DE102019201689A1 - Method and control unit for operating an autonomous vehicle - Google Patents

Abstract

Control unit (20) for an autonomous or partially autonomous vehicle (10), comprising a processor (40) which is designed to receive actual status data relating to the vehicle (1) via an interface (45) to a vehicle communication network (28), receiving target status data or control commands from a control system (100) via an interface (47) to a radio link (37); to determine a deviation between the target status data and the actual status data; and to control one or more vehicle components (12, 14, 16, 18) based on the deviation between the target state data and the actual state data in order to achieve or maintain a safe state of the vehicle (10).

Description

TECHNICAL AREA

The present disclosure relates to the field of autonomous vehicles, in particular a control unit and a method for controlling an autonomous or partially autonomous vehicle in order to achieve or maintain a safe state of the vehicle.

TECHNICAL BACKGROUND

Autonomous or semi-autonomous vehicles have sensors that detect at least the area in front of the vehicle in the direction of travel by sensors and whose data are evaluated in a control unit using suitable software. On the basis of the information obtained through this data processing, a control unit can automatically initiate and carry out braking, speed, distance, compensation and / or evasive regulation via appropriate actuators.

An autonomously moving vehicle, for example a driverless transport system (AGV), an autonomous car, a rail vehicle or a boat should be able to be monitored and remotely controlled at any time with the help of telemetry built into the vehicle or a similar physical radio link, taking functional safety into account. The aim is to protect the vehicle from damage to property and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.

Caused by EC Regulation No. 661/2009, emergency braking systems known as AEBS (Advanced Emergency Braking System) are increasingly being used in commercial vehicles, which output a warning signal when certain sensor data is available and, if necessary, autonomously initiate emergency braking with the greatest possible deceleration of the vehicle in order to avoid a To avoid a collision with another vehicle, a person or a stationary obstacle, or at least to reduce the consequences of an impending collision.

The operation of an autonomous vehicle should be as safe as possible, even in unforeseen situations and when technical errors occur, incorrect behavior of other road users and bad weather conditions. Maintaining a safe condition at all times of a journey is necessary so that the vehicle does not pose any danger to passengers or other road users.

The present invention was developed with regard to the problems described above, and it is the object of the present invention to implement a secured remote control for vehicles.

This object is achieved by the control unit according to claim 1, the control system according to claim 8, the control system according to claim 10, and the method for controlling an autonomous or partially autonomous vehicle according to claims 12 and 13. Further advantageous embodiments of the invention emerge from the subclaims and the following description of preferred exemplary embodiments of the present invention.

The exemplary embodiments show a control unit for an autonomous or partially autonomous vehicle, comprising a processor which is designed to receive actual status data relating to the vehicle via an interface to a vehicle communication network, target status data or control commands via an interface to a radio link from a control system to recieve; to determine a deviation between the target status data and the actual status data; and to control one or more vehicle components based on the discrepancy between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle.

The vehicle can in particular be a driverless, autonomous vehicle or a partially autonomous vehicle. For example, it can be a land, air or water vehicle, for example a driverless transport system (AGV), an autonomous car, a rail vehicle, a drone or a boat.

The status data relate to the status of the vehicle or the vehicle components. A state of the vehicle can in particular be understood to mean its position, location, direction of movement and speed. In the case of a watercraft, the condition of the vehicle can relate to the distance above ground, for example.

The processor can be, for example, a computing unit such as a central processing unit (CPU = central processing unit) that executes program instructions.

The acquisition, checking and processing of the actual status data, for example the vehicle data (e.g. CAN or camera data) is preferably carried out in real time.

The connection between the control system and the vehicle can be secured separately / redundantly and the vehicle can immediately follow Occurrence of an emergency, for example in the case of a break in the radio connection, a faulty vehicle state or faulty control data, or if a danger is detected, can be transferred to a safe state.

The processor of the control unit is also designed to send the actual status data to the control system via the radio link. In particular, the control unit enables secure transmission of vehicle status data (e.g. CAN data) and monitoring data via the radio link. For example, the actual status data sent to the control system can include image data that were captured with an image sensor integrated in the vehicle.

The actual status data can include, for example, a position, a speed, a steering angle, a yaw angle speed, a yaw rate, a position angle, a position angle acceleration, an acceleration and / or a transverse acceleration, or data from environment sensors.

For example, the processor of the control unit can be designed to receive image data relating to a vehicle environment from an optical sensor integrated in the vehicle. The data supplied by the optical sensor can be processed and prepared by means of image processing and compared with specified image data in order to infer a critical driving situation. The optical sensor can be a camera or an infrared camera.

Furthermore, the processor of the control unit can be designed to detect a direction of movement of the vehicle. In this way, it is possible, for example, to estimate whether a predetermined position range will be left if the current direction of movement is maintained. This information can be used to determine the current position of the vehicle when approaching the limits of the predetermined position range with a higher position determination frequency and to compare it with a predetermined target position. Thereby, a defective vehicle condition (defective position) can be detected with a minimum delay.

Furthermore, the control unit can be designed to recognize a critical driving situation on the basis of a yaw rate and / or a lateral acceleration of the vehicle detected by means of a sensor.

The actual state data can also include an actual trajectory and the control unit can be designed to recognize an error state on the basis of a comparison with a setpoint trajectory.

In addition, the control unit can be designed to receive information about a drive energy store and about the drive unit (for example functional information). On the basis of this information, the control unit can determine whether it can ensure that the specified destination can be achieved. If this is not the case, a control command can be generated to bring the vehicle into a safe state.

According to an exemplary embodiment of the present invention, the target status data can include a target position, a target orientation or control commands.

For example, the target state of the vehicle can be defined by a target position in a Cartesian coordinate system (x, y, z) and by a target orientation of the vehicle described by a position angle (roll, pitch, yaw).

Furthermore, the target status data can include a model-based image and the processor can be designed to recognize the discrepancy between the specified target status data and the actual status data on the basis of a model-based plausibility check.

The processor of the control unit can also be designed to evaluate time stamps that are received with the target status data. On the basis of the time stamp, the control unit can recognize the point in time for which a control command was provided and, if necessary, discard or correct commands in order to compensate for a brief failure of the radio link.

Furthermore, the target status data that are received by the control unit according to the present invention from the control system can include information that defines a safe driving area. If the radio connection to the control system breaks down, the vehicle can continue to move in the safe driving area.

The exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising the control unit as described above, and an emergency stop control unit which is designed to receive an activation signal for a safe state of the vehicle via a second radio link, and to control one or more vehicle components in response to the activation signal in such a way that a safe state of the vehicle is achieved.

In this way, a safe state of an autonomous vehicle is achieved without the involvement of a human driver Use of redundant and therefore highly available systems.

The exemplary embodiments furthermore also show a vehicle comprising a control unit or a control system as described above.

The exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising a processor which is designed to: send target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; To receive actual status data via the radio link from the control unit of the autonomous or partially autonomous vehicle; to determine a deviation between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data, to control the control unit of the autonomous or semi-autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.

The processor of the control system can also be designed to control an emergency stop control unit in the autonomous or semi-autonomous vehicle via a second radio link based on the deviation between the target status data and the actual status data or on the basis of a manual command in order to switch the vehicle into one safe state.

The exemplary embodiments also show a method for controlling an autonomous or semi-autonomous vehicle, comprising the steps: receiving, via an interface to a vehicle communication network, actual status data relating to the vehicle, receiving, via an interface to a radio link, from a control system of target Status data or control commands; Determining a deviation between the target status data and the actual status data; and controlling, based on the deviation between the target status data and the actual status data, one or more vehicle components in order to achieve or maintain a safe status of the vehicle.

The exemplary embodiments also show a method for managing an autonomous or partially autonomous vehicle, comprising the steps of: sending target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; Receiving actual status data via the radio link from the control unit of the autonomous or semi-autonomous vehicle; Determining a deviation between the target status data and the actual status data; and controlling, based on the deviation between the target status data and the actual status data, from the control unit of the autonomous or partially autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.

The method can further include the step of activating, based on the discrepancy between the target status data and the actual status data or on the basis of a manual command, an emergency stop control unit in the autonomous or semi-autonomous vehicle via a second radio link in order to put the vehicle in a safe position Convict state.

• 1 ein Blockdiagramm zeigt, das schematisch die Konfiguration eines autonomen Fahrzeugs gemäß einem Ausführungsbeispiel der vorliegenden Erfindung darstellt;
• 2 ein autonomes Fahrzeug gemäß der Erfindung zeigt, das über eine Funkverbindung mit einem als Leitstand bezeichneten externen Server in Verbindung steht;
• 3 ein Blockdiagramm zeigt, das eine beispielhafte Konfiguration der Safety-Steuereinheit 20 darstellt;
• 4a, b und c ein Ausführungsbeispiel eines Verfahrens gemäß der vorliegenden Erfindung veranschaulichen, wobei 4a die Schritte zeigt, die in dem Leitstand-Server ausgeführt werden zeigt, 4b die Schritte zeigt, die in der Safety-Steuereinheit des Fahrzeugs ausgeführt werden und 4c die Schritte zeigt, die in der Notaus-Steuereinheit ausgeführt werden;
• 5a ein weiteres Ausführungsbeispiel eines Verfahrens gemäß der vorliegenden Erfindung zeigt, wobei die Schritte dargestellt sind, die in dem Leitstand-Server ausgeführt werden;
• 5b ein weiteres Ausführungsbeispiel eines Verfahrens gemäß der vorliegenden Erfindung zeigt, wobei die Schritte dargestellt sind, die in dem Leitstand-Server ausgeführt werden;
• 6a eine Ausführungsform der Übertragung von Steuerbefehlen von Leitstand zur Safety-Steuereinheit zeigt; und
• 6b eine weitere Ausführungsform der Übertragung von Steuerbefehlen von Leitstand zur Safety-Steuereinheit zeigt.

Embodiments will now be described by way of example and with reference to the accompanying drawings, in which:

• 1 Fig. 13 is a block diagram schematically showing the configuration of an autonomous vehicle according to an embodiment of the present invention;
• 2 Figure 3 shows an autonomous vehicle according to the invention communicating via a radio link to an external server called a control room;
• 3 shows a block diagram showing an exemplary configuration of the safety control unit 20th represents;
• 4a, b and c illustrate an embodiment of a method according to the present invention, wherein 4a shows the steps to be performed in the control room server shows 4b shows the steps carried out in the vehicle's safety control unit and 4c shows the steps performed in the emergency stop control unit;
• 5a Figure 3 shows another embodiment of a method in accordance with the present invention showing the steps performed in the control room server;
• 5b Figure 3 shows another embodiment of a method in accordance with the present invention showing the steps performed in the control room server;
• 6a shows an embodiment of the transmission of control commands from the control station to the safety control unit; and
• 6b shows another embodiment of the transmission of control commands from the control station to the safety control unit.

1 Fig. 3 is a block diagram schematically showing the configuration of an autonomous vehicle 10 according to an embodiment of present invention. The autonomous vehicle 10 includes several electronic components that communicate via a vehicle communication network 28 are interconnected. The vehicle communication network 28 For example, a standard vehicle communication network installed in the vehicle such as a CAN bus (controller area network), a LIN bus (local interconnect network), a LAN bus (local area network), a MOST bus and / or a FlexRay Bus (registered trademark) or the like.

In the in 1 The example shown includes the autonomous vehicle 10 a control unit 12th (ECU 1) for a braking system. The braking system refers to the components that enable the vehicle to brake. The autonomous vehicle 10 further comprises a control unit 14th (ECU 2) that controls a power train. The drive train refers to the drive components of the vehicle. The powertrain may include an engine, a transmission, a drive / propeller shaft, a differential, and a final drive. The autonomous vehicle 10 further comprises a control unit 16 (ECU 3 ) that controls a steering system. The steering system refers to the components that enable directional control of the vehicle.

The control units 12th , 14th and 16 can also receive vehicle operating parameters from the vehicle subsystems mentioned above, which these detect by means of one or more vehicle sensors. Vehicle sensors are preferably those sensors that detect a state of the vehicle or a state of vehicle parts, in particular their state of movement. The sensors may include a vehicle speed sensor, a yaw rate sensor, an acceleration sensor, a steering wheel angle sensor, a vehicle load sensor, temperature sensors, pressure sensors, and the like. For example, sensors can also be arranged along the brake line in order to output signals which indicate the brake fluid pressure at various points along the hydraulic brake line. Other sensors in the vicinity of the wheel can be provided which detect the wheel speed and the brake pressure applied to the wheel.

The vehicle sensors of the autonomous vehicle 10 also includes a satellite navigation unit 24 (GNSS unit). It should be pointed out that, in the context of the present invention, GNSS is representative of all global navigation satellite systems (GNSS), such as GPS, A-GPS, Galileo, GLONASS (Russia), Compass (China), IRNSS (India) and the like.

The autonomous vehicle 10 furthermore comprises one or more sensors which are designed to detect the surroundings of the vehicle, the sensors being mounted on the vehicle and recording images of the surroundings of the vehicle, or to detect objects or states in the surroundings of the vehicle. The environment sensors 26th include in particular cameras, radar sensors, lidar sensors, ultrasonic sensors or the like. The environment sensors 26th can be arranged inside the vehicle or outside the vehicle (e.g. on the outside of the vehicle). For example, a camera in a front area of the vehicle 10 be provided for recording images of an area in front of the vehicle.

The autonomous vehicle 10 further comprises a control unit for autonomous driving 18th (ECU 4). The control unit for autonomous driving 18th is designed to be the autonomous vehicle 10 to be controlled in such a way that it can act completely or partially without the influence of a human driver. The control unit for autonomous driving 18th controls one or more vehicle subsystems while the vehicle is operating in autonomous mode, namely the braking system 12th , the drive system 14th and the steering system 16 . The control unit for autonomous driving can be used for this 18th for example via the vehicle communication network 28 with the corresponding control units 12th , 14th and 16 communicate. The control unit for autonomous driving 18th comprises in particular an image processing system for performing image processing processes. The image processing processes are, for example, the processing of image data from the environmental sensors 26th , for example from image data of an image recorded by a camera in the direction of travel of the area in front of the vehicle.

If an operating state for autonomous driving is activated on the control side or on the driver side, the control unit determines for autonomous driving 18th on the basis of inputs, such as data about a predetermined route, of data from the satellite navigation unit, of environmental data recorded by environmental sensors, and of vehicle operating parameters recorded by the vehicle sensors, which the control unit 18th from the control units 12th , 14th and 16 parameters for the autonomous operation of the vehicle (for example target speed, target torque, steering process and the like). The parameters can be used to control aspects of the vehicle subsystems, including the drive train, braking system and steering system, as well as auxiliary behavior (e.g. switching on the lights).

The autonomous vehicle 10 also includes a safety control unit (safety ECU) 20th which serves to keep the vehicle in a safe condition to keep or to bring to a safe state. The safety control unit 20th is a system-independent control unit in which vehicle data (e.g. CAN or camera data) are recorded, checked and processed in real time. The safety control unit 20th is also designed to use a radio link (see 2 ) to pass on recorded data to a control room and to receive setpoints or control commands from the control room. The safety control unit 20th is configured in such a way that it generates control commands on the basis of the recorded vehicle data upon detection of a fault condition in order to transfer the vehicle to a safe condition. If a deviation occurs, the safety control unit in particular controls 20th the control units 12th , 14th , 16 , 18th in such a way that the vehicle can automatically bring itself to a safe state (e.g. v = 0 km / h and the last successfully transmitted steering angle). Structure and functionality of the safety control unit 20th are in the embodiments of 2 , 3 , 4b and 5 described in more detail.

The autonomous vehicle 10 can also have an emergency stop control unit 30th include. The emergency stop control unit 30th is designed in such a way that it can be connected to an external central computer called a control station (hereinafter "server") 100 communicates and, when it receives an activation signal for a safe condition of the vehicle from the control center, the autonomous control unit 18th or the control units 12th , 14th and 16 controls the vehicle in such a way that the vehicle is brought into a safe state (e.g. v = 0 km / h and the last successfully transferred steering angle, see above).

The autonomous vehicle 10 further comprises a user interface 32 (HMI = Human-Machine-Interface) that enables a vehicle occupant to interact with one or more vehicle systems. This user interface 32 (for example a GUI = graphical user interface) can be an electronic display for outputting graphics, symbols and / or content in text form, and an input interface for receiving input (for example manual input, voice input and input through gestures, head or eye movements) include. The input interface can include, for example, keyboards, switches, touch-sensitive screens (touchscreen), eye trackers and the like.

2 shows an autonomous vehicle 10 according to the invention, which is connected via a radio link to an external central computer called a control station (hereinafter "server") 100 communicates.

The autonomous vehicle 10 according to the invention in particular comprises an autonomous control unit (ECU 4) 18th , a safety control unit (Safety-ECU) 20th and an emergency stop control unit (emergency stop ECU) 30th . From a control room 100 a first radio connection is established (e.g. initiated by a control room employee or a software control system) 37 to the vehicle 10 built up. That in the vehicle 10 integrated radio module 34 provides a connection to a system-independent safety ECU 20th in which vehicle data (e.g. CAN or camera data) are recorded, checked and processed in real time. The safety ECU 20th is designed to use the radio module 34 with the control center 100 to communicate. The safety ECU 20th is designed in such a way that it receives data such as target status data or control commands from the control center and transmits data such as actual status data (camera images, position, speed and the like) to the control center.

The control room 100 includes a central computer (server) 110 and a communication interface, in the example shown, a radio module 130 . The control station is designed to compare the actual current status data (actual status data) of the vehicle with specified target status data and, based on a deviation between the target status data and the actual status data, the safety control unit 20th of the vehicle 10 to drive to a safe condition of the vehicle 10 to achieve or to obtain.

The control center is also designed to send an activation signal for a safe condition of the vehicle via a second radio link 38 to an emergency stop control unit 30th to be transmitted in the vehicle when the actual status data of the vehicle deviate from the specified target status data, as shown in the 4a and 5 is described by way of example. The actual status data are provided by the safety ECU 20th of the vehicle 10 via the first communication interface 34 to the control room server 110 transmitted.

The control center is also designed to use the second radio connection if the radio connection with the safety controller is broken 38 an activation signal for a safe condition of the vehicle to the emergency stop control unit 30th to be transmitted in the vehicle. If communication with the safety controller fails via the first radio connection 37 is thus an activation of a safe state in the vehicle via the second radio link 38 still possible. The emergency stop control unit 30th is here via a second radio module 36 with the control center 100 connected and is designed so that when they are from the control room 100 an activation signal for a safe condition of the vehicle receives, the control units 12th , 14th , 16 , 18th controls the vehicle in such a way that the vehicle is brought into a safe state (e.g. v = 0 km / h and the last successfully transferred steering angle, see above). This means that the Safety-ECU uses a second 20th independent system also has a radio link to the vehicle 10 manufactured. In this way, if an error occurs, the vehicle can 10 can be brought into a safe state by actuating an emergency stop switch. An employee in the control room can, for example, operate a hand-held transmitter. Furthermore, the control system can automatically recognize that the target specifications are incorrectly interpreted or implemented by the vehicle and then activate the emergency stop switch (cf. 4a and corresponding description).

It can advantageously be used for communication between the vehicle 10 and the control center 100 a hybrid communication system can be used. Communication between the vehicle 10 and the control center, for example, through the joint integration of ad-hoc-based telecommunications standards according to IEEE 802.11, ETSI ITS-G5 in the 5.9 GHz range and the available standards for fully digital cellular networks, such as 3GPP Long Term Evolution (LTE) in the 800 MHz, 1800 MHz and 2600 MHz range. In order to increase the reliability, the two use radio links 37 , 38 preferably different technologies, for example different frequency bands, different transmission rates, or the like.

The safety ECU 20th According to the invention, it is designed to record vehicle state parameters (e.g. CAN or camera data) in real time, process them and initiate a corresponding vehicle reaction when an error state is detected, so that the vehicle automatically brings itself to a safe state. The safety ECU 20th is designed in particular to recognize, for example by comparing the actual status data with specified target status data, that an error status is present and in this case an instruction or an instructive action to the autonomous control unit 18th report back to bring the vehicle into a safe state. The safety ECU 20th is configured in particular in such a way that it detects deviations in the control system by comparing target and actual status data, for example between target and actual position.

Bringing the vehicle to a safe state can include, for example, one or more of the following measures: reducing the current speed, braking the vehicle with the maximum possible braking force, increasing safety distances, making changes in the planning and execution of driving maneuvers (e.g. increased curve radii) and stopping the vehicle in a safe place (e.g., hard shoulder of the highway, curb, parking lot). Furthermore, the safety control unit can, for example, after a brief failure of the radio link 20th request the last control command from the control center again. In addition, further measures are conceivable, all of which pursue the goal of protecting the vehicle from damage to property and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.

The safety ECU 20th can furthermore be designed to provide an avoidance or attenuation reaction of the vehicle to one or more predefined error states. The predefined error states can correspond to critical driving situations or driving events that represent an impending safety risk. If the autonomous vehicle is controlled as expected, it is possible that such conditions or events do not occur or only very rarely, so that the final control of the vehicle is solely with the autonomous control unit 18th which enables autonomous operation. However, the Safety-ECU detects 20th that the target specifications are incorrectly interpreted or implemented by the vehicle, the safety ECU can, independently of the control unit 18th for autonomous driving that determine the vehicle behavior, for example by directly addressing vehicle actuators, or the control unit 18th makes specifications for autonomous driving, which this has to be implemented.

The safety ECU can, for example, be designed to compare the actual status data with the specified target status data to avoid any discrepancies between the data (for example, a safety distance that is too small) and thus a critical driving situation, for example an impending collision with a vehicle ahead or a stationary vehicle Recognize obstacle and in this case autonomously initiate an emergency braking process with a maximum possible braking force or a maximum possible deceleration of the own vehicle in order to put the vehicle in a safe state or at least to reduce the consequences of a possible collision.

The safety ECU 20th is also designed to use the vehicle communication bus ( 28 in 1 ) Status data from the autonomous control unit and / or via the vehicle communication network 28 from other vehicle components. The safety ECU 20th can in particular be designed to be used by the autonomous control unit 18th Receive input. The ones from the autonomous control unit 18th The inputs provided can, for example, be one from the sensor unit 26th the detected current position of the vehicle, a speed, an acceleration, a steering angle and the like. Alternatively, the Safety-ECU 20th receive this information directly from the respective vehicle components.

The safety ECU 20th can determine or retrieve the current status data regularly at a specified frequency. The condition data acquisition frequency may vary depending on the vehicle speed, e.g. B. the status data determination frequency can increase with increasing speed.

As an alternative to the in 2 A plurality of safety ECUs can also be provided in the vehicle in order to implement a failover or a bypass of the autonomous control system (ECU4). The functionality of the safety ECU described here and the functionality of the control unit 18th for autonomous driving can be implemented together in a common control unit.

3 shows a block diagram showing an exemplary configuration of the Safety-ECU (Safety-ECU) 20th represents. The safety ECU can, for example, be a control device (electronic control unit ECU or electronic control module ECM). The safety ECU includes a processor 40 . At the processor 40 For example, it can be a computing unit such as a central processing unit (CPU) that executes program instructions. The safety ECU 20th further comprises a memory and an input / output interface. The memory can consist of one or more non-transitory computer-readable media and comprises at least a program storage area and a data storage area. The program memory area and the data memory area can comprise combinations of different types of memory, for example read-only memory 43 (ROM = Read-only memory) and a random access memory 42 (RAM = Random Access Memory) (e.g. dynamic RAM ("DRAM"), synchronous DRAM ("SDRAM"), etc.). The Safety-ECU can also use an external storage drive 44 such as an external hard disk drive (HDD), a flash memory drive, or a nonvolatile solid state drive (SSD). The safety ECU 20th further comprises a communication interface 45 via which the control unit connects to the vehicle communication network ( 28 in 1 ) can communicate.

Regarding 4a First, an exemplary procedure from the point of view of the control center ( 100 in 2 ) described. The method can be used, for example, by a processor of the server ( 110 in 2 ) are carried out in the control room. In one step S400 the control center sends via an initial radio link ( 37 in 2 ) a target position to the safety ECU ( 20th in 2 ) of the vehicle (see 4b for the use of this information by the Safety-ECU). In one step S402 the control center calls up an actual position from the safety ECU of the vehicle via the first radio link. In one step S404 the control center checks whether the actual position has been received from the safety ECU or not. If the actual position sent by the Safety-ECU was correctly received in the control center (ie there is no failure of the radio link, for example), then step S406 proceeded. In step S406 it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. If it is determined that the difference between the target position and the actual position does not exceed the specified threshold value S, the control station concludes from this that the target specifications have been correctly interpreted or implemented by the vehicle, and the process is restarted. If, on the other hand, it is determined that the difference exceeds the specified threshold value S, the control center concludes from this that the target specifications have been incorrectly interpreted or implemented by the vehicle, and step is followed S408 proceeded. In one step S408 via a second radio link ( 38 in 2 ), an activation signal for a safe state to the emergency stop control unit ( 30th in 2 ) of the vehicle. The steps performed in the emergency stop control unit are described below with reference to FIG 4c described. Has been in step S404 If no actual position is received from the Safety-ECU, for example in the event of a break in the radio connection between the vehicle and the control center, the process goes directly to step S408 via and an activation signal for a safe condition is transmitted directly to the emergency stop control unit of the vehicle.

The comparison of the target and actual state of the vehicle can e.g. with the help of a classic "WatchDog" functionality. The threshold value S is either fixed in the control room (e.g. S = 2m), or can also be set dynamically in the control room as a function of other variables such as the speed of the vehicle or the like.

An automated process for initiating an emergency stop process was described above. Alternatively, the target position and the actual position of the vehicle (and possibly also other information received from the vehicle) could also be displayed to a control center employee on a screen so that he or she can manually initiate an emergency stop if he considers this to be necessary.

Regarding 4b an exemplary procedure from the point of view of the safety ECU ( 20th in 2 ) described. The method can be used, for example, by a processor ( 40 in 3 ) of the Safety-ECU. In one step S450 The Safety-ECU sends the actual position of the vehicle to the control room server via the first radio link (see step S402 in 4a) . In one step S452 the Safety-ECU receives the specified target position from the control room server via the first radio link (see step S400 in 4a) . In one step S454 it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. If it is determined that the difference between the target position and the actual position does not exceed the specified threshold value S, the safety ECU concludes from this that the target specifications have been correctly interpreted or implemented by the vehicle, and the process is new started. If, on the other hand, it is determined that the difference exceeds the specified threshold value S, the safety ECU concludes from this that the target specifications have been incorrectly interpreted or implemented by the vehicle, and step is followed S456 proceeded. In step S456 the safety ECU controls the autonomous control unit of the vehicle in such a way that the vehicle is put into a safe state.

Regarding 4c The following describes the procedure from the point of view of the emergency stop control unit ( 30th in 2 ) described. In one step S480 the emergency stop control unit determines whether or not an activation signal for a safe condition of the vehicle has been received by the control room server (see step S408 in 4a) . If it is determined that no activation signal for a safe condition of the vehicle has been received, the process is restarted. If, on the other hand, it is determined that an activation signal for a safe state of the vehicle has been received, the emergency stop control unit controls the autonomous control unit of the vehicle in such a way that the vehicle is transferred to a safe state.

With the embodiments of 4a, b , and c if there is redundant safety functionality, if there is a problem with the radio connection to the safety ECU (radio connection 37 in 2 ), so that the Safety-ECU is not able to recognize or initiate a necessary emergency stop itself, the control center can still recognize this and via the redundant radio connection (radio connection 38 in 2 ) an emergency stop can be initiated for the emergency stop ECU of the vehicle.

5a Figure 3 shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server. In one step S500 the control room server determines a target trajectory for the vehicle. In one step S502 the control center calls up an actual trajectory from the safety ECU of the vehicle via the first radio link. In one step S504 the control center also receives camera images from the vehicle's safety ECU via the first radio link. In one step S506 the camera images are visualized together with the target and actual trajectories and displayed on a screen, for example. In this way, a control center employee can conveniently compare the actual vehicle status with the target status. According to the in 5a Thus, camera images are used to check the plausibility of the vehicle state, in which the target and actual trajectories of the vehicle are visualized.

5b Figure 3 shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server. In one step S550 the control room server determines a target position and a target orientation (heading) for the vehicle. In one step S552 a model-based determination of an image of the surroundings takes place on the basis of the target position and the target orientation. In one step S554 the image is transmitted to the vehicle's safety ECU. In this case, a model-based image of the vehicle environment is generated that corresponds to the target specifications of the control center.

This image is transmitted from the control station to the safety ECU. This image transmission can be used to check the plausibility of the vehicle's internal localization, for example by combining the model-based image received from the control center with one or more images of the surroundings sensors ( 26th in 1 ), for example a camera. That is, with the help of a model-based plausibility check, the vehicle status can also be compared. For example, street, building and landscape models can be used as they are known to those skilled in the art from navigation systems.

6a shows an embodiment of the transmission of control commands from the control station to the safety ECU. A first control command “target steering angle = - 90 °” (sharp left) is sent to the safety ECU. The control command contains a time stamp 7:52:20 as additional information, which specifies the time of day for the control command. Two seconds later, a second control command “Target steering angle = 0 °” (straight ahead) with a time stamp of 7:52:22 is sent to the Safety ECU. Then a third control command “target steering angle = + 90 °” (sharp right) with time stamp 7:52:23 is sent to the safety ECU. Is the radio connection between the control center and the safety ECU interrupted, commands from the control station or the communication device are temporarily stored for the duration of the failure and transmitted after the radio link has been re-established. Using the time stamp, the Safety-ECU can recognize the point in time for which a control command was intended and, if necessary, reject or correct commands in order to compensate for the brief failure of the radio link. Alternatively or additionally, positioning data can also be transmitted in this way.

6b shows another embodiment of the transmission of control commands from the control station to the safety ECU. A control command "target steering angle = - 10 °" is sent to the safety ECU. A "current" parameter indicates that this is a currently valid control command. Simultaneously with the transmission of this control command, a second control command “target steering angle = - 8 °” is sent to the safety ECU. A “previous” parameter indicates that this control command is a control command immediately preceding the current control command, ie the control command last sent by the control center. By comparing this previous control command with the control command present in the Safety-ECU, the Safety-ECU can recognize whether control commands have been received consistently or whether control commands have possibly been lost due to transmission errors. Alternatively, control commands could also be provided with sequential numbers and the safety ECU could draw such conclusions based on the numbers of the commands received. Alternatively or additionally, positioning data can also be transmitted in this way.

The safety control unit 20th can furthermore be designed such that it outputs an error on the basis of a predetermined threshold value. If the deviation from an actual value to a previously received control command is above a defined threshold, then there is most likely a transmission error (e.g. steering angle previously 90 ° left, new steering angle 90 ° right). This situation can then be resolved by requesting the last control command again.

To ensure the consistency of the data, i.e. to ensure the control commands or setpoints from the control center to the safety control unit or of sensor data and vehicle information from the safety ECU to the control center, these could be transmitted and validated with the help of BlockChain technology.

As a further alternative, the control system defines a safe driving area (“Safety Area”) and transmits it to the vehicle. This transmission of a safety area by the control system enables certain paths from the control system, e.g. blocked or restricted. The definition of a virtual boundary can either be defined by the control system as a function of position via GNSS technology (or other radio technologies such as WLAN or UWB) or it is dependent on an environment sensor system which is built into the infrastructure of the environment. If the radio connection to the control center breaks down, the vehicle may continue to move in the given safety area. If the radio connection fails over a longer period of time, further control can be implemented in a cascade-like manner by comparing it with vehicle data that has already been transmitted, including an emergency stop. For example, if the vehicle detects that it is leaving a given safety area using a localization process, it switches itself off (v = 0 km / h). For this purpose, for example, a predicted (next expected) actual position is calculated on the basis of the current vehicle speed and orientation (safety area position and heading) in order to predict where the vehicle will move. The target position (or target positions) specified by the safety area from the control center is then compared with the vehicle-internal calculation (predicted position). If, on the basis of a deviation between the target and the prediction, it is recognized that the vehicle is leaving the safety area, the vehicle switches off automatically. With this alternative, the radio emergency stop switch can be saved if necessary.

Additionally or alternatively, a safety area can be dynamically defined around the vehicle itself. To define the safety area, virtual boundaries can be set up around the vehicle with the help of GNSS technology or data from environment sensors, for example. Such a safety area located directly in front of the vehicle can, in particular, be blocked completely or broken down into sub-areas for other vehicles. Thus e.g. a collision with other vehicles can be avoided. Such a dynamic safety area (virtual boundary) around the vehicle itself can also be monitored by the environment sensors on the vehicle. In the safety area, e.g. Obstacles, objects or foreign vehicles are listed. The safety area or its sub-areas can also be used to trigger user-defined warning messages, e.g. Information about speed limits or other safety notices.

List of reference symbols

10

autonomous vehicle

12th

Control unit for steering system

14th

Control unit for braking system

16

Control unit for drive train

18th

Control unit for autonomous driving

20th

Safety control unit (Safety ECU)

24

Satellite navigation unit

26th

Sensor device

28

Vehicle communication network

30th

Emergency stop control unit (emergency stop ECU)

32

User interface

34

Radio module of the safety ECU

36

Radio module of the emergency stop control unit

37

first radio connection

38

second radio link

40

processor

42

RAM

43

ROM memory

44

Storage drive

45

Communication interface

100

Control room

110

Control room server

130

Control room radio module

Claims (14)

Control unit (20) for an autonomous or partially autonomous vehicle (10), comprising a processor (40) which is designed to to receive actual status data relating to the vehicle (10) via an interface (45) to a vehicle communication network (28), to receive target status data or control commands from a control system (100) via an interface (47) to a radio link (37); to determine a deviation between the target status data and the actual status data; and to control one or more vehicle components (12, 14, 16, 18) based on the deviation between the target state data and the actual state data in order to achieve or maintain a safe state of the vehicle (10). Control unit (20) Claim 1 , wherein the processor (40) is designed to send the actual status data to the control system (100) via the radio link (37). Control unit (20) Claim 1 or 2 , wherein the actual status data include a position, a speed, a steering angle, a yaw rate, a yaw rate, a position angle, a position angle acceleration, an acceleration and / or a lateral acceleration, or data from environment sensors. Control unit (20) according to one of the preceding claims, wherein the target status data include a target position, a target orientation or control commands. Control unit (20) according to one of the preceding claims, wherein the target status data comprise a model-based image and the processor (40) is designed to recognize the deviation between the specified target status data and the actual status data on the basis of a model-based plausibility check. Control unit (20) according to one of the preceding claims, wherein the processor (40) is designed to evaluate time stamps that are received with the target status data. Control unit (20) according to one of the preceding claims, wherein the target status data include information that defines a safe driving area. Control system for an autonomous or partially autonomous vehicle (10), comprising the control unit (20) according to one of the preceding claims, as well as an emergency stop control unit (30) which is designed to send an activation signal for a safe state via a second radio link (38) of the vehicle, and to control one or more vehicle components (12, 14, 16, 18) in response to the activation signal in such a way that a safe state of the vehicle is achieved. Vehicle (10) comprising a control unit (20) according to one of the Claims 1 to 7th or a tax system according to Claim 8 . Control system (100) for an autonomous or partially autonomous vehicle (10), comprising a processor (110) which is designed to: To send target status data via a radio link (37) to a control unit (20) of an autonomous or partially autonomous vehicle (10); Receiving actual status data via the radio link (37) from the control unit (20) of the autonomous or partially autonomous vehicle (10); to determine a deviation between the target status data and the actual status data; and to control the control unit (20) of the autonomous or semi-autonomous vehicle (10) via the radio link (37) based on the deviation between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle (10). Control system (100) Claim 10 , wherein the processor (110) is further designed, based on the deviation between the target status data and the actual status data or on the basis of a manual command to control an emergency stop control unit (30) in the autonomous or semi-autonomous vehicle (10) via a second radio link (38) in order to bring the vehicle (10) into a safe state. A method for controlling an autonomous or partially autonomous vehicle (10), comprising the steps: Obtaining, via an interface (45) to a vehicle communication network (28), actual status data relating to the vehicle (1), Receiving, via an interface (47) to a radio link (37), from a control system (100) of target status data or control commands; Determining a deviation between the target status data and the actual status data; and Activate one or more vehicle components (12, 14, 16, 18) based on the deviation between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle (10). A method for managing an autonomous or partially autonomous vehicle (10), comprising the steps: Sending target status data via a radio link (37) to a control unit (20) of an autonomous or semi-autonomous vehicle (10); Receiving actual status data via the radio link (37) from the control unit (20) of the autonomous or semi-autonomous vehicle (10); Determining a deviation between the target status data and the actual status data; and Control, based on the discrepancy between the target status data and the actual status data, from the control unit (20) of the autonomous or partially autonomous vehicle (10) via the radio link (37) in order to achieve a safe status of the vehicle (10) or to obtain. Procedure according to Claim 13 , the method further comprising the step of: controlling, based on the deviation between the target status data and the actual status data or on the basis of a manual command, an emergency stop control unit (30) in the autonomous or semi-autonomous vehicle (10) via a second radio link (38) to bring the vehicle (10) into a safe state.

Images