processing system

1 . An error-tolerant data processing system for generating safe behavior of an automatically operable vehicle, the data processing system comprising:

at least two hardware modules comprising a first hardware module and a second hardware module, the at least two hardware modules configured to operate:

in a redundant operating mode to generate results for a specified task independently of one another; and

in at least one complementary operating mode in which the first hardware module generates a first result for a first subtask and the second hardware module generates a second result for a second subtask different from the first subtask; and

at least one switching component configured to select a current operating mode for the at least two hardware modules, the current operating mode being either the redundant operating mode or the at least one complementary operating mode.

2 . The data processing system as recited in claim 1 , wherein the switching component is configured to monitor at least one switchover condition for a switchover between at least two different operating modes comprising the redundant operating mode and the at least one complementary operating mode and effects a switchover between the at least two different operating modes when the at least one switchover condition is satisfied.

3 . The data processing system as recited in claim 1 , wherein the specified task and the different subtasks are implemented in the form of corresponding software modules in the at least two hardware modules, wherein the software modules are processed based on the selected current operating mode.

4 . The data processing system as recited in claim 3 , wherein, using the switching component, it is ensured that all required input data are available to the software modules to be processed in the current operating mode in the at least two hardware modules.

5 . The data processing system as recited in claim 1 , further comprising:

at least one combination module, with which:

in the redundant operating mode, the independently generated results for the specified task are combined to increase fail-safety of the automatically operable vehicle, and

in the at least one complementary operating mode, the results generated for the different subtasks are combined to produce an overall result.

6 . The data processing system as recited in claim 5 , further comprising:

at least one further hardware module to which a further subtask is assigned in the at least one complementary operating mode, such that the at least one further hardware module is used in the at least one complementary operating mode to generate partial results and make the partial results available to the combination module.

7 . The data processing system as recited in claim 1 , wherein the at least one switching component is further configured:

to recognize an occurrence of an error and/or failure situation at a first time and an end of the error and/or failure situation at a second time different from the first time,

to effect a switchover from the redundant operating mode to a complementary operating mode of the at least one complementary mode in response to recognizing the occurrence of the error and/or failure situation at the first time, and

to effect a switchover from the complementary operating mode to the redundant operating mode in response to recognizing the end of the error and/or failure situation at the second time.

8 . The data processing system as recited in claim 1 , wherein the at least one switching component is configured:

to recognize an occurrence and an end of an exceptional situation including a pre-crash situation, and/or a minimum risk maneuver and/or an emergency braking action,

to effect a switchover from the redundant operating mode to a complementary operating mode of the at least one complementary mode when the exceptional situation occurs, and

at the end of the exceptional situation, to effect a switchover from the complementary operating mode to the redundant operating mode.

9 . The data processing system as recited in claim 1 , further comprising an interface module controlled via the at least one switching component and configured to:

transmit first data associated with the specified task to the at least two hardware modules when the at least one switching component selects the redundant operating mode for the at least two hardware modules; and

transmit second data to the first hardware module associated with the first subtask and third data, different from the second data, to the second hardware module associated with the second subtask, wherein the transmitting of the second data and the third data occurs when the at least one switching component selects the at least one complementary operating mode for the at least two hardware modules.