DE102014213171A1 - System for autonomous vehicle guidance and motor vehicle - Google Patents

Abstract

The invention relates to a system for autonomous vehicle guidance, which is designed so that an at least limited and / or time-limited vehicle guidance is still possible even if a part of the components of the system fails. The invention further relates to a vehicle having such a system.

Description

The invention relates to a system for autonomous vehicle guidance, which has a plurality of electrical and / or electronic components, wherein the components are designed to cooperatively perform an autonomous vehicle guidance. The invention further relates to a motor vehicle with such a system.

It is known to equip vehicles such as cars, trucks or buses so that they can drive completely or partially autonomous. Currently ready for production, for example, parking assistants for autonomous maneuvering in a parking space, congestion assistants for lane keeping and distance at low speeds or Abstandstempomate for automatically maintaining a speed-dependent distance to a vehicle in front. Such systems can significantly relieve the driver in certain situations by taking him at least part of the vehicle guidance. Thus, they contribute to increased safety and also to increased ride comfort. For such driver assistance systems, for example, components such as cameras, ultrasonic sensors or radars are used.

It may be referred to as a general development goal to equip motor vehicles so that they take as many tasks as possible from the driver in as many situations as possible. It would be desirable, for example, for a vehicle to be able to drive completely autonomously on roads which allow it to travel long distances under largely defined conditions, for example on motorways. Since it is often driven to overcome long distances with very high speeds, an autonomous ride with appropriate design represent a significant safety gain. For example, an electronic vehicle management system can rely on special means of communication to obtain information from other vehicles or even from infrastructure about road conditions and possible hazards. In addition, electronic systems have a faster responsiveness than a human driver and are free of emotion.

However, it is understood that a possible gain in security can only be achieved if the system for autonomous vehicle guidance itself has a high degree of security, for example against failure of individual components of the security system. Otherwise, for example, there would be a risk that in case of failure of essential components, the vehicle is suddenly no longer controlled correctly, so for example, no longer follows a roadway or no other vehicles considered. This would most likely result in an accident.

It is therefore an object of the invention to provide a system for autonomous vehicle guidance, which is improved, for example, in terms of safety. It is a further object of the invention to provide a motor vehicle with such a system.

This is inventively achieved by a system according to claim 1 and a motor vehicle according to claim 28. Advantageous embodiments are included, for example, in the respective subclaims. The content of the claims is made by express reference to the content of the description.

The invention relates to a system for autonomous vehicle guidance, which has a plurality of electrical and / or electronic components, wherein the components are designed to cooperatively perform an autonomous vehicle guidance.

• – jede der Komponenten einer ersten Menge von Komponenten oder einer zweiten Menge von Komponenten zugeordnet ist,
• – wobei die Komponenten der ersten Menge dazu ausgebildet sind, eine zumindest eingeschränkte und/oder zeitlich begrenzte autonome Fahrzeugführung auch bei Ausfall der Komponenten der zweiten Menge durchzuführen, und
• – wobei die Komponenten der zweiten Menge dazu ausgebildet sind, eine zumindest eingeschränkte und/oder zeitlich begrenzte autonome Fahrzeugführung auch bei Ausfall der Komponenten der ersten Menge durchzuführen.

According to the invention, it is provided that

• Each of the components is associated with a first set of components or a second set of components,
• - Wherein the components of the first set are adapted to perform an at least limited and / or time-limited autonomous vehicle guidance even in case of failure of the components of the second set, and
• - Wherein the components of the second set are adapted to perform an at least limited and / or time-limited autonomous vehicle guidance even in case of failure of the components of the first set.

The system according to the invention is not only designed to autonomously control a vehicle when all components are functioning. Rather, it is additionally designed to control the vehicle autonomously, at least to a limited extent and / or for a limited time, when some of the components fail. Failure of a component may be due, for example, to a faulty power supply, board break, lightning strike, or other rare but possible event. In such a failure, however, the vehicle is not left uncontrolled, which would most likely lead to an accident, but will continue to avoid an accident.

Under a limited vehicle guidance can be understood, for example, that the vehicle only with lower speed, with poorer tracking accuracy, less accurate Position determination or greater distance from the vehicle in front can be performed. If autonomous vehicle guidance is possible for a limited time, the envisaged time in which the vehicle continues to be guided autonomously can be sufficient, for example, for a driver to take over the vehicle guidance or to bring the vehicle into a safe state, for example a drive at a lower speed or the achievement of a parking position, for example on a hard shoulder.

Autonomous vehicle guidance can mean complete or partially autonomous vehicle guidance. Under a completely autonomous vehicle guidance can be understood, for example, that the vehicle travels routes without intervention of the driver, the vehicle ideally takes independently on parameters such as route, road condition and other vehicles consideration. A partially autonomous vehicle guidance can be understood, for example, as meaning that the vehicle undertakes individual driving tasks such as holding the speed, keeping the distance to the vehicle in front or keeping the lane itself, but other driving tasks are simultaneously taken over by the driver. Autonomous driver assistance can also be understood as autonomous assistance functions such as construction site assistant, highway driving or traffic jam assist.

Preferably, some or all of the components are communicatively connected to each other for data exchange. This allows the exchange of data such as measured values, sensor data, calculation results or driving commands. For example, the components can be connected via a field bus, in particular a CAN fieldbus. The use of wireless communication such as Bluetooth or WLAN is conceivable. It should be understood that the components may also be communicatively connected to one another by a plurality of systems for data exchange.

• – das System ein erstes Bordnetz und ein zweites Bordnetz aufweist,
• – wobei die erste Menge von Komponenten an dem ersten Bordnetz angeschlossen ist und die zweite Menge von Komponenten an dem zweiten Bordnetz angeschlossen ist.

According to a preferred embodiment it is provided that

• - The system has a first electrical system and a second electrical system,
• - Wherein the first set of components is connected to the first electrical system and the second set of components is connected to the second electrical system.

The electrical systems are used in particular for powering the components. They may be at least partially or entirely implemented as components of a wiring harness. The described division ensures that even with complete failure of a vehicle electrical system and in this case possible complete failure of all components of one of the two sets a safe onward journey of the vehicle while continuing the autonomous control, albeit possibly limited and / or limited in time possible is.

• – Vorrichtung zur Trajektorienplanung,
• – Vorrichtung zur groben Lokalisierung, insbesondere mittels Satellitennavigation und/oder dead reckoning,
• – Vorrichtung zur Ermittlung von Eingangsparametern für Aktoren (Motion-Control),
• – Aktoren, insbesondere Lenkung, Motorsteuerung, und/oder Bremse,
• – Umfeldsensoren, insbesondere Kameras, Radargeräte, Lidargeräte, Ultraschallsensoren, Temperatursensoren, Regensensoren und/oder Straßenzustandssensoren.

According to respective preferred embodiments, it is provided that the first set of components comprises one or more of the following elements:

• Device for trajectory planning,
• Device for coarse localization, in particular by means of satellite navigation and / or dead reckoning,
• Device for determining input parameters for actuators (motion control),
• Actuators, in particular steering, engine control, and / or brake,
• - Environment sensors, in particular cameras, radars, Lidargeräte, ultrasonic sensors, temperature sensors, rain sensors and / or road condition sensors.

The first set is also referred to as the "seeing path" because of the possible uptake of visual function components.

The device for trajectory planning can be, for example, an electronic arithmetic unit which can be designed independently or as part of another arithmetic unit that executes further functions. The trajectory planning carried out serves, in particular, for the precalculation of a desired and / or suitable driving route, which can also be referred to as a trajectory. In other words, using trajectory planning, the system specifies along which route the vehicle should move. The trajectory planning can preferably plan ahead for a certain period of, for example, 5 s or 10 s.

For satellite navigation, known systems such as GPS or GLONASS can be used, which usually allows a position determination with high accuracy. For dead reckoning, for example, data from various sensors such as speed sensors or steering angle sensors can be used. From the data of such sensors, the distance traveled can be calculated and thus the position can be calculated relative to a reference point.

Also in the apparatus for calculating input parameters for actuators, which may also be referred to as motion control, it may be a computing unit, which may be executed independently or as part of another, further functions executing arithmetic unit. This will be for example Control commands for actuators such as steering, brake and / or engine control calculated by means of which the calculated trajectory is driven by the vehicle.

The first set of components preferably has a camera for determining input data for a localization function. Thus, for example, lanes and / or landmarks such as crash barriers, guide posts or traffic signs can be detected, which allows a particularly accurate position determination, especially if the system, the exact locations of the landmarks are known. For this purpose, a suitable map or database may be present, wherein such maps or databases may for example also be provided by a central server system to which the vehicle has access via wireless data transmission. Traffic signs can also be evaluated to obtain information about applicable traffic rules, which can be used, for example, in the context of autonomous vehicle navigation.

• – Visuelle Odometrie (Bewegungsschätzung),
• – Lokalisierung mittels gleichzeitiger Lokalisierung und Abbildung (SLAM, Simultaneous Localization and Mapping),
• – Schätzung von Nick-, Wank- und/oder Rollrate.

As indicated, the localization function input data is one or more of the following information:

• - visual odometry (motion estimation),
• - Localization using Simultaneous Localization and Mapping (SLAM),
• - Estimation of pitch, roll and / or roll rate.

This input data can be generated for example by the camera itself or by another component, preferably from image and / or video data obtained from the camera. The camera or another component can also be designed to determine dynamic data from the image and / or video data.

Preferably, a component is designed to determine an absolute position based on visual landmarks by means of images or data supplied by the camera and preferably also by means of map data. Such landmarks may be, for example, the guardrails, delineators or traffic signs already mentioned above. Positions of such landmarks may be included, for example, in map data stored in the vehicle or retrievable from a server via wireless data transmission. It should be understood that the vehicle may, for example, also update a central database of landmarks, particularly if it finds a new landmark, has removed a landmark, or has changed the position of a landmark.

Data provided by the camera can also be fused with data from environmental sensors such as radar sensors or lidar sensors. The fused data thus obtained can be used, for example, for position determination or else made available to other components. Thus, for example, the burden of communication means such as a field bus can be reduced, in particular if thereby less original data is transmitted.

It should be understood that a fusion can basically be designed as a tightly coupling or as a loose coupling.

The camera may, for example, be a monocamera, a stereo camera or a topview camera. It can also be provided several cameras of the same or different types.

• – Antennenschnittstelle, insbesondere für Fahrzeug-zu-X-Kommunikation (C2X-Kommunikation),
• – Vorrichtung zur spurgenauen Positionierung und/oder Lokalisierung, insbesondere mittels Satellitennavigation, Odometrie und/oder landmarkenbasierter Positionierung,
• – Fahrzeug-zu-X-Kommunikationsmittel (C2X-Kommunikationsmittel),
• – weitere Vorrichtung zur Ermittlung von Eingangsparametern für Aktoren (Backup-Motion-Control),
• – weitere Aktoren (Backup-Aktoren), insbesondere weitere Lenkung (Backup-Lenkung), weitere Motorsteuerung (Backup-Motorsteuerung) und/oder weitere Bremse (Backup-Bremse).

According to respective preferred embodiments, it is provided that the second quantity of components comprises one or more of the following elements:

• Antenna interface, in particular for vehicle-to-X communication (C2X communication),
• Device for accurate positioning and / or localization, in particular by means of satellite navigation, odometry and / or landmark-based positioning,
• Vehicle-to-X communication means (C2X communication means),
• Further device for determining input parameters for actuators (backup motion control),
• - Other actuators (backup actuators), in particular further steering (backup steering), further engine control (backup engine control) and / or additional brake (backup brake).

The second set is also referred to as the "listening path" due to the possible inclusion of radio systems.

Vehicle-to-X communication, also referred to as C2X communication for short, is understood in particular to be a vehicle-to-vehicle communication and a vehicle-to-infrastructure communication. The former refers to communication between vehicles, whereby, for example, data on speed, course, lane change intentions, breakdowns or special operations rights can be exchanged. Secondly, a communication between a vehicle and infrastructure, for example, information about breakdowns can be sent from the vehicle and information about the infrastructure Traffic rules, speed limits, traffic conditions or diversions can be received.

The antenna interface may be dedicated to the C2X communication or may have multiple functions, so that, for example, other communication means such as a car phone can use the antenna interface.

The device for accurate positioning of the track can be embodied, for example, by means of satellite navigation and / or by means of odometry, wherein in the latter case, for example, data from driving dynamics sensors can be received and used. In particular, the device for accurate positioning of the second set may also be present in addition to the device for coarse positioning of the first set, in which case the device for accurate positioning of the track typically enables a more accurate position determination than the device for coarse positioning. The latter can be designed, for example, to determine the road on which the vehicle is traveling, while the former is designed to also determine the lane, which is particularly advantageous on motorways and other multi-lane roads.

A track-accurate positioning can be done in particular in a digital map or used for a digital map.

The C2X communication means may be designed, for example, in the form of a radio and / or data processing module for the C2X communication. They can also be designed as part of such a module, which has more functions.

The backup motion control and the backup actuators can in particular be designed to take over the corresponding tasks in the event of a failure of the motion control or one or more actuators from the first set. Thus, the second set of components can be fundamentally put into the position to take over the vehicle management even in case of failure of the corresponding components of the first set.

Preferably, the second set comprises a number of environment sensors, in particular cameras, radar devices, lidar devices, ultrasound sensors, temperature sensors, rain sensors and / or road condition sensors. These environment sensors may in particular be present in addition to environmental sensors which are assigned to the first quantity. This increases the safety of the system, especially in the event of failure of components of the first set, since the second set in this case has some ability to perceive the environment, although this capability will typically lag behind that of the first set.

Preferably, the second set comprises a number of vehicle dynamics sensors, in particular rotational speed sensors, speed sensors, steering angle sensors, steering wheel angle sensors, acceleration sensors and / or yaw rate sensors. This makes it possible to acquire driving dynamics data, for example for use in a position determination or in a position-accurate positioning.

According to a preferred embodiment, the system is adapted to transfer a vehicle in the event of failure of a vehicle electrical system or in the event of failure of at least one component in a safe state. The safe state can be, for example, a transfer of the vehicle guidance to a driver, a reduction in the speed and / or a parking of the vehicle in a space provided for this purpose, for example a side strip. Thus, the failure can be accommodated in a suitable manner to prevent an accident as effectively as possible.

A driver can be warned in case of failure of a vehicle electrical system or failure of at least one component, for example, by optical, acoustic and / or haptic signals to take over the leadership of the vehicle. Thus, the driver can be quickly made aware that his intervention to avoid a dangerous situation is required.

Some or all of the components may be configured to collect data and exchange captured data between components of both sets. The system may be designed to autonomously continue the vehicle in the event of failure of a vehicle electrical system or of components for a short period of time, in particular a period of 5 seconds to 10 seconds, by means of the information previously exchanged between the components of both quantities.

At least one component of the second quantity is preferably designed to transmit data to at least one component of the first quantity when operating both vehicle systems and / or when operating all the components.

• – Fahrzeugposition in einem globalen Referenzsystem, insbesondere WGS 84,
• – spurgenaue Positionierung, beispielsweise zur Verwendung in einer digitalen Karte,
• – Informationen aus einer Fahrzeug-zu-X-Kommunikation, beispielsweise – sich dynamisch verändernde Objekte, welche sich auf einer Trajektorie befinden können, wie liegen gebliebene Fahrzeuge, Baustellen, Sondereinsatzfahrzeuge und/oder Stauende, – Verkehrszeicheninformationen, – Fahrdynamikdaten anderer Fahrzeuge, insbesondere von vorrausfahrenden, herannahenden oder nebenher fahrenden Fahrzeugen, mit welchen stabile Kolonnenfahrt ermöglicht werden kann, – Informationen über Spurwechselabsichten anderer Fahrzeuge, insbesondere von vorrausfahrenden, herannahenden oder nebenher fahrenden Fahrzeugen, welche die eigene Fahrspur betreffen,
• – Fahrdynamikdaten, beispielsweise – Drehrate und/oder 3D-Drehrate, – Beschleunigung und/oder 3D-Beschleunigung, – Lenkwinkel, – Raddrehzahl, – Geschwindigkeit über Grund, – Schwimmwinkel.

According to respective implementations, the data communicated by components of the second set of components of the first set may be one or more of the following:

• Vehicle position in a global reference system, in particular WGS 84,
• Accurate positioning, for example for use in a digital map,
• Information from vehicle-to-X communication, for example dynamically changing objects which may be on a trajectory, such as left-over vehicles, construction sites, special-purpose vehicles and / or traffic jams, traffic signal information, vehicle dynamics data of other vehicles, in particular advance vehicles approaching or approaching, with which stable convoy travel can be made possible, information about lane change intentions of other vehicles, in particular of preceding, approaching or moving vehicles, which affect their own traffic lane,
• - Vehicle dynamics data, for example - yaw rate and / or 3D yaw rate, - acceleration and / or 3D acceleration, - steering angle, - wheel speed, - speed over ground, - slip angle.

This information can be used for autonomous vehicle guidance of components of the first set, for example. In particular, data from the vehicle-to-X communication relevant to a trajectory that the vehicle is expected to drive will be relevant.

Preferably, some or all of the information transmitted by components of the second set of components of the first set has a respective time stamp indicating the time of information capture. This enhances possibilities for evaluating or fusing the information, since it is known exactly when the particular information was recorded.

Particularly preferably, the time stamp is generated using global time information, in particular a time information obtained from satellite navigation. This also allows the comparison of time stamps, which were assigned in the own vehicle, with time stamps from other vehicles or infrastructure.

A timestamp may, for example, have a data record which has a time in a specific format and possibly also a date.

With a position transferred from a component of the second path, for example a device for accurate tracking positioning, a simple localization in at least one component of the first set can be continuously calibrated, which enables, for example, a track-accurate positioning in trajectory planning. Also, a traversed actual trajectory can be determined by self-localization and from this an optimization of the actuator control can be carried out by the motion control. Thus, a closed control loop of Aktoransteuerung and resulting position change can be formed, which allows a particularly precise driving.

According to a preferred embodiment, the data transmitted by components of the second set of components of the first set include global time information, in particular a time information obtained from satellite navigation. This makes it possible, in particular in an advantageous manner, for the time information to be transferred to environmental sensors and for the environmental sensors to provide respective measured values with a time stamp based on the time information. For example, in the case of a fusion of the incoming data, such a time stamp can improve a time allocation of the data and thereby reduce a time blurring of the information generated in the fusion.

Particularly preferably, at least one component of the first set is designed to, in the event of a failure of the second on-board network or at least one component of the second set, carry out trajectory planning by means of the information transmitted by components of the second set of components of the first set for a specific period of time, preferably between 5 s and 10 s. This may be a sufficient time to perform a handover of the vehicle control to a driver, wherein the vehicle is sufficiently reliably controlled until the handover to avoid an accident. Alternatively or additionally, it may be provided to transfer the vehicle to a specific state, such as stopping on a hard shoulder.

Preferably, at least one component of the first set is configured to continuously transmit trajectory planning to at least one component of the second set when operating both on-board systems, wherein at least one component of the second set is configured in the event of failure of the first on-board network or components of the first set operate autonomous driving for a certain period of time using this trajectory planning. Thus, even in the case of a failure on the part of the first set a safe, albeit possibly temporally limited continued operation of the vehicle can be made possible, until a driver has taken control or other measures have been taken.

In the case of a failure of components of the first set, in particular in case of failure of a motion control or a number of actuators, preferably a backup motion control or backup actuators from the second set can be used.

In case of failure of components of the first set, a trajectory check is preferably carried out by a positioning module of the second set and reported back to the backup motion control, so that it can optimize its control.

In case of failure of the first on-board network, in the event of failure of at least one component of the first set or even assumption of the vehicle guidance solely by components of the second set for other reason, the trajectory planning obtained from a component of the first set is preferred using data from a vehicle Updated to X communication. This allows a longer safe driving time under autonomous vehicle guidance.

According to a preferred embodiment, at least one component or a device not connected to the first on-board network or the second on-board network is designed to provide one or more vehicle-to-X communication means if the first on-board network and / or the second on-board network fails and / or individual components fail send multiple messages to other vehicles and / or infrastructure, the messages including the information that the vehicle is in emergency mode. This may alert other vehicles that the vehicle may not behave as if it had fully operational autonomous vehicle guidance. You can then, for example, maintain a greater distance or refrain from changing lanes.

According to a preferred embodiment, some or all of the data and / or information exchanged between the components has an integrity measure which indicates the quality of the data and / or information. This allows a better evaluation of the data, for example in fusion or other calculations or evaluations. For example, the data with the best integrity measure can be used for certain calculations.

According to respective implementations, redundant location information is provided to one or more components, and / or the system has a central component that performs a centrally-monitoring algorithm and to which redundant location information is provided, the algorithm being adapted to autonomous vehicle control or individual functions autonomous vehicle control even if one of the vehicle electrical system or at least one component fails. This achieves a particularly high degree of safety. Such an algorithm may preferably operate based on the integrity measures. The components that execute the centrally monitoring algorithm may be associated with both sets of components.

The system preferably has one or more components in order to calculate a vehicle position in two ways, namely firstly based on vehicle dynamics data and satellite navigation data, and secondly based at least on camera data and particularly preferably also on map data. For an advantageous redundancy is achieved, which can be used in case of failure of a certain part of the system to other parts in order to obtain the necessary for a safe or at least limited driving with autonomous vehicle management functionality. In addition, a tolerance against common cause errors is achieved, i. it is very unlikely that the same error will interfere with both types of computation in the same way. Particularly preferred is a component for calculating the vehicle position based on camera data and possibly also map data for the first set of components. More preferably, a component for calculating the vehicle position based on vehicle dynamics data and satellite navigation belongs to the second set of components.

According to a preferred embodiment, the system has one or more components in order to merge vehicle dynamics data, satellite navigation data and camera data as well as preferably also map data and to provide them as fused information to other components. Thus, for example, a load on an in-vehicle communication system such as a fieldbus can be reduced. Such components may belong to the first and / or second quantity.

According to a preferred embodiment, the first vehicle electrical system has a first power supply unit and the second vehicle electrical system has a second power supply unit, wherein the first power supply unit serves to supply the components connected to the first vehicle electrical system and the second power supply unit serves to supply the components connected to the second vehicle electrical system , Furthermore, the first vehicle electrical system preferably has a first battery, which, if the first power supply unit fails, takes over the power supply of the first vehicle electrical system. The second electrical system preferably has a second battery, which takes over the power supply of the second electrical system in case of failure of the second power supply unit.

By providing batteries, extra security can be provided to avoid the need for some or all of the emergency measures mentioned above to be applied in the event of component failure. In case of failure of a power supply unit, which would otherwise lead to the failure of components, the operation of the components connected to the electrical system components can be further ensured by a battery in an advantageous manner. The time within which such a battery operation is possible, in particular, may be longer than the time within which a safe continued operation of the vehicle under autonomous vehicle guidance in case of failure is possible.

Particularly preferably, the system further comprises at least one battery management system, which is designed so that in case of failure of the first power supply unit and the first battery, the second battery takes over the power supply of the first electrical system, and / or that in case of failure of the second power supply unit and the second battery first battery takes over the power supply of the second electrical system. Thus, even in the case in which a power supply unit and the associated battery fail simultaneously, the function of both electrical systems and thus all components of the system can be further ensured. This makes it even more unlikely that the emergency measures described above need to be used. Rather, these would only be necessary if, for example, the other battery also fails or another defect exists, for example a break in a component in a circuit breaker.

The invention further relates to a motor vehicle having a system according to the invention for autonomous vehicle guidance. Thus, the advantages described above for a motor vehicle can be utilized. Regarding the system can be used on all the described versions and variants. Illustrated benefits apply accordingly.

It should be understood that components of the autonomous vehicle management system may also be used for other purposes. For example, a steering angle sensor can be used both for autonomous vehicle guidance as well as for the control of a power steering.

Basically, arithmetic units or other electrical or electronic components or elements of the system described may be embodied, for example, by means of a microprocessor, a microcontroller, an application specific integrated circuit (ASIC), a programmable logic controller (SPSS) or other hardwired or freely programmable components. By way of example, such arithmetic units or other electronic components or elements may comprise processor means and memory means, wherein the memory means stores program code in the execution of which the processor means execute a specific method and / or sequence of instructions.

In principle, a number of specific units should be understood as meaning either such a unit or a plurality of such units.

Further features and advantages will be apparent to those skilled in the embodiment described below with reference to the accompanying drawings. Showing:

1 : An embodiment of a system for autonomous vehicle guidance,

2 : An embodiment of a vehicle with such a system.

1 schematically shows an embodiment of a system 10 for autonomous vehicle guidance.

The system 10 indicates a first quantity 100 of components and a second lot 200 of components. These components will be described in detail below.

The first lot 100 has a device 110 for trajectory planning, a device 120 for gross localization, a device 130 for determining input parameters for actuators, a number of actuators 140 , a camera 150 and a number of other environmental sensors 160 on. Due to the integration of a camera and other environment sensors, the components of the first set 100 also called "seeing path".

The second lot 200 has a vehicle-to-X antenna interface 210 , a device 220 for accurate tracking positioning, another device 230 for determining input parameters for actuators, a number of other actuators 240 , a vehicle-to-X communication module 250 , a number of environmental sensors 260 , a number of driving dynamics sensors 270 as well as a computing unit 280 on. Due to the integration of external communication, the components of the first set are also referred to as the "listening path".

The system 10 is designed to autonomously control a vehicle in defined situations. It should be mentioned in particular that the system 10 can realize a stable column ride on a highway, so that the vehicle joins the flow of traffic and normally no intervention by the driver are necessary. In particular, steering angle, engine power and braking effect are by the system 10 autonomously controlled so that the direction of travel, curve radii, speed, acceleration and deceleration are set automatically. If all the components of the system listed above 10 are functioning normally, ie are in operation, the system reaches 10 its maximum functionality.

The system 10 However, it is also designed to lead the vehicle even at least limited and limited in time autonomously, if one or more of the components fail.

In particular, the system 10 adapted to the vehicle in the event of failure of the components of the first set 100 or in the case of failure of the components of the second set 200 limited and limited in time until a driver has taken over the vehicle control. In such a case, the driver is advised that the system 10 is no longer fully functional for autonomous vehicle management and that he must take over the vehicle control itself. However, since the driver will not be prepared for this regularly, it usually takes a few seconds for the driver to check the traffic situation and take over the vehicle. In this time the system leads 10 the vehicle further restricted, thereby avoiding that the vehicle continues unattended and causes an accident. This happens in particular by means of those components which have not failed. So if, for example, the components of the first set 100 fail, take over the components of the second set 200 the vehicle control. If, however, the components of the second set 200 fail, take over the components of the first set 100 the vehicle control. Details will be described below.

All components of both quantities 100 . 200 are connected to each other via a not shown CAN fieldbus system so that they can exchange data with each other. Such fieldbus systems are known per se, which is why will not be discussed in detail.

The system 10 has a first electrical system 102 and a second electrical system 202 on. The components of the first set 100 are on the first electrical system 102 connected and the components of the second set 200 are at the two electrical system 202 connected. The vehicle electrical system 102 . 202 serve the power supply of the components of the quantities 100 . 200 ,

The first electrical system 102 has a first power supply unit 104 on which the components of the first set 100 powered. The first electrical system 102 also has a first battery 106 on. The first battery 106 is designed to be the components of the first set 100 to supply power if the first power supply unit 106 should fail.

The second electrical system has a second power supply unit 204 on which the components of the second set 200 powered. The second electrical system 202 also has a second battery 206 on. The second battery 206 is designed to be the components of the second set 200 to supply power if the second power supply unit 206 should fail.

By the described embodiment with the two power supply units 104 . 204 and the two batteries 106 . 206 becomes the reliability of the system 10 already significantly increased, since even in the event of a failure of a respective power supply unit 104 . 204 For example, due to an internal defect, the respective battery 106 . 206 at least for a limited time can take over the power supply.

To the reliability of the system 10 To further increase, this also has a battery management system 90 on. This is with both on-board networks 102 . 202 and with both batteries 106 . 206 connected. In case of failure of both the first power supply unit 104 as well as the first battery 106 takes care of the battery management system 90 for having the power supply of the first electrical system 102 through the second battery 206 he follows. In case of failure of both the second power supply unit 204 as well as the second battery 206 takes care of the battery management system 90 for having the power supply of the second electrical system 202 through the first battery 106 he follows.

In the event that even through the battery management system 90 provided security functionality should fail, further security functionalities are implemented, which will be discussed in more detail below.

The device 110 for trajectory planning and the device 130 for determining input parameters for actuators are executed in a conventional manner as electronic computing units. The device 130 for determining input parameters for actuators can also be referred to as motion control.

The device 120 for coarse localization is formed in a conventional manner as electronic processing unit and in particular has a satellite navigation module, which can calculate the position of the vehicle using satellite signals. Furthermore, it also receives from the driving dynamics sensors described below 270 Information by means of which the position calculation can be further refined.

At the actuators 140 In the present case, these are steering, engine control and brake. This makes it possible to control all important driving parameters such as course and speed of the vehicle. The actors 140 get their instructions from the device 130 for determining input parameters for actuators, which currently calculates these instructions.

The camera 150 Looks in the direction of travel on the lane and detects landmarks such as traffic signs, lane boundaries and other helpful to determine the position of the vehicle helpful objects. The camera 150 is in particular designed to determine input data for a localization function from recorded images. For this purpose, the camera is designed to perform a visual odometry, so close on the basis of the images taken on the movement of the vehicle. Dynamic data can also be determined. The information obtained from this is sent to the device 120 for rough localization, which can use the information to improve localization. In case of failure of the device 120 For gross localization contained satellite navigation module or other for determining the position of important components, the device 120 for rough localization the position of the vehicle also based solely on that of the camera 150 calculate the information received. In addition, map data can be consulted.

In the other environment sensors 160 these are radars, ultrasonic sensors, temperature sensors and rain sensors. These provide information about the distance of other vehicles, the weather and the road conditions to the CAN fieldbus system and thus to the other components.

The antenna interface 210 is adapted to receive radio signals and to the communication module 250 forward as well as radio signals coming from the communication module 250 be generated, amplify and send out. The antenna interface 210 has for this purpose a transmitting and receiving amplifier, which is connected to a vehicle outer antenna.

The device 220 for accurate tracking positioning is formed in a conventional manner as electronic processing unit and has another satellite navigation module to independently of the device 120 for rough localization to determine the position of the vehicle. The device 220 For accurate tracking, the camera also receives images from the camera 150 and then evaluates them to include landmarks such as traffic signs or road boundaries. When such landmarks are detected, the device uses 220 for accurate tracking this to improve the accuracy of positioning. For this purpose, the device also has a database of landmarks. In addition, the device receives 220 for accurate positioning also data of the driving dynamics sensors described in more detail below 270 to further improve positioning by means of odometry.

In the other device 230 for determining input parameters for actuators and the other actuators 240 these are units which are equivalent to the device 130 for determining input parameters for actuators and to the actuators 140 are executed. The other device 230 for determining input parameters for actuators and the other actuators 240 are especially intended for the functions of the device 130 for determining input parameters for actuators or actuators 140 to take over if they should fail. The other device 230 For determining input parameters for actuators can thus also be referred to as backup motion control. Likewise, the other actuators 240 be referred to as backup actuators.

The vehicle-to-X communication module 250 is designed to be via the antenna interface 210 and the vehicle exterior antenna connected thereto to communicate with other vehicles and with infrastructure facilities. The communication module 250 continuously sends out signals containing information such as the current position of the vehicle, its speed and any lane change intentions.

Likewise, the communication module receives 250 Ongoing signals from other vehicles and infrastructure facilities, for example, positions, speeds and events of other vehicles, the traffic situation or traffic rules such as speed limits. This information will be the other components of the system 10 made accessible.

The environment sensors 260 the second lot 200 have a camera and a radar device in the present case. These are in addition to the camera 150 and the environmental sensors 160 the first lot 100 present and serve the second set 200 of components to give at least some ability to perceive the environment, so in case of failure of the components of the first set 100 Positioning and vehicle guidance can be improved.

The driving dynamics sensors 270 have a number of speed sensors, a steering angle sensor, a steering wheel angle sensor and an acceleration sensor. Thus, the driving state of the vehicle can be comprehensively detected and mapped into vehicle dynamics data, this vehicle dynamics data in particular of the device 220 be supplied for accurate tracking positioning.

If one of the two electrical systems 102 . 202 fails, so also fall the components of the respective amount 100 . 200 , which are connected to the electrical system, off. In this case, the components of the other of the two quantities 100 . 200 Take over the control of the vehicle with limited functionality, as already described above. However, the accuracy of this control is sufficient only for a period of a few seconds. For this reason, the driver is in case of failure of a vehicle electrical system 102 . 202 or promptly acoustically and optically prompted to take over the control of the vehicle even in case of failure of a component essential for the control. If the driver reacts and takes over the control actively, the autonomous vehicle control is switched off. However, if the driver does not react, the vehicle is transferred from the functioning components to a safe state. This means in the present case that the vehicle is braked and brought to a side strip to a halt.

During correct operation, so in particular both electrical systems 102 . 202 work and also the connected components of the first and second sets 100 . 200 work, submit components of the second set 200 ongoing data to components of the first set 100 , to the device 110 for trajectory planning and the device 120 for gross localization.

The transmitted data is in particular one of the device 220 Vehicle position determined in the global reference system WGS 84 for accurate positioning and information from the vehicle-to-X communication about other vehicles and traffic rules. Furthermore, the driving dynamics data already described above are also transmitted.

All data within the system 10 between the components of the two sets 100 . 200 be transmitted, bear a respective timestamp. This is based on a global time reference, which by means of the in the device 220 for satellite positioning, satellite navigation satellite positioning module is obtained. This time reference will be all components of the system 10 made available. In particular, all measured values of the sensors contained in the system are each provided with a time stamp. This ensures, on the one hand, that all information can be assigned exactly to a particular time, which makes it possible to detect time courses and generally reduces time blurring. On the other hand it also ensures that out of the system 10 data obtained from outside the vehicle, in particular from the vehicle-to-X communication, can be compared in terms of time. Namely, these data were also time-stamped by the respective transmitting vehicles or infrastructures using the time reference obtained from satellite navigation.

Should the second electrical system 202 fail or should components of the second lot 200 fail otherwise, so that the data described above no longer to the device 110 for trajectory planning and the device 120 for coarse localization, so is the device 110 designed for trajectory planning to continue, at least for a period of about 10 s, the trajectory planning with an accuracy which is sufficient to ensure a safe onward journey of the vehicle. Within this time, the driver should have taken control.

The of the device 110 for trajectory planning ongoing trajectory planning is continuously to the arithmetic unit 280 to hand over. The arithmetic unit 280 is thus able to do so if the first on-board network fails 102 or of components of the first quantity 100 to an already made trajectory planning from the first set 100 resort and thus take over the vehicle control. The trajectory planning can be in the arithmetic unit 280 continue, in particular using data from the vehicle-to-X communication, their functionality is not from the first electrical system 102 depends. Events such as the collapse of another vehicle in the calculated trajectory can be taken into account in this way.

If at least one component of the system 10 fails and the functionality of the system 10 for the autonomous driving of the vehicle thus is restricted, so sends the communication module 250 a message via the antenna interface 210 by which other vehicles are informed that the vehicle is in an emergency operation. This will allow them to prepare for the vehicle not behaving as expected and to take appropriate precautionary measures to avoid an accident. For example, other vehicles can reduce their speed and maintain a greater distance.

Some data between the components of the system 10 are exchanged, have an integrity measure. This indicates the quality of the data. By way of example, a sensor which generates data based on measured values can determine the degree of integrity on the basis of its measuring accuracy. Other components can then estimate how accurate the data provided by this sensor is.

The arithmetic unit 280 is also designed to merge the above-mentioned vehicle dynamics data, data from satellite navigation, camera data and map data, and to provide the fusion information thus obtained to the other components. This allows a reduction in the required computing capacity in other components.

2 schematically shows a motor vehicle 5 with a system 10 which is formed as just described. The vehicle 5 also has a power supply device 8th with an alternator and a vehicle battery on which the system 10 supply with electrical energy. This allows autonomous control of the vehicle 5 in the manner just described.

Below is a further description of features that may be relevant to the invention. It should be understood that individual features in this description may or may not be assigned features of the previous description by virtue of their functionality or other criteria. All features described below can be combined with all features described above in any combinations and sub-combinations. In particular, the disclosure of this application also includes any selection, combination or sub-combination of features described above, wherein one or more of the features described below are explicitly excluded from protection. The following statements may, for example, be understood as an independent description of an invention or as a specification of the invention already described above.

Vehicle-to-X communication systems (C2X systems) are already known in the art for both transport-related data transmission and various service data such as entertainment applications. The vehicle-to-X communication is based both on the data exchange between vehicles with each other (vehicle-to-vehicle communication) and on the data exchange between vehicles and infrastructure facilities (vehicle-to-infrastructure communication). This data exchange can be done eg on the WLAN standard IEEE 802.11p which is currently in pre-development. Likewise, various types of surrounding detection systems are known which detect a vehicle environment by means of different environment sensors, such as camera, radar, lidar, ultrasound and temperature sensors. Furthermore, it is known to combine vehicle-to-X communication systems and environment detection systems in order to create the most complete possible modeling of the vehicle environment and thus to enable autonomous vehicle guidance.

However, there is still a need for safety concepts for autonomous vehicle guidance, since in a partial or complete system failure safe autonomous driving a vehicle is usually no longer guaranteed.

It is therefore proposed that a first part of the systems necessary for autonomous driving is connected to a first vehicle electrical system and a second part of the systems necessary for autonomous driving is connected to a second vehicle electrical system.

In a preferred embodiment, the environment sensors, the trajectory planning, simple localization, the motion control and the actuators (steering, engine control and brake) are supplied by the first electrical system in normal operation. Due to the integration of environmental sensors, this part is called the "seeing path".

The second on-board network system preferably connects the antenna interface, the track-accurate positioning and localization unit, the C2X system, the backup motion control and the backup actuator system (backup steering, brake) as well as the motor control. Due to the antenna connection this part is also called "listening path".

In "normal mode", the "seeing path" is preferably fed by data from the "listening path", i. the data of the "seeing path" are supplemented by data of the "listening path".

• – die Position in einem globalen Referenzsystem (z. B. WGS 84),
• – die spurgenaue Positionierung in einer digitalen Karte, welche auch mit Informationen aus dem C2X-System (dynamisch sich verändernde Objekte, welche sich auf der Fahrtrajektorie befinden können, dies sind z. B. liegengebliebene Fahrzeuge, Baustellen, Sondereinsatzfahrzeuge, Stauende, Verkehrszeicheninformationen, etc. aber auch Fahrdynamikdaten der vorrausfahrenden, herannahenden oder nebenherfahrenden Fahrzeuge, mit denen stabile Kolonnenfahrt ermöglicht werden könnte, Informationen über Spurwechselabsicht anderer vorrausfahrenden, herannahenden oder nebenher fahrenden Fahrzeugen, welche die eigene Fahrspur betreffen) angereichert ist,
• – die Fahrdynamikdaten (z. B. bis zu 3D-Drehrate, 3D-Beschleunigung, Lenkwinkel, Raddrehzahl, Speed-over-Ground, Schwimmwinkel, etc.) und
• – eine globale Zeitinformation.

For example, this "listening path" data includes some, several, or all of the following information:

• The position in a global reference system (eg WGS 84),
• The exact positioning in a digital map, which is also provided with information from the C2X system (dynamically changing objects which may be on the driving trajectory, eg broken-down vehicles, construction sites, special-purpose vehicles, jam ends, traffic sign information, etc but also vehicle dynamics data of the preceding, approaching or co-moving vehicles with which stable convoy travel could be enabled, information about lane change intention of other forward driving, approaching or moving vehicles, which concern the own traffic lane, enriched,
• The driving dynamics data (eg up to 3D yaw rate, 3D acceleration, steering angle, wheel speed, speed over ground, slip angle, etc.) and
• - a global time information.

All transferred information preferably includes a timestamp that contains the exact time when the information was captured.

With the transferring position, the simple localization in the "seeing path" is preferably constantly calibrated, thus enabling a track-accurate positioning in the trajectory planning.

The traversed actual trajectory is also preferably determined by the self-localization, and optimization of the actuator control by the motion control is thereby preferably carried out. This creates a closed control loop of actuator control and the resulting change in position.

Likewise, time information is preferably transferred from the "listening path" to the environment sensors, so that the measurements are also provided with a time stamp as early as possible.

In the case of a fusion of the incoming data, the time stamp preferably serves for temporal allocation of the data and thereby for reducing the time blurring of the information generated in the fusion.

All data is designed to enable trajectory planning in the event of failure of the "listening path" until the driver is taken over (eg 5-10sec after failure).

In the event of failure, the vehicle is preferably automatically brought into a "safe state" as quickly as possible, i. the speed is reduced or controlled a safe position on the roadside or the driver is warned by optical, acoustic or haptic signals to take over the leadership of the vehicle, etc., possibly without other road users run the risk of colliding with the vehicle or other road users.

Since in this case the environment sensors are still functional, the failure of the "Hearing_Path" is less serious than the failure of the "Seeing Path".

In the event of a failure of the "seeing path", the "listening path" preferably resorts to a sufficiently far-ahead trajectory planning from the "seeing path", which in the "normal mode" was previously handed over to the "listening path". The length of the trajectory planning is preferably selected such that it is sufficient to transfer the vehicle guidance back to the driver or to bring the vehicle into a safe state.

In the event of a failure of the "seeing path", a backup motion control module is preferably supplied with the backup trajectory, which thus calculates the necessary actuator movements of the backup actuators. The trajectory control is now preferably performed directly by the positioning module in the "listening path" and reported back to the motion control so that it can optimize its control.

Likewise, the sufficiently forward-looking trajectory planning (eg, 5-10sec) obtained from the "seeing path" is preferably continually updated with an update from the C2X system so that events recorded by the C2X system prior to the failure of the "Seeing Paths" were not known to be taken into account. Thus, e.g. fast and short-term events that could lead to a collision (such as another vehicle shattering into the trajectory of the vehicle) are included in trajectory planning.

Likewise, the "emergency operation" of the vehicle can preferably also be transmitted to other vehicles directly via C2X, so that these, e.g. maintain sufficient distance to the vehicle and avoid collapse into the trajectory of the vehicle.

• a. Die Implementierung des erfindungsgemäßen Sicherheitskonzepts beim automatisierten Fahren gleichzeitig die Konfiguration des Fahrzeuges skalierbar macht und
• b. beim Ausfall des „Sehenden-Pfades“ der „Hörende-Pfad“ ebenso ein Minimum an „Sehfähigkeit“ besitzt und damit die Back-Up Trajektorienplanung weiter absichern kann, falls plötzliche Ereignisse eintreten. Damit können mittels des C2X-Systems erfasste Ereignisse bevorzugt plausibilisiert werden, oder bevorzugt nicht zur C2X-Kommunikation befähigte Verkehrsteilnehmer erkannt werden.

A further embodiment provides that a part of the environment sensors, in particular the Extensions for autonomous driving, with integrated into the second electrical system, so that

• a. The implementation of the security concept according to the invention in automated driving simultaneously makes the configuration of the vehicle scalable and
• b. If the "seeing path" fails, the "listening path" also has a minimum of "vision" and thus can further back-up trajectory planning if sudden events occur. In this way, events recorded using the C2X system can preferably be made plausible or, preferably, road users who are not capable of C2X communication can be identified.

A further embodiment provides that the first electrical system via a battery management system, the second electrical system with energy supplied if the power source of the second electrical system fails.

The same occurs preferably vice versa, when the power supply of the first electrical system fails.

In all cases, the safety concept works even if only individual functions fail from one of the wiring systems. In this case, then preferably takes over the corresponding main function or the backup function in the not affected electrical system, the failed function.

The security concept according to the invention is preferably used not only in autonomous driving but also in autonomous assistance functions (such as, for example, construction site assistant, convoy on motorways, etc.).

The invention thus has a way, in the event of failure of one of the two vehicle electrical systems, to rule out autonomous vehicle guidance, at least until safe acceptance of the vehicle guidance by the driver, endangering the surrounding traffic.

Further preferred embodiments will become apparent from the following explanations as well as the further attached figures.

Show it

3 an exemplary first construction of a functional architecture of a system,

4 an exemplary first construction of a hardware architecture of a system,

5 an exemplary second construction of a hardware architecture of a system,

6 an exemplary third construction of a hardware architecture of a system, and

7 an exemplary fourth construction of a hardware architecture of a system.

To the figures his following explanations given:
IDC = integrated drive control
SDC = safety domain control
BDC = backup drive control

In particular, the BDC can take over the function of the IDC if it should fail.

• – generieren statischer Landmarken und dynamischer Objekte (Daraus wird der befahrbare Raum berechnet),
• – identifizieren von Verkehrsregeln,
• – versorgen des Backup-Systems mit Landmarken und Geschwindigkeit, um die Lokalisierung zu optimieren (z.B. offset drift von dead reckoning, spurgenaue Positionierung in die Karte anhand von Landmarken).

According to a further, not necessarily illustrated embodiment of the "seeing path" is connected to the primary electrical system and includes sensors for

• - generating static landmarks and dynamic objects (from which the trafficable space is calculated),
• - identify traffic rules,
• - Provide the backup system with landmarks and speed to optimize localization (eg offset drift from dead reckoning, accurate positioning in the map using landmarks).

• – einer vorrausschauenden Karte, welche spurgenaue Positionen und mittels des C2X-Systems erfasste Ereignisse enthält und min. für 5sec. Fahrt Kartendaten enthält,
• – von den Sensoren erfassten, dynamischen Objekten, die den befahrbaren Raum eingrenzen,
• – der Verkehrsregelfusion.

In the IDC, for example, the trajectories calculated by merger are calculated

• - a predictive map containing true-to-track positions and events recorded by the C2X system, and min. for 5sec. Driving map data contains
• - Dynamic objects detected by the sensors, which limit the trafficable space,
• - the traffic regulation merger.

In the IDC, the simple localization with the exact tracking localization from the backup system is continuously calibrated.

• – Kartendaten empfangen werden und Kartenkorrekturen an das Backend gesendet werden,
• – mittels des C2X-Systems erfasste Ereignisse empfangen werden und sog. Ego-C2X-Informationen gesendet werden.

According to a further, not necessarily illustrated embodiment of the "listening path" is connected to the backup electrical system and includes an antenna module, by means of which

• - card data is received and map corrections sent to the backend,
• - Receive events detected by the C2X system and send so-called Ego-C2X information.

• – genauer Karte,
• – GNSS-Lokalisierung mit dead reckoning, inkl. Geschwindigkeitsinformation aus den Sensoren,
• – Landmarken aus den Sensoren und
• – mittels des C2X-Systems erfassten Ereignissen im relevanten Umfeld.

In the SDC, the track-accurate position in the map is calculated, for example, by fusion

• - more accurate map,
• - GNSS localization with dead reckoning, including speed information from the sensors,
• - landmarks from the sensors and
• - Events recorded in the relevant environment using the C2X system.

• – Die Bahnführung über die Sensoren und mit den bereits ins IDC übergebenen Kartendaten, bis der Fahrer nach 5 sec. übernommen hat,
• – Überwachung der Positionsveränderung mittels differenzieller Lokalisierung mit präzisem Startwert (aus Backupsystem).

According to another embodiment, which is not necessarily illustrated, the "seeing path" assumes the following functions if the "listening path" fails:

• - the web guide over the sensors and with the card data already handed over to the IDC, until the driver has taken over after 5 seconds,
• - Monitoring of the position change by means of differential localization with precise start value (from backup system).

• 1. System zu autonomen Fahrzeugführung, umfassend Umfeldsensorik und Fahrzeug-zu-X-Kommunikationsmittel, wobei die Umfeldsensorik und die Fahrzeug-zu-X-Kommunikationsmittel jeweils dazu ausgebildet sind, Informationen über eine Fahrzeugumgebung zu erfassen, wobei das System dazu ausgebildet ist, anhand der erfassten Informationen ein Fahrzeug autonom zu führen, dadurch gekennzeichnet, dass Bestandteile des Systems derart an zwei voneinander unabhängige Bordnetze angebunden sind, dass das Fahrzeug bei Ausfall eines Bordnetzes in einen sicheren Zustand überführbar ist.
• 2. System nach 1, dadurch gekennzeichnet, dass eine Trajektorienplanung, eine einfache Lokalisierung, eine Motion-Control und Aktoren (Lenkung, Motorsteuerung und Bremse) an ein erstes Bordnetz angebunden sind.
• 3. System nach mindestens 1 oder 2, dadurch gekennzeichnet, dass wird bevorzugt die Antennenschnittstelle, eine spurgenaue Positionier- und Lokalisierungseinheit, Fahrzeug-zu-X-Kommunikationsmittel, ein Backup-Motion-Control, eine Backup-Aktorik (Backup-Lenkung, -Bremse) und eine Motorsteuerung an ein zweites Bordnetz angeschlossen sind.
• 4. System nach mindestens einem von 1 bis 3, dadurch gekennzeichnet, dass die Umfeldsensorik ebenfalls an das erste Bordnetz angeschlossen ist.
• 5. System nach mindestens einem von 1 bis 4, dadurch gekennzeichnet, dass das System dazu ausgebildet ist, jeweils erfasste Daten zwischen den Bordnetzen auszutauschen.
• 6. System nach mindestens einem von 1 bis 5, dadurch gekennzeichnet, dass das System dazu ausgebildet ist, das Fahrzeug bei Ausfall eines Bordnetzes noch für einen kurzen Zeitraum, insbesondere 5 bis 10 s, mittels der zuvor zwischen den Bordnetzen ausgetauschten Informationen autonom weiterzuführen.
• 7. System nach mindestens einem von 1 bis 6, dadurch gekennzeichnet, dass das System in ein Kraftfahrzeug integriert ist.
• 8. System nach mindestens einem von 1 bis 7, dadurch gekennzeichnet, dass die Umfeldsensoren Kamerasensorik und/oder Radarsensorik und/oder Lidarsenorik und/oder Ultraschallsensorik und/oder Temperatursensorik und/oder Regensensorik und/oder Straßenzustandssensorik umfassen.
• 9. System nach mindestens einem von 1 bis 8, dadurch gekennzeichnet, dass der sichere Zustand eine Übergabe der Fahrzeugführung an einen Fahrer oder ein Abstellen des Fahrzeugs auf einem hierfür vorgesehenen Platz ist.

Below is a systematic list of some aspects. These are not the claims of this application, it is understood, however, that the following list can be used as claims.

• A system for autonomous vehicle guidance comprising environment sensors and vehicle-to-X communication means, wherein the environment sensors and the vehicle-to-X communication means are each adapted to acquire information about a vehicle environment, the system being adapted to the information recorded to drive a vehicle autonomously, characterized in that components of the system are connected to two independent Bordnetze such that the vehicle in case of failure of a vehicle electrical system in a safe state can be transferred.
• 2. System according to 1, characterized in that a trajectory planning, a simple localization, a motion control and actuators (steering, engine control and brake) are connected to a first electrical system.
• 3. System according to at least 1 or 2, characterized in that is preferably the antenna interface, a track-accurate positioning and localization unit, vehicle-to-X communication means, a backup motion control, a backup actuator (backup steering, Brake) and a motor control are connected to a second electrical system.
• 4. System according to at least one of 1 to 3, characterized in that the environment sensor system is also connected to the first electrical system.
• 5. System according to at least one of 1 to 4, characterized in that the system is adapted to exchange each detected data between the on-board networks.
• 6. System according to at least one of 1 to 5, characterized in that the system is designed to autonomously continue the vehicle in case of failure of a vehicle electrical system for a short period, in particular 5 to 10 s, by means of previously exchanged information between the on-board networks.
• 7. System according to at least one of 1 to 6, characterized in that the system is integrated in a motor vehicle.
• 8. System according to at least one of 1 to 7, characterized in that the environmental sensors include camera sensors and / or radar sensors and / or Lidarsenorik and / or ultrasonic sensors and / or temperature sensors and / or rain sensors and / or road conditions sensor.
• 9. System according to at least one of 1 to 8, characterized in that the safe state is a transfer of the vehicle guidance to a driver or a parking of the vehicle in a space provided therefor.

The claims belonging to the application do not constitute a waiver of the achievement of further protection.

If, in the course of the procedure, it turns out that a feature or a group of features is not absolutely necessary, the applicant is now already seeking to formulate at least one independent claim which no longer has the feature or the group of features. This may, for example, be a subcombination of a claim present at the filing date or a subcombination of a claim limited by further features of a claim present at the filing date. Such newly formulated claims or feature combinations are to be understood as covered by the disclosure of this application.

It should also be noted that embodiments, features and variants of the invention, which are described in the various embodiments or embodiments and / or shown in the figures, can be combined with each other as desired.

Single or multiple features are arbitrarily interchangeable. Resulting combinations of features are to be understood as covered by the disclosure of this application.

Recoveries in dependent claims are not to be understood as a waiver of obtaining independent, objective protection for the features of the dependent claims. These features can also be combined as desired with other features.

Features that are disclosed only in the specification or features that are disclosed in the specification or in a claim only in conjunction with other features may, in principle, be of independent significance to the invention. They can therefore also be included individually in claims to distinguish them from the prior art.

With regard to the following claims, it should be noted that, for the purpose of better readability, the enumeration of reference symbols was at least partially dispensed with, in particular in the term "components".

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• IEEE 802.11p [0105]

Claims (28)

System ( 10 ) for autonomous vehicle guidance, comprising - a plurality of electrical and / or electronic components, - wherein the components are designed to cooperatively perform an autonomous vehicle guidance, characterized in that - each of the components of a first set ( 100 ) of components or a second quantity ( 200 ) of components is assigned, - whereby the components of the first set ( 100 ) are adapted to an at least limited and / or time-limited autonomous vehicle management even in the case of failure of the components of the second set ( 200 ), and - wherein the components of the second set ( 200 ) are adapted to an at least limited and / or time-limited autonomous vehicle management even in case of failure of the components of the first set ( 100 ). System ( 10 ) according to claim 1, characterized in that - the system ( 10 ) a first electrical system ( 102 ) and a second electrical system ( 202 ), wherein the first quantity ( 100 ) of components on the first electrical system ( 102 ) and the second set ( 200 ) of components on the second electrical system ( 202 ) connected. System ( 10 ) according to claim 1 or 2, characterized in that - the first quantity ( 100 ) of components has one or more of the following elements: device ( 110 ) for trajectory planning, device ( 120 ) for gross localization, in particular by means of satellite navigation and / or dead reckoning, device ( 130 ) for determining input parameters for actuators (motion control), - actuators ( 140 ), in particular steering, engine control, and / or brake, - environment sensors ( 150 . 160 ), in particular cameras, radars, Lidargeräte, ultrasonic sensors, temperature sensors, rain sensors and / or road condition sensors. System ( 10 ) according to one of the preceding claims, characterized in that - the first quantity ( 100 ) of components a camera ( 150 ) for determining input data for a localization function. System ( 10 ) according to claim 4, characterized in that the input data for the localization function is one or more of the following information: - visual odometry (motion estimation), - localization by means of simultaneous localization and mapping, - estimation of pitch, roll and / or roll rate. System ( 10 ) according to claim 4 or 5, characterized in that a component ( 120 ) is designed to determine an absolute position based on visual landmarks by means of images or data supplied by the camera and preferably also by means of map data. System ( 10 ) according to one of the preceding claims, characterized in that - the second set ( 200 ) of components comprises one or more of the following elements: - antenna interface ( 210 ), in particular for vehicle-to-X communication (C2X communication), device ( 220 ) for accurate positioning and / or localization, in particular by means of satellite navigation, odometry and / or landmark-based positioning, vehicle-to-X communication means ( 250 ) (C2X communication means), - further device ( 230 ) for determining input parameters for actuators (backup motion control), - additional actuators ( 240 ) (Backup actuators), in particular further steering (backup steering), further engine control (backup engine control) and / or additional brake (backup brake). System ( 10 ) according to one of the preceding claims, characterized in that the second quantity ( 200 ) a number of environment sensors ( 260 ), in particular cameras, radars, Lidargeräte, ultrasonic sensors, temperature sensors, rain sensors and / or road condition sensors. System ( 10 ) according to one of the preceding claims, characterized in that the second quantity ( 200 ) a number of driving dynamics sensors ( 270 ), in particular speed sensors, speed sensors, steering angle sensors, steering wheel angle sensors, acceleration sensors and / or yaw rate sensors. System ( 10 ) according to one of the preceding claims, characterized in that the system ( 10 ) is adapted to a vehicle ( 5 ) in case of failure of a vehicle electrical system ( 102 . 202 ) or in case of failure of at least one component in a safe state to transfer. System ( 10 ) according to claim 10, characterized in that the safe state, a transfer of the vehicle guidance to a driver, a reduction of the speed and / or a parking of the vehicle ( 5 ) on a space provided for this purpose, for example a side strip. System ( 10 ) according to one of the preceding claims, characterized in that at least one component of the second quantity ( 200 ) is designed, when operating both electrical systems ( 102 . 202 ) and / or when operating all components data to at least one component of the first set ( 100 ). System ( 10 ) according to claim 12, characterized in that it is in the case of components of the second set ( 200 ) to components of the first quantity ( 100 ) is one or more of the following information: Vehicle position in a global reference system, in particular WGS 84, Track-specific positioning, for example for use in a digital map, Information from a vehicle-to-X communication, for example dynamically changing objects, which may be on a trajectory, such as left-over vehicles, construction sites, special-purpose vehicles and / or traffic jams, traffic signal information, vehicle dynamics data of other vehicles, in particular of forward-driving, approaching or moving vehicles, with which stable convoy travel can be made possible Information about lane change intentions of other vehicles, in particular of preceding, approaching or moving vehicles, which relate to their own traffic lane, vehicle dynamics data, for example yaw rate and / or 3D yaw rate, acceleration and / or 3D acceleration, - steering angle, - wheel speed, - speed over ground, - slip angle. System ( 10 ) according to claim 12 or 13, characterized in that some or all of the components of the second quantity ( 200 ) to components of the first quantity ( 100 ) have a respective time stamp which indicates the time of the information acquisition. System ( 10 ) according to claim 14, characterized in that the time stamp is generated using global time information, in particular a time information obtained from satellite navigation. System ( 10 ) according to any one of claims 12 to 15, characterized in that the components of the second set ( 200 ) to components of the first quantity ( 100 ) data include global time information, in particular a time information obtained from satellite navigation. System ( 10 ) according to claim 16, characterized in that the time information to environment sensors ( 150 . 160 . 260 ) and the environment sensors ( 150 . 160 . 260 ) provide respective measured values with a timestamp based on the time information. System ( 10 ) according to one of claims 12 to 17, characterized in that at least one component of the first quantity ( 100 ) is designed to, in case of failure of the second electrical system ( 202 ) or at least one component of the second set ( 200 ) trajectory planning by means of components of the second set ( 200 ) to components of the first quantity ( 100 ) transmitted information for a certain period, preferably between 5 s and 10 s to perform. System ( 10 ) according to one of the preceding claims, characterized in that at least one component ( 110 ) of the first quantity ( 100 ) is designed, when operating both electrical systems ( 102 . 202 ) trajectory planning continuously to at least one component of the second set ( 200 ), at least one component ( 280 ) of the second set ( 200 ) is designed, in case of failure of the first electrical system ( 102 ) or components of the first set ( 100 ) continue to operate autonomous driving for a certain period of time using this trajectory planning. System ( 10 ) according to claim 19, characterized in that in case of failure of the first electrical system ( 102 ) consisting of a component ( 110 ) of the first quantity ( 100 ) is updated using data from vehicle-to-X communication. System ( 10 ) according to one of the preceding claims, characterized in that at least one component ( 250 ) or one not on the first electrical system ( 102 ) or the second electrical system ( 202 ) connected device is designed to, in case of failure of the first electrical system ( 102 ) and / or the second electrical system ( 202 ) and / or individual components via vehicle-to-X communication means ( 210 . 250 ) one or more messages to other vehicles and / or infrastructure the messages contain the information that the vehicle ( 5 ) is in an emergency operation. System ( 10 ) according to one of the preceding claims, characterized in that some or all of the data exchanged between the components and / or information have an integrity measure which indicates the quality of the data and / or information. System ( 10 ) according to one of the preceding claims, characterized in that redundant localization information is supplied to one or more components, and / or that the system ( 10 ) has a central component which executes a centrally monitoring algorithm and to which redundant localization information is supplied, the algorithm being adapted to execute an autonomous vehicle control or individual functions of an autonomous vehicle control even if one of the vehicle electric systems ( 102 . 202 ) or at least one component fails. System ( 10 ) according to one of the preceding claims, characterized in that the system ( 10 ) one or more components ( 120 . 220 ) in order to calculate a vehicle position in two ways, namely firstly based at least on vehicle dynamics data and satellite navigation data, and secondly based at least on camera data and preferably also on map data. System ( 10 ) according to one of the preceding claims, characterized in that the system ( 10 ) one or more components ( 280 ) to merge vehicle dynamics data, satellite navigation data and camera data as well as preferably also map data and to provide as fused information to other components. System ( 10 ) according to one of the preceding claims, characterized in that the first electrical system ( 102 ) a first power supply unit ( 104 ) and the second electrical system ( 202 ) a second power supply unit ( 204 ), wherein the first power supply unit ( 104 ) for the supply to the first electrical system ( 102 ) connected components and the second power supply unit ( 204 ) for the supply to the second electrical system ( 202 ) connected components, wherein furthermore the first electrical system ( 102 ) a first battery ( 106 ), which in case of failure of the first power supply unit ( 104 ) the power supply of the first electrical system ( 102 ), and / or wherein the second electrical system ( 202 ) a second battery ( 206 ), which in case of failure of the second power supply unit ( 204 ) the power supply of the second electrical system ( 202 ) takes over. System ( 10 ) according to claim 26, characterized in that it further comprises at least one battery management system ( 90 ), which is designed such that in case of failure of the first power supply unit ( 104 ) and the first battery ( 106 ) the second battery ( 206 ) the power supply of the first electrical system ( 102 ) and / or that in case of failure of the second power supply unit ( 204 ) and the second battery ( 206 ) the first battery ( 106 ) the power supply of the second electrical system ( 202 ) takes over. Motor vehicle ( 5 ), which is a system ( 10 ) for autonomous vehicle guidance according to one of the preceding claims.

Images