DE112018005794T5 - System and method for controlling a motor vehicle for autonomous driving - Google Patents

Abstract

A motor vehicle (MV) is controlled to drive autonomously by a bank of control units (110) that generate desired control signals (NCS) that are configured to cause the motor vehicle (MV) to move in accordance with a desired path . A data memory (140) contains a set of boundary conditions ({bc}) which the target path should meet in order to be considered safe. On the basis of sensor signals (SS) that represent a current state of the motor vehicle (MV), among other things, a safety unit (120) receives a set of safety-relevant parameters (P, R, S, H) that describe a state (s), in which the motor vehicle (MV) is currently operated. In response, the security unit (120) repeatedly generates at least one command ({cmd}) that updates the constraints ({bc}) with the aim of keeping the target path within limits imposed by a current state of the set of safety-relevant parameters (P, R, S, H) are specified. The bank of control units (110) reads the set of boundary conditions ({bc}) from the data memory (140) and controls the motor vehicle (MV) to move in such a way that the target path meets the boundary conditions ({bc}).

Description

Technical area

The invention relates generally to autonomous vehicles. In particular, the present invention relates to a system for controlling a motor vehicle for autonomous driving in accordance with a target path and a corresponding method. The invention also relates to a computer program and a non-volatile data carrier.

background

Today there is a clear trend towards fully autonomous vehicles. Of course, safety aspects are very important as there is no human driver involved. Functional safety standards, such as ISO 26262, require the diagnostic functionality that is required with regard to safety. In general, these standards place significant additional effort on diagnosis and the safe handling of functional errors. In addition, the verification of the verifiability of functional safety is a very complex process. Typically, the additional effort increases with the number of functions and the complexity of the functions involved. As a result, autonomous driving and related functions in the automotive sector have so far been one of the greatest challenges in terms of complexity.

US 2017/0277194 describes how operational control of a vehicle can be facilitated. Here, a limited set of candidate trajectories of the vehicle is generated, which are based on the location of the vehicle at a specific point in time. The candidate trajectories are based on a state of the vehicle and on possible behaviors of the vehicle and the environment with regard to the location of the vehicle and the specific point in time. A supposedly optimal trajectory is selected from the candidate trajectories based on costs associated with the candidate trajectories. The cost includes costs related to violations of operating rules of the vehicle. The selected supposedly optimal trajectory is used to facilitate the operational control of the vehicle.

EP 2,317,412 shows a security management system for equipment which is arranged to operate autonomously in a real-time environment. Deterministic and non-deterministic processors are provided for processing incoming alarms and generating control signals in response thereto. The non-deterministic processor can deal with untrained, complex and unpredictable situations by essentially providing processes that are open towards the end and that work in large search areas without a guaranteed solution. The deterministic processor monitors a behavior of the non-deterministic processor and validates control signals of the same against safety guidelines. The deterministic processor also provides an intelligent interface to the non-deterministic processor that receives alarms only from the deterministic processor, and enforces a time-critical delivery of responses.

US 2015/0057869 discloses devices, methods and a storage medium in connection with computer-assisted or autonomous driving of vehicles. A computing device can obtain multiple data related to vehicles traveling in different locations within a locality; and, based on this, generate one or more location-specific guidelines for computer-assisted or autonomous driving of vehicles at the location.

Therefore, there are known examples of solutions for controlling automobiles for autonomous driving in accordance with certain rules and guidelines while handling complex and unpredictable traffic situations.

However, there is still no solution in this area that enables comfortable and efficient integration of new and / or updated vehicle functions while maintaining compliance with relevant safety standards. A corresponding individual verification is therefore typically required for each new / updated function. This procedure is costly and very time-consuming.

Summary

It is therefore an object of the present invention to make updating existing functions in a system for autonomous driving more efficient and simple. It is also an object of the invention to simplify the process of adding new functions to such a system.

According to one aspect of the invention, these objects are achieved by a system for controlling a motor vehicle for autonomous driving, the system comprising: a bank of control units, a security unit and a data memory. The bank of control units in turn comprises a number of car control units that are set up to generate setpoint control signals that are set up to control the motor vehicle cause to move autonomously in accordance with a target path. For example, a first car control unit can implement an expressway pilot, a second car control unit can implement a congestion pilot, a third car control unit can implement a vehicle train pilot, and so on. The safety unit is set up to monitor a set of safety-relevant parameters which describe at least one state in which the motor vehicle is currently being operated. The set of safety-relevant parameters is based at least in part on sensor signals that were received from the motor vehicle, the sensor signals describing a current state of the motor vehicle. The data memory contains a set of boundary conditions which the target path should meet in order to be considered safe. The bank of control units is set up to read out the set of boundary conditions from the data memory, and the bank of control units is also set up to control the motor vehicle to move in such a way that the target path meets the boundary conditions. The safety unit is set up to receive the set of safety-relevant parameters and in response to this repeatedly generate at least one command which is set up to update the boundary conditions, the aim being to keep the target path within limits set by a current state of the set of safety-related parameters are given.

This system is advantageous because it not only automatically adapts the automatic control of the motor vehicle to any changes in the dynamic environment around the vehicle, but also in response to any modifications to the vehicle as such (and its resulting changed capabilities). Consequently, updating existing vehicle functions and adding new functions to the motor vehicle become straightforward tasks.

According to one embodiment of this aspect of the invention, the set of safety-related parameters comprises: a collection of requirements and / or guidelines that should be satisfied during operation of the motor vehicle, at least one signal that indicates a current property of a physical environment around the motor vehicle, and / or vehicle state data that represent a functional state of the motor vehicle. This allows the set of safety-related parameters to be efficiently influenced by different types of highly relevant factors.

According to a further embodiment of this aspect of the invention, the system further comprises a first data interface unit which is set up to receive and store at least one security guideline which describes an associated task-related rule that is to be followed during operation of the motor vehicle. The at least one safety guideline can relate to: a minimum distance that the motor vehicle should keep to a vehicle following, a speed limit that the motor vehicle should keep, and / or definitions of safe stopping locations that the motor vehicle should reach in the event of a fault in the motor vehicle Should be able to. The first data interface unit is communicatively connected to the security unit in order to provide the at least one security policy for the security unit. The motor vehicle can therefore be controlled to follow any general behavior-related rules in an uncomplicated manner.

According to yet another embodiment of this aspect of the invention, the system further comprises a second data interface unit which is set up to receive and store at least one regulatory requirement which is to be fulfilled during operation of the motor vehicle. The second data interface unit is communicatively connected to the safety unit in order to provide the at least one regulatory requirement for the safety unit. As a result, the motor vehicle can be conveniently controlled in order to obey certain traffic rules.

According to a further embodiment of this aspect of the invention, the system comprises a risk assessment unit, which is set up to dynamically assess a respective estimated risk that the motor vehicle will collide with any other road user and / or obstacle that is in the vicinity of the Motor vehicle is located. The respective estimated risk is expressed by at least one signal, and the risk assessment unit is communicatively connected to the security unit in order to provide the at least one signal for the security unit. As a result, a collision avoidance functionality is imaginatively implemented.

According to yet another embodiment of this aspect of the invention, the risk assessment unit is further configured to monitor an environment of the motor vehicle in order to determine whether the motor vehicle is currently operating within a range of parameters under which it is designed to work. Therefore, if the vehicle is determined to be out of this area, appropriate action can be taken immediately.

According to a further embodiment of this aspect of the invention is Risk assessment unit further set up to determine an estimated risk that the motor vehicle and / or any other road user in the vicinity thereof violates a traffic rule. The at least one signal also indicates this estimated risk. As a result, the vehicle control implemented by the car control units can be effected in such a way that the overall risk of violations of the traffic rules is reduced.

According to yet another embodiment of this aspect of the invention, the system comprises a system state monitoring unit which is set up to monitor the sensor signals received and, based thereon, to derive vehicle state data which indicate any errors contained in the functional state of the motor vehicle. The system condition monitoring unit is communicatively connected to the safety unit in order to provide the vehicle condition data for the safety unit. As a result, the error detection and handling are also taken into account in the vehicle control, which is implemented by the car control units.

According to yet another embodiment of this aspect of the invention, the safety unit is further set up to determine whether the set of safety-relevant parameters describes at least one state in which the motor vehicle is currently being operated is such that there is a risk that the motor vehicle is not can be moved autonomously in accordance with the target path, exceeds an error risk threshold. When this error risk threshold value is exceeded, the safety unit is set up to generate safety control signals which are set up to cause the motor vehicle to move autonomously in accordance with a safe path.

The safe path has priority over the target path, which is represented by the target control signals. In other words, the motor vehicle is set up to ignore any desired control signals received if the safety control signals are present. As a result, safe vehicle handling is ensured even in emergency situations.

As an alternative or in addition to this, the safety unit can be set up to generate a control signal which indicates whether the error risk threshold value has been exceeded or not. The system further includes a control switch placed in communication with the bank of control units. The control switch is arranged in communication with the bank of control units and the security unit, and the security switch is adapted to: receive the control signal; to receive the setpoint control signals or any safety control signals; and, in response to the control signals, forward either the desired control signals or the safety control signals to the motor vehicle. In such a case, the motor vehicle itself does not have to take any measures to ensure that a safe path is preferred to the target path.

According to further embodiments of this aspect of the invention, either each of the car control units is configured to generate a set of target control signals which is configured to cause the motor vehicle to move autonomously in accordance with a corresponding target path; or two or more of the car control units are configured to generate a common set of target control signals that are configured to cause the motor vehicle to move autonomously in accordance with the target path. This leads to a high degree of freedom with regard to the implementation of the system.

According to yet another embodiment of this aspect of the invention, the system comprises a platform interface which is set up to receive the sensor signals from the motor vehicle; and send the target control signals to the motor vehicle. Therefore, communication between the system and the automobile can be made efficient and flexible.

According to a further aspect of the invention, the above objects are achieved by a method for controlling a motor vehicle for autonomous driving. The method comprises: generating, by means of a bank of control units, target control signals that are configured to cause the motor vehicle to move autonomously in accordance with a target path; Monitoring, by a safety unit, a set of safety-related parameters which describe at least one state in which the motor vehicle is currently being operated; Receiving sensor signals from the motor vehicle, the sensor signals describing a current state of the motor vehicle and at least partially forming a basis for the set of safety-relevant parameters; Sending the target control signals to the motor vehicle. Storing, in a data memory, a set of constraints which the target path should meet in order to be considered safe; Reading, from the data memory, the set of constraints into the bank of control units; Generating, by the bank of control units, the target control signals in such a way that the motor vehicle is controlled to move in such a way that the target path meets the boundary conditions; Received, in the security unit, the set of safety-relevant parameters; and in response to this, repeatedly generating at least one command which is configured to update the boundary conditions, the aim being to keep the target path within limits which are predetermined by a current state of the set of safety-relevant parameters.

The advantages of this method and the preferred embodiments thereof emerge from the above description with reference to the proposed system.

According to a further aspect of the invention, the objects are achieved by a computer program which comprises instructions which, when they are executed in at least one processor, cause the at least one processor to execute the method described above.

According to a further aspect of the invention, the objects are achieved by a non-volatile data carrier which contains such a computer program.

Further advantages, advantageous features and applications of the present invention will become apparent from the following description and the dependent claims.

Figure list

• 1 stellt schematisch Systeme gemäß Ausführungsformen der Erfindung dar;
• 2 zeigt schematisch ein System gemäß einer weiteren Ausführungsformen der Erfindung; und
• 3 stellt mittels eines Ablaufdiagramms das allgemeine Verfahren gemäß der Erfindung dar.

The invention will now be described in more detail by means of preferred embodiments which are disclosed as examples and with reference to the accompanying drawings.

• 1 Figure 3 schematically illustrates systems according to embodiments of the invention;
• 2 shows schematically a system according to a further embodiment of the invention; and
• 3 shows the general method according to the invention by means of a flow chart.

Detailed description

Regarding 1 we will describe a system according to an embodiment of the invention for controlling a motor vehicle MV for autonomous driving. The system includes a bank of control units 110 , a security unit 120 and a data store 140 .

The bank of control units 110 again comprises a number of car control units ACU1, ..., ACUn, which are set up to generate setpoint control signals NCS, which are set up to cause the motor vehicle MV to move autonomously in accordance with a setpoint path, ie along a specific one Trajectory on the subsurface.

Either each of the car control units ACU1, ..., ACUn is set up to generate a set of setpoint control signals NCS, the set of setpoint control signals NCS being set up to cause motor vehicle MV to move autonomously in accordance with a setpoint path; or two or more of the car control units ACU1, ..., ACUn are set up to generate a common set of setpoint control signals NCS, the common set of setpoint control signals NCS being set up to cause motor vehicle MV to move in accordance with the setpoint path to move autonomously. For example, one of the car control units can be set up to control the motor vehicle MV in a longitudinal direction, whereas another car control unit is set up to control the motor vehicle MV in a transverse direction. Alternatively, a first car control unit ACU1 can implement an expressway pilot, a second car control unit can implement a traffic jam pilot, a third car control unit can implement a vehicle train pilot and so on, up to an n-th car control unit, which can be configured, for example, to operate the motor vehicle in a mine environment to operate. Although the auto control units ACU1, ..., ACUn can of course be implemented as hardware, it is advantageous if they are implemented in software. In such a case, either for each car control unit in the bank of control units 110 , a specific software module, or the entire bank of control units 110 can be represented by common software.

The security unit 120 is set up to monitor a set of safety-relevant parameters P, R, S _j , H, which describe at least one state in which the motor vehicle MV is currently operated. The set of safety-relevant parameters P, R, S _j , H is based at least in part on sensor signals SS that were received from the motor vehicle MV. According to one embodiment of the invention, the system comprises a system status monitoring unit 150 which is set up to monitor the received sensor signals SS and, based thereon, to derive vehicle state data H as part of the set of safety-relevant parameters.

The sensor signals SS describe a current state of the motor vehicle MV, and these signals can be transmitted from the motor vehicle MV via a platform interface 130 can be obtained. Such a platform interface is preferred 130 bidirectional and therefore also set up to send the setpoint control signals NCS to the motor vehicle MV to send. Nevertheless, according to the invention, even if the platform interface 130 is included in the embodiment, one or more sensor signals SS can be obtained via alternative channels, and / or one or more of the setpoint control signals NCS can be received in a different way than via the platform interface 130 to be given to the motor vehicle MV.

The data store 140 contains the set of boundary conditions {bc} which should be fulfilled by the target path in order to be considered safe, for example as specified by a safety standard, for example ISO 26262.

The bank of control units 110 is set up to use the set of boundary conditions {bc} from the data store 140 read out. This process can either be implemented as a pull function by the bank of control units 110 triggered, or as a push function by the data store 140 is effected. In either case, the bank is the control units 110 set up to control the motor vehicle MV to move in such a way that the target path meets the boundary conditions {bc}. As will be described further below, the boundary conditions {bc} are dynamic and depend on the set of safety-relevant parameters P, R, S _j and H.

More precisely, is the security unit 120 set up to receive the set of safety-related parameters P, R, S _j and H. The security unit 120 is arranged to repeatedly generate in response to this at least one command {cmd} which is arranged to update the constraints {bc} with the aim of keeping the target path within limits imposed by a current state of the sentence of safety-relevant parameters P, R, S _j , H are specified.

According to one embodiment of the invention, the set of safety-relevant parameters can comprise: a collection of requirements R and / or guidelines P, which should be satisfied during operation of the motor vehicle MV; one or more signals S _j indicating a current property of a physical environment around the motor vehicle MV; and / or vehicle state data H which represent a functional state of the motor vehicle MV. As mentioned above, the vehicle condition data H can be obtained from the system condition monitoring unit 150 can be derived, and the vehicle state data H can indicate any errors that are present in the functional state of the motor vehicle MV. The system health monitoring unit 150 communicates with the security unit 120 connected to the vehicle state data H for the security unit 120 provide.

According to one embodiment of the invention, the system comprises a first data interface unit 163 which is set up to receive and store at least one safety guideline P, which describes an associated task-related rule that is to be followed during the operation of the motor vehicle MV. As a result, the automatic control of the motor vehicle MC can comfortably adapt to any changes to the safety guidelines P by simply updating the first data interface unit 163 be adjusted.

For example, the safety guideline P is specified at a time of an operation and can relate to a minimum distance that the motor vehicle MV should keep from a vehicle following behind, a speed limit that the motor vehicle (MV) should keep; and / or definitions of safe stopping locations that the motor vehicle MV should be able to reach in the event of a fault in the motor vehicle MV. The at least one safety guideline P can also provide rules that were determined at a time of a design that relate to classes of safe stopping locations that must be accessible in the event of errors in the motor vehicle MV. In addition, the at least one safety guideline P can provide a minimum number of preferred stopping locations of each desired class that should be available for the motor vehicle MV for each road section.

The first data interface unit 163 communicates with the security unit 120 connected to the at least one security policy P for the security unit 120 and therefore the security unit 120 to be able to generate the at least one command {cmd} on the basis of the at least one security policy P.

According to one embodiment of the invention, the system comprises a second data interface unit 165 which is set up to receive and store at least one regulatory requirement R that is to be fulfilled during operation of the motor vehicle MV. Examples of regulatory requirements R are market-specific provisions that are specified at a time of an operation and relate, for example, to traffic rules (for example left-hand traffic / right-hand traffic, local traffic rules and various traffic signs).

Analogous to the first data interface unit 163 is the second data interface unit 165 communicating with the security unit 120 connected to the at least one regulatory requirement R for the security unit 120 and therefore the security unit 120 to enable the at least one command {cmd} to be generated on the basis of the at least one regulatory requirement R.

According to one embodiment of the invention, the system comprises a risk assessment unit 167 which is set up to dynamically assess a respective estimated risk that the motor vehicle MV collides with any other road user and / or obstacle that is in the vicinity of the motor vehicle MV. The dynamic evaluation is based on a number of sensor signals which contain information relating to an environment around the motor vehicle MV. However, sensor signals from within the motor vehicle MV can also be transmitted by the risk assessment unit 167 be used. Consequently, the risk assessment unit 167 receive one or more of the sensor signals SS (not shown).

An estimated risk that the motor vehicle MV will collide with a specific road user can include a so-called intentional estimate for this road user as well as a current expected path that is related to the road user in question. The corresponding estimated risks that the motor vehicle MV will collide with a certain road user and / or obstacle are expressed by at least one signal S _j which is sent to the risk assessment unit via a communication link 167 is forwarded. Therefore, the signal (s) S _{j can form} a basis for at least one command {cmd}.

In addition, it is preferred if the risk assessment unit 167 is further configured to monitor an environment of the motor vehicle MV in order to determine whether the motor vehicle MV is currently operating within a range of parameters under which it is designed to work.

Furthermore, the risk assessment unit 167 be set up to determine an estimated risk that the motor vehicle MV and / or any other road user in the vicinity thereof violates a traffic rule. The evaluation can include monitoring of lane markings, and if no sufficiently clearly detectable lane markings are recognized, the at least one signal S _j indicates this in the form of an estimated risk of a traffic rule violation.

According to one embodiment of the invention, the security unit 120 also set up to determine whether the set of safety-relevant parameters P, R, S _j , H describes one or more states in which the motor vehicle MV is currently operated, the state (s) being / are such that a risk that the motor vehicle MV cannot be moved autonomously in accordance with the target path exceeds an error risk threshold value.

If the failure risk threshold is exceeded, the security unit is 120 set up to generate safety control signals SCS, which are set up to cause the motor vehicle MV to move autonomously in accordance with a safe path. The safe path is an alternative to the target path, and the safe path is to be followed instead of the target path provided by the bank of controllers 110 was calculated. In other words, the safe path is given priority over the target path, which is represented by the target control signals NCS.

According to one embodiment that is described in 1 is shown, the motor vehicle MV itself brings about this priority in that it is set up to ignore any desired control signals NCS received if the safety control signals SCS are received, for example via the platform interface 130 like this in 1 is shown. As a result, safe vehicle handling is guaranteed even in emergencies.

2 shows schematically a system according to a further embodiment of the invention. All units, signals, commands and parameters that are also used in 1 there are the same units, signals, commands and parameters as those referring to above 1 have been described.

In the in 2 illustrated system is the security unit 120 set up to generate a control signal Ctrl which indicates whether the error risk threshold value has been exceeded or not.

The system also includes a control switch 210 who is in communication with the bank of control units 110 and the security unit 120 is arranged. The control switch 210 is set up to: receive the control signal Ctrl; to receive the setpoint control signals NCS or any safety control signals SCS.

The control switch 210 is set up to forward either the setpoint control signals NCS or the safety control signals SCS to the motor vehicle MV. In particular, the security unit generates 120 then when the security unit 120 the safety control signals SCS generates also the control signals Ctrl in such a way that upon receiving them in the control switch 210 towards the control switch 210 prevents the Setpoint control signals NCS are forwarded to the motor vehicle MV. Instead, the control signal Ctrl forwards the safety control signals SCS to the motor vehicle MV. This weakens the requirements for the motor vehicle MV to the effect that it does not have to select from the setpoint control signals NCS and the safety control signals SCS; and analogous to the above, safe handling of the motor vehicle is also guaranteed in emergencies.

Analogous to the car control units ACU1, ..., ACUn, the safety unit 120 , the system health monitoring unit 150 , the first data interface 163 , the second data interface 165 , the risk assessment unit 167 and / or the control switch 210 partially or completely implemented as software. In turn, such software can be installed to run on one or more processors. Furthermore, a common software can implement two or more of the named units and interfaces.

For example, the security unit 120 comprise a processing unit with processing means including at least one processor, such as one or more general purpose processors. Furthermore, the processing unit is preferably communicating with a data carrier 125 connected in the form of a computer-readable medium, such as a random access memory (RAM), a flash memory or the like. The disk 125 contains computer executable instructions, ie a computer program 127 for causing the processing unit and the other units of the system to operate in accordance with the embodiments of the invention as described herein when the computer-executable instructions are executed on the at least one processor of the processing unit.

To summarize and refer to the flowchart in 3 we will now describe the general method according to the invention for controlling a motor vehicle for autonomous driving.

In a first step 310 sensor signals are received from the motor vehicle. The sensor signals describe a current state of the motor vehicle.

Then in one step 320 a set of safety-relevant boundary conditions is generated at least partially on the basis of the sensor signals. This set of safety-relevant boundary conditions describes one or more states in which the motor vehicle is currently being operated.

Then one step monitors 330 the safety-relevant parameters; and in one step 340 which then follows, boundary conditions are read out from the data memory into a bank of control units. In a first pass of the process, the data store contains default value constraints. In subsequent passes, the boundary conditions are passed through the step described below 370 have been updated.

In one step 350 after the step 340 Target control signals are generated by the bank of control units and based on the boundary conditions. The setpoint control signals are set up to cause the motor vehicle to move autonomously in accordance with a setpoint path.

After that, in one step 360 the target control signals are sent to the motor vehicle to control the motor vehicle to move in accordance with the target path.

In a subsequent step 370 at least one command is generated by means of which the boundary conditions are updated, the aim being to keep the target path within limits which are predetermined by a current state of the set of safety-relevant parameters. The boundary conditions updated in this way are stored in the data memory, and then the process returns to step 310 back.

Although the method according to the invention is carried out in a general sequential order as shown in FIG 3 As is shown, it should of course be noted that a subsequent step in the process can be initiated before a previous step is completed. In fact, essentially all of the steps are active all the time. For example, sensor signals are preferably used in step 310 with respect to a specific time interval, while the boundary conditions in step 370 updated in the context of a set of safety-related parameters relating to a time interval prior to the specified time interval, and so on.

All of the procedural steps as well as any subsequent steps referring to FIG 3 have been described above can be controlled by means of at least one programmed processor. The invention therefore also extends to computer programs, in particular Computer programs on or in a carrier, which are set up to implement the invention in practice, although the embodiments of the invention which have been described above with reference to the drawings comprise a processor as well as processes which are carried out in at least one processor. The program may be in the form of source code, object code, code between source code and object code, such as in partially compiled form, or in any other form suitable to be used in implementing the method according to the invention. The program can either be part of an operating system or a separate application. The carrier can be any unit or device suitable to contain the program. For example, the carrier can be a storage medium such as a flash memory, a ROM (Read Only Memory), for example a DVD (Digital Video / Versatile Disk), a CD (Compact Disk) or a semiconductor ROM, an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory) or a magnetic recording medium such as a floppy disk or a hard disk. Furthermore, the carrier can be a transmittable carrier such as an electrical or optical signal that can be transmitted via an electrical or optical cable or by radio or other means. If the program is embodied in a signal which can be transmitted directly over a cable or other means, the carrier can be formed by such a cable or device or means. Alternatively, the carrier can be an integrated circuit in which the program is embedded, the integrated circuit being set up to carry out the relevant processes or to be used when carrying them out.

When the term “comprise” is used in this description, it is to be understood that it indicates the presence of the specified features, numbers, steps or components. However, the term is not intended to exclude the presence or addition of one or more further features, numbers, steps or components or groups thereof.

The invention is not restricted to the embodiments described in the figures, but can be varied freely within the scope of the claims.

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• US 2017/0277194 [0003]
• EP 2317412 [0004]
• US 2015/0057869 [0005]

Claims (25)

System for controlling a motor vehicle (MV) for autonomous driving, the system comprising: a bank of control units (110), which comprises a number of car control units (ACU1, ..., ACUn) which are set up to generate setpoint control signals (NCS) which are set up to cause the motor vehicle (MV) to move autonomously in accordance with a target path; and a safety unit (120) which is set up to monitor a set of safety-relevant parameters (P, R, S _j , H) which describe at least one state in which the motor vehicle (MV) is currently being operated, the set of safety-relevant parameters (P, R, S _j , H) based at least partially on sensor signals (SS) received from the motor vehicle, and wherein the sensor signals (SS) describe a current state of the motor vehicle (MV), characterized in that the system further comprises a data memory (140) which comprises a set of constraints ({bc}) which the target path should meet in order to be considered safe; the bank of control units (110) is set up to read out the set of boundary conditions ({bc}) from the data memory (140), and the bank of control units (110) is set up to control the motor vehicle (MV) to itself to move in such a way that the target path meets the boundary conditions ({be}); and the security unit (120) is set up to receive the set of security-relevant parameters (P, R, S _j , H) and in response to this repeatedly generate at least one command ({cmd}) which is set up to set the boundary conditions ({bc}), aiming to keep the target path within limits imposed by a current state of the set of safety-related parameters (P, R, S _j , H). System according to Claim 1 , wherein the set of safety-relevant parameters comprises at least one of the following: a collection of requirements (R) and / or guidelines (P) that should be satisfied during operation of the motor vehicle (MV), at least one signal (S _j ) that indicates a current property of a physical environment around the motor vehicle, and vehicle state data (H) which represent a functional state of the motor vehicle. System according to Claim 2 , further comprising a first data interface unit (163) which is set up to receive and store at least one security guideline (P) which describes an associated task-related rule to be followed during the operation of the motor vehicle (MV), the at least A safety guideline (P) relates to at least one of the following: a minimum distance that the motor vehicle (MV) should keep to a following vehicle, a speed limit that the motor vehicle (MV) should keep, and definitions of safe stops that the motor vehicle (MV ) should be able to be reached in the event of a fault in the motor vehicle (MV), the first data interface unit (163) being connected to the security unit (120) in a communicating manner in order to provide the at least one security policy (P) for the security unit (120) . System according to Claim 2 or 3 , further comprising a second data interface unit (165) which is set up to receive and store at least one regulatory requirement (R) that is to be fulfilled during operation of the motor vehicle (MV), the second data interface unit (165) communicating with the security unit (120) is connected to provide the at least one regulatory requirement (R) for the security unit (120). System according to one of the Claims 2 to 4th , further comprising a risk assessment unit (167) which is set up to dynamically assess a respective estimated risk that the motor vehicle (MV) will collide with any other road user and / or obstacle that is in the vicinity of the motor vehicle ( MV), wherein the respective estimated risk is expressed by at least one signal (S _j ), and wherein the risk assessment unit (167) is communicatively connected to the security unit (120) in order to generate the at least one signal (S _j ) for the security unit ( 120) to be provided. System according to Claim 5 wherein the risk assessment unit (167) is further configured to monitor an environment of the motor vehicle (MV) in order to determine whether the motor vehicle (MV) is currently operating within a range of parameters under which it is designed to work. System according to one of the Claims 5 or 6 , wherein the risk assessment unit (167) is further configured to determine an estimated risk that the motor vehicle (MV) and / or any other road user in the vicinity thereof violates a traffic rule, and wherein the at least one signal (S _j ) also indicates this estimated risk. System according to one of the Claims 2 to 7th , further comprising a system state monitoring unit (150) which is set up to monitor the received sensor signals and, based thereon, to derive vehicle state data (H) which indicate any errors that are contained in the functional state of the motor vehicle (MV), wherein the safety unit ( 120) is communicatively connected to the safety unit (120) in order to provide the vehicle status data (H) for the safety unit (120). System according to one of the preceding claims, wherein the safety unit (120) is further configured to: determine whether the set of safety-relevant parameters (P, R, S _j , H) describes at least one state in which the motor vehicle (MV) is currently is operated, wherein the at least one state is such that a risk that the motor vehicle (MV) cannot be moved autonomously in accordance with the target path exceeds a fault risk threshold value, and in addition, if the fault risk threshold value is exceeded, safety control signals ( SCS) that are set up to cause the motor vehicle (MV) to move autonomously in accordance with a safe path, the safe path being given priority over the target path represented by the target control signals (NCS). System according to Claim 9 , wherein the security unit (120) is adapted to generate a control signal (Ctrl) indicating whether or not the failure risk threshold is exceeded, and wherein the system further comprises a control switch (210) in communication with the bank of control units (110) and the safety unit (120) is arranged, the control switch (210) being set up to: receive the control signal (Ctrl), receive the setpoint control signals (NCS) or any safety control signals (SCS), and in response to the Control signals (Ctrl) to forward either the setpoint control signals (NCS) or the safety control signals (SCS) to the motor vehicle (MV). System according to one of the preceding claims, wherein each of the car control units (ACU1, ..., ACUn) is set up to generate a set of setpoint control signals (NCS), the set of setpoint control signals (NCS) being set up to control the motor vehicle (MV ) to cause them to move autonomously in accordance with a corresponding target path. System according to one of the preceding claims, wherein two or more of the car control units (ACU1, ..., ACUn) are set up to generate a common set of setpoint control signals (NCS), the common set of setpoint control signals (NCS) being set up to cause the motor vehicle (MV) to move autonomously in accordance with the target path. System according to one of the preceding claims, further comprising a platform interface (130) which is configured to: to receive the sensor signals (SS) from the motor vehicle (MV); and to send the setpoint control signals (NCS) to the motor vehicle (MV). A method for controlling a motor vehicle (MV) for autonomous driving, the method comprising: generating, by means of a bank of control units (110), target control signals (NCS) which are set up to cause the motor vehicle (MV) to be in To move autonomously in accordance with a target path; Monitoring, by a safety unit (120), a set of safety-relevant parameters (P, R, S _j , H) which describe at least one state in which the motor vehicle (MV) is currently being operated; Receiving sensor signals (SS) from the motor vehicle, the sensor signals (SS) describing a current state of the motor vehicle (MV) and at least partially forming a basis for the set of safety-relevant parameters (P, R, S _j , H); and sending the nominal control signals (NCS) to the motor vehicle (MV), characterized by storing, in a data memory (140), a set of boundary conditions ({bc}) which the nominal path should meet in order to be considered safe; Reading out from the data memory (140) the set of constraints ({bc}) into the bank of control units (110); Generating, by the bank of control units (110), the target control signals (NCS) such that the motor vehicle (MV) is controlled to move in such a way that the target path meets the boundary conditions ({bc}); Receiving, in the security unit (120), the set of security-relevant parameters (P, R, S _j , H), and in response to this repeated generation of at least one command ({cmd}) which is set up to set the boundary conditions ({bc }), aiming to keep the target path within limits imposed by a current state of the set of safety-related parameters (P, R, S _j , H). Procedure according to Claim 14 , wherein the set of safety-relevant parameters comprises at least one of the following: a collection of requirements (R) and / or guidelines (P) that should be satisfied during operation of the motor vehicle (MV), at least one signal (S _j ) that indicates a current property of a physical environment around the motor vehicle, and vehicle state data (H) which represent a functional state of the motor vehicle. Procedure according to Claim 15 , further comprising: receiving and storing, in a data interface unit (163), at least one security policy (P) which describes an associated task-related rule that is to be followed during operation of the motor vehicle (MV), the at least one security policy (P) at least one of the following concerns: a minimum distance that the motor vehicle (MV) should keep to a following vehicle, a speed limit that the motor vehicle (MV) should keep, and definitions of safe stopping places that the motor vehicle (MV) should keep in the event of an error should be able to reach in the motor vehicle (MV), wherein the first data interface unit (163) is communicatively connected to the security unit (120) in order to provide the at least one security policy (P) for the security unit (120). Method according to one of the Claims 15 or 16 , further comprising: receiving and storing, in a second data interface unit (165), a regulatory requirement (R) which is to be fulfilled during operation of the motor vehicle (MV), the second data interface unit (165) communicating with the safety unit (120) is connected to provide the at least one regulatory requirement (R) for the security unit (120). Method according to one of the Claims 15 to 17th , further comprising: dynamically evaluating, in a risk assessment unit (167), a respective estimated risk that the motor vehicle (MV) will collide with any other road user and / or obstacle that is in the vicinity of the motor vehicle (MV) , wherein the respective estimated risk is expressed by at least one signal (S _j ), and wherein the risk assessment unit (167) is communicatively connected to the security unit (120) in order to provide the at least one signal (S _j ) for the security unit (120) . Procedure according to Claim 18 , further comprising: monitoring, by the risk assessment unit (167), an environment of the motor vehicle (MV) to determine whether the motor vehicle (MV) is currently operating within a range of parameters under which it is designed to operate. Method according to one of the Claims 18 or 19th , further comprising: determining, by the risk assessment unit (167), an estimated risk that the motor vehicle (MV) and / or any other road user in the vicinity thereof violates a traffic rule, and wherein the at least one signal (S _j ) furthermore this indicating estimated risk. Method according to one of the Claims 15 to 20th , further comprising: receiving the sensor signals (SS) in a system state monitoring unit (150) for monitoring, deriving, based on the sensor signals (SS), vehicle state data (H) which indicate any faults which occur in the functional state of the motor vehicle (MV) are included, and forwarding of the vehicle status data (H) from the system status monitoring unit (15) to the security unit (120). Method according to one of the Claims 14 to 21st , further comprising: determining, in the safety unit (120), whether the set of safety-relevant parameters (P, R, S _j , H) describes at least one state in which the motor vehicle (MV) is currently operated, the at least one state is such that a risk that the motor vehicle (MV) cannot be moved autonomously in accordance with the target path exceeds a fault risk threshold value, and in addition, if the fault risk threshold value is exceeded, generating, in the safety unit (120) Safety control signals (SCS) that are set up to cause the motor vehicle (MV) to move autonomously in accordance with a safe path, the safe path being given priority over the target path represented by the target control signals (NCS). Procedure according to Claim 22 , further comprising: generating, in the security unit (120), a control signal (Ctrl) which indicates whether the error risk threshold value is exceeded or not, and determining, by a control switch (210) and in response to the control signal (Ctrl), that either the setpoint control signals (NCS) or any safety control signals (SCS) can be forwarded to the motor vehicle (MV) through the platform interface (130). Computer program (127), comprising instructions which, when executed in at least one processor, cause the at least one processor to implement a method according to one of the Claims 14 to 23 execute. Non-volatile data carrier (125) that a computer program after Claim 24 contains.

Images