DE102021106505A1 - Method and control arrangement for self-diagnosis of a vehicle - Google Patents

Abstract

Method (400) and control arrangement (310) in a vehicle (100) for vehicle self-diagnosis. The method (400) comprises executing (401) a first measure of the vehicle (100) which is to be expected to trigger an alarm; detecting (402) the alarm triggered by the executed (401) first action; executing (403) a second action of the vehicle (100) which is expected to clear the alarm; detecting (404) that the alarm triggered by the performed (401) first action is canceled; and a determination (410) to allow / forbid the driving of the vehicle (100) based on the result of the performed (401) first action, the detection (402) of the triggered alarm, the performed (403) second action and / or detecting (404) the cleared alarm.

Description

Technical area

This disclosure relates to a method and a control arrangement in a vehicle. In particular, a method and a control arrangement in a vehicle for self-diagnosis are described.

background

A regular check of the vehicle condition ("vehicle health") before starting a journey is important from the point of view of road safety, on the one hand, but also to keep the vehicle in good working order and to maintain its function and its economic value. An example would be to walk around the vehicle with the engine running and the lights on to check that the lights are working, that the lamp glass is not broken or cracked (which can affect light distribution), that the rearview mirrors are intact and cracked before driving off, before driving are clean, there are no oil stains under the vehicle (which could be seen as an indirect sign of the need to visit the workshop), etc.

Fortunately, many vehicles have electrical tests that detect, for example, when a lamp is defective and give the driver a visual indication. However, none of the other defects described above cannot be detected by such known electrical tests. If the display of the vehicle (on which the visual indication is shown) malfunctions, the driver may not notice the output visual indication, resulting in a potentially dangerous traffic safety situation. It would be desirable to improve error code management and be able to detect, for example, an interrupted sensor or communication, an incorrect error display, etc.

Vehicles are often dependent on wireless communication with surrounding vehicles and other functional units outside the vehicle and, for example, on a functioning location service for navigation. If the wireless communication does not work correctly, traffic safety can be endangered.

The vehicle described here can be a means of transport in the broadest sense, such as a truck, a car, a motorcycle, a trailer, a bus, a bicycle, a train, a tram, an airplane, a watercraft or other similar manned or unmanned vehicle Mode of Transport.

Due to a lack of time and / or interest, many vehicle drivers may not check their vehicle regularly, at least not as thoroughly as might be desirable.

In addition, some vehicles can be unmanned, so called autonomous vehicles. So there is no driver present to check the condition of the vehicle.

In the case of a negligent driver and / or an unmanned vehicle, when it is finally brought to a workshop, it would be of great help to the auto mechanic and / or the vehicle manufacturer if they knew, for example, how long the fault has been going on, how it has arisen, whether there are consequential errors, etc. The negligent driver can do little to help the mechanic in such cases if regular vehicle checks are not carried out.

Another problem relates to digital maps used in a navigation device of the vehicle. Such maps are often based on collected data that may be out of date due to road modifications and extensions. This is dangerous for the driver who blindly trusts the navigator. For an autonomous vehicle, a trustworthy digital map is critical to a successful journey; however, updating digital maps requires a lot of labor.

Another problem, perhaps particularly in connection with autonomous vehicles, is that the vehicle may have been compromised or damaged while parking by an accident, break-in, sabotage, etc., which the warning messages provided may not be able to detect. The damage caused can represent a traffic safety problem, but it can also be important to record the incident in order to be able to report the damage to the insurance company and / or the police.

The pamphlet US20170269593 discloses a control system for an autonomous vehicle that checks the functionality of a number of components before the autonomous vehicle starts to travel. The detection of a defective component leads to the inactivation of the autonomous driving function. The tested vehicle functions are described as steering, braking, accelerating and / or shifting.

However, the disclosed control system does not represent a solution to the problems of disturbed vehicle-internal communication and / or of external-vehicle communication with other functional units.

The pamphlet US20170205824 presents a method for checking various data of a parked autonomous vehicle before starting a journey.

In this document, a solution for the problems of disturbed vehicle-internal communication and / or vehicle-external communication with other units is also not presented.

The WO 2019/088893 describes a vehicle that is adapted for manual or autonomous driving mode. Certain functions of the vehicle such as lights, stabilization system and brakes are checked before the change from manual driving mode to autonomous driving mode is permitted.

The document relates to the change of mode / permission to change the mode, not the initiation of a safe stop or a driving permit.

It would therefore be desirable to improve the fault detection of a vehicle before the vehicle is released.

summary

It is therefore an object of the present invention to solve at least some of the problems described above and to increase road safety by improving anomaly detection of the vehicle.

According to a first embodiment of the invention, this object is achieved by a method in a vehicle for vehicle self-diagnosis. The method includes executing a first measure of the vehicle that is expected to trigger an alarm. The method further comprises detecting the alarm triggered by the first measure carried out. In addition, the method includes performing a second measure on the vehicle, which is expected to cancel the alarm. In addition, the method includes detecting that the alarm triggered by the first action carried out has been lifted. The method comprises determining to allow / forbid driving the vehicle based on the result of the first measure carried out, the detection of the triggered alarm, the carried out second measure and / or the detection of the canceled alarm.

According to a second embodiment of the invention, this object is achieved by a control arrangement in a vehicle. The control arrangement aims at self-diagnosis of the vehicle. The control arrangement is configured to generate a command to carry out a first measure of the vehicle which is expected to trigger an alarm. Furthermore, the control arrangement is configured to detect that the alarm triggered by the first action carried out has been lifted. The control arrangement is additionally configured to determine, based on the result of the first action taken, the detection of the triggered alarm, the second action taken and / or the detection of the canceled alarm, that driving of the vehicle is permitted / prohibited.

Thanks to the embodiments described, the implementation of the self-diagnosis of the vehicle by executing the first measure to consciously trigger the alarm and then executing the second measure to cancel the alarm and intermittently monitoring the behavior of the alarms ensures that the internal communication and that with the executed Action-related alarm systems work before the vehicle is given permission to drive.

In any example of the first measure to be carried out, the pressure in the braking system of the vehicle can be reduced by braking. If the pressure in the brake system falls below a threshold value, an alarm / error code can be triggered. If the low pressure alarm has been detected, the second action, which involves increasing the pressure in the braking system, can be carried out, for example by running the on-board compressor until the low pressure alarm disappears.

This confirms the success of the measures carried out and also checks the functionality of the alarm handling before the vehicle is released for travel. Various problems that can occur on the vehicle, which are normally detected by an attentive driver, can be detected by the control routine provided for self-diagnosis, which increases road safety.

Further advantages and additional novel features can be seen from the following detailed description.

Figure list

• 1A eine Seitenansicht eines Fahrzeugs gemäß einem Ausführungsbeispiel der Erfindung;
• 1B ein Fahrzeug gemäß einem Ausführungsbeispiel der Erfindung in der Draufsicht;
• 2 ein Fahrzeug und eine fahrzeugexterne Funktionseinheit gemäß einem Ausführungsbeispiel der Erfindung;
• 3A ein Beispiel für eine Anomalie-Erfassung in einem Bild gemäß einem Ausführungsbeispiel der Erfindung;
• 3B ein Beispiel für eine Anomalie-Erfassung in einem Bild gemäß einem Ausführungsbeispiel der Erfindung;
• 3C ein Beispiel für eine Anomalie-Erfassung in einem Bild gemäß einem Ausführungsbeispiel der Erfindung;
• 3D ein Beispiel für eine Anomalie-Erfassung in einem Bild gemäß einem Ausführungsbeispiel der Erfindung;
• 4A ein Flussdiagramm, das ein Ausführungsbeispiel eines ersten Teils eines Verfahrens zeigt;
• 4B ein Flussdiagramm, das ein Ausführungsbeispiel eines zweiten Teils des Verfahrens zeigt; und
• 5 eine Darstellung, die ein System gemäß einem Ausführungsbeispiel zeigt.

Embodiments of the invention will now be described in more detail with reference to the accompanying figures. Show it:

• 1A a side view of a vehicle according to an embodiment of the invention;
• 1B a vehicle according to an embodiment of the invention in plan view;
• 2 a vehicle and a functional unit external to the vehicle according to an exemplary embodiment of the invention;
• 3A an example of an anomaly detection in an image according to an embodiment of the invention;
• 3B an example of an anomaly detection in an image according to an embodiment of the invention;
• 3C an example of an anomaly detection in an image according to an embodiment of the invention;
• 3D an example of an anomaly detection in an image according to an embodiment of the invention;
• 4A a flow chart showing an embodiment of a first part of a method;
• 4B a flow chart showing an embodiment of a second part of the method; and
• 5 FIG. 3 is a diagram showing a system according to an embodiment.

Detailed description

Exemplary embodiments of the invention described here are defined as a method and a control arrangement which can be implemented in the exemplary embodiments described below. However, these exemplary embodiments can be implemented by way of example in many different forms and are not to be restricted to the examples shown here; rather, these illustrative examples of embodiments are provided so that this disclosure will be thorough and complete.

Other objects and features can be apparent from the following detailed description when considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are intended for the purpose of illustration only and not as a definition of the scope of protection of the exemplary embodiments disclosed herein, for which reference should be made to the appended claims. Furthermore, the drawings are not necessarily to scale and, unless otherwise indicated, are only used to conceptually illustrate the structures and methods described herein.

In 1A shows a scenario with a vehicle 100 . The vehicle 100 drives on a road 115 in one direction of travel 105 .

The vehicle 100 may include a means of transport in the broadest sense, such as a truck, a car, a motorcycle, a trailer, a bus, a bicycle, a train, a tram, an airplane, a watercraft, a drone, a spacecraft or other similar manned vehicle or unmanned transport.

The vehicle 100 can be driver-controlled or driverless (ie autonomously controlled) in various exemplary embodiments. The disclosed solution can, however, be particularly advantageous for an autonomous vehicle.

The vehicle 100 may include various sensors, such as one or more forward-facing sensor (s) 110, one or more right-facing sensor (s) 120, one or more rear-facing sensor (s) 130, and / or or one or more left-facing sensor (s) 140, in the direction of travel 105 considered. This is also in 1B shown in a top view.

The sensors 110 , 120 , 130 , 140 may be of the same or different types and in different exemplary embodiments may include, for example, a camera, a stereo camera, an infrared camera, a video camera, a radar, a lidar, an ultrasound device, a time-of-flight camera or a similar device.

For example, in some embodiments, the sensors may comprise a motion detection device and / or be based on a passive infrared (PIR) sensor that responds to a person's skin temperature through the emitted blackbody radiation at medium infrared wavelengths, as opposed to background objects at room temperature; or by the emission of a continuous wave of microwave radiation and the detection of movement by the principle of Doppler radar; or by the emission of an ultrasonic wave and the detection and analysis of the reflections; or by a tomographic motion detection system based on the detection of radio wave interference, to name a few possible implementations.

The sensors 110 , 120 , 130 , 140 can in the vehicle 100 be arranged for various functionalities, such as the provision of environmental information for an advanced driver assistance system (ADAS) or a system for autonomous driving of the vehicle 100 .

Such sensors can be in the vehicle 100 and out of the vehicle 100 be directed out, for example to detect an obstacle in front of the vehicle 100 . Part of the image captured by the sensor, the video sequence or other However, information becomes your own vehicle 100 cover.

By using the vehicle's own sensors to collect information about your own vehicle 100 , image, video or other sensor information and the analysis of this information, for example by comparing this information with a stored ideal image, a video sequence or other sensor information of the vehicle 100 or part of it, may be an anomaly that is the result of a defective component on the vehicle 100 , or may be signs of an accident in the vicinity of the vehicle 100 , may ice on the street 115 etc. are recorded. This solution acts like a second pair of eyes (or the only pair of eyes in the case of an autonomous vehicle), constantly looking for anomalies that indicate a vehicle failure 100 can point out. This enables (part of) a self-diagnosis of the vehicle 100 before it drives off and / or before it leaves the vehicle 100 approved to leave a start zone. The launch zone can be a parking area, loading dock, fenced area, or other similar location where the vehicle is located 100 drives at low or limited speed.

The solution provided relates to the implementation of a measure to trigger an alarm on the vehicle 100 cause, ie to carry out an action which is known to lead to an alarm or warning, such as lowering the pressure in a braking system of the vehicle 100 by braking. Braking continues until the low pressure alarm is triggered, which ensures that the alarm is working as intended. The pressure of the braking system can then be increased, for example by operating the on-board compressor or an external compressed air supply, until the pressure level of the braking system has reached a sufficient / acceptable level and the alarm is cleared. Furthermore, it is monitored that the measure for raising the alarm does not trigger any other alarm in some exemplary embodiments.

In some exemplary embodiments, it can be checked whether the vehicle 100 Has the correct Functional Product Characteristic (FPC) codes. The FPC codes describe functional properties of the vehicle 100 .

It can also be checked whether the vehicle 100 Has active Diagnostic Trouble Codes (DTC) and / or incorrectly active DTCs before driving authorization is granted.

In addition, it can be checked whether every ECU in the vehicle 100 has the correct ECU source address or identity, e.g. by comparing the extracted ECU source address / identity with information from a database. Also a reference number to clearly identify the vehicle 100 can be taken and compared with a database, for example, for verification. In the event that the vehicle 100 does not include a control device with a capacity exceeding a minimum standard limit for autonomous driving or the vehicle 100 is on a black list ("hotlist") for decommissioned and / or stolen vehicles, the vehicle 100 be immobilized.

This ensures that internal communication and the warning system associated with a certain measure work before the vehicle is allowed to drive 100 is granted. This increases road safety.

Another example of vehicle self-diagnosis can be a door of the vehicle 100 open and check if an open door alarm is generated. Then the door is closed and a check is made to see whether the alarm has been canceled.

An example can also be the pressure (of a passenger) on a seat of the vehicle 100 detect, determine whether the seat belt is buckled, and trigger vehicle immobilization until the seat belt is buckled or the passenger enters the vehicle 100 leaves.

In some exemplary embodiments, the receipt of a confirmation of the correspondence between an expected result of a measure and the result of the measure carried out can be a prerequisite for the issuing of a driving permit for the vehicle 100 be. Thus, a lack of confirmation of the result of the measure by the expected result can lead to the vehicle 100 no driving permit is issued.

The non-confirmation of the result of the action by the expected result can be the cause, for example, that the intended action is not or not as expected, the alarms are not generated / canceled as expected and / or other unexpected behavior in relation to the vehicle 100 cause, e.g. by one of the sensors 110 , 120 , 130 , 140 , e.g. changes in the light distribution imply defective or inappropriate lamps, dirty or broken lamp glass, etc .; If the direction indicator light is missing when the direction indicator is used, this indicates that the indicator lamps are dirty or defective; indicate changes in the roll, Yaw or pitch angle of the cabin on a defective cabin suspension; the detection of faults in the high beam range trigger an adjustment of the light; the detection of errors in the function of the adaptive low beam (ie that the high beam is switched off when another vehicle or road user appears); the detection of unsecured cargo; the error detection for the rain sensor, etc.

In some exemplary embodiments, a command for an action is generated, the result of the command is checked and compared with an expected result. If they match (within a threshold value), the correctness of the action is confirmed. Otherwise, a deviation from the expected result of the command / action is recorded.

In one example, a command can be generated for the execution of a defined measure that is to be carried out by an actuator on the vehicle, e.g. turning the drive wheel to the left / right by a certain degree. The result of the command issued, i.e. the drive wheel angle, can be measured after a certain defined period of time. A comparison can then be made between the expected value according to the generated command and the measured result of the command. If the difference between these variables exceeds a threshold value (e.g. 5% difference, 10% difference or another predefined or configurable value), the recorded deviation can trigger a restricted driving permit, e.g. driving slower than a certain speed limit, driving at a greater distance to a vehicle in front, only driving outside of rush hour, only driving on certain roads, only driving to the workshop, completely blocked driving permit, etc.

Failure to obtain confirmation can also result in faulty communication with the sensors 110 , 120 , 130 , 140 and / or a malfunction of the sensors 110 , 120 , 130 , 140 or the actuators or refer to a malfunction of the positioning. Furthermore, a check with regard to the wireless communication with a unit external to the vehicle can be carried out, as in FIG 2 shown as an example.

2 shows a vehicle 100 , wirelessly with a functional unit external to the vehicle 200 via a wireless transceiver 210 communicates.

Wireless communication can take place via a wireless communication interface, such as vehicle-to-vehicle (V2V) communication or vehicle-to-infrastructure (V2I) communication. Sometimes the general term Vehicle-to-Everything (V2X) is also used.

In some embodiments, communication between the units 100 , 200 take place via V2V communication, e.g. based on Dedicated Short-Range Communications (DSRC) devices. DSRC operates in the 5.9 GHz band with a bandwidth of 75 MHz and an approximate range of 1000 m in some exemplary embodiments.

The wireless communication can take place according to any IEEE standard for wireless vehicle communication, such as a special mode of IEEE 802.11 for vehicle networks called Wireless Access in Vehicular Environments (WAVE). IEEE 802.11p is an extension of the 802.11 specification for the media access layer (MAC) and the physical layer (PHY) of the wireless LAN (Wireless LAN).

Other wireless communication options are e.g. Wi-Fi, Bluetooth, RFID, 3GPP LTE, etc.

In some exemplary embodiments, a test for the functionality of the wireless communication between the vehicle can be carried out 100 and the functional unit external to the vehicle 200 , and / or the functionality of the functional unit external to the vehicle 200 be performed.

The test can be carried out by sending a signal to the functional unit external to the vehicle 200 be carried out, which prompts them to send a reply message. If there is a response signal from the functional unit external to the vehicle 200 is received, the conclusion is that the wireless communication between the respective units 100 , 200 functions.

A more demanding test can, however, be a challenge-response mechanism, for example. A message (challenge) can be sent by the vehicle 100 to the functional unit external to the vehicle 200 be sent. The functional unit external to the vehicle 200 can perform an agreed operation on the challenge, e.g. add a shared secret value to the challenge and calculate a hash value according to a known algorithm. The calculated result (answer) is then sent to the vehicle 100 sent back where a comparison can be made by performing the same operations on the vehicle 100 be carried out, ie adding the shared secret value to the challenge and calculating the hash value. If the values are identical, the functional unit external to the vehicle can 200 regarded as functional will. It is also checked that the functional unit external to the vehicle 200 is not corrupted.

Other health tests may include passwords, mutual authentication using a two-way challenge-response mechanism, and the like.

The functional unit external to the vehicle 200 is in the embodiment shown with a database 220 and a sensor external to the vehicle 230 such as a camera, lidar, radar, etc.

In some embodiments, there may be an abnormality in the vehicle 100 based on sensor data collected by the off-vehicle sensor 230 are recorded, the sensor data of the vehicle 100 such as damage caused by vandalism or a flat tire.

So can the vehicle 100 Sensor data from the sensor external to the vehicle 230 from the functional unit external to the vehicle 200 request for anomalies related to the vehicle 100 capture.

3A Fig. 10 shows an example of a vehicle interior of the vehicle 100 and describes how the previous scenario in 1A , 1B and or 2 from a potential driver or passenger of the vehicle 100 can be perceived.

The vehicle 100 includes a control arrangement 310 for self-diagnosis of the vehicle 100 and thus to determine whether the vehicle 100 may or may not drive. The tax arrangement 310 can be a database 320 include or be connected to these, in the expected reference values of the vehicle 100 can be stored.

In the embodiment shown, an alarm can be displayed 330 be activated by evoking. In this case, the pressure in a braking system of the vehicle 100 can be reduced by sending a brake signal to a brake actuator. If the alarm caused by the low brake pressure is realized, the braking can be disabled and instead the pressure can be increased by generating a start signal to the compressor. The pressure of the braking system can then be increased, for example by operating the on-board compressor, until the pressure level of the braking system has reached a sufficient / acceptable level and the alarm is cleared. Furthermore, it is monitored that the measure for causing the alarm does not trigger any other alarm in some exemplary embodiments.

3B Fig. 10 shows an example of a vehicle interior of the vehicle 100 and represents like the previous scenario in 1A , 1B and or 2 from a potential driver or passenger of the vehicle 100 can be perceived.

The tax arrangement 310 can get information from sensors 110 , 120 , 130 , 140 of the vehicle 100 and / or from sensors external to the vehicle 230 collect. This information can be found in the database 320 get saved. A comparison can later be made between the currently collected sensor data and the previously stored sensor data from the database 320 can be retrieved.

The sensors 110 , 120 , 130 , 140 can be rotated and / or deflected in different directions, and the devices which are provided for the display of objects outside the direct field of view of a driver can use the set view of the associated sensor 110 , 120 , 130 , 140 represent.

The tax arrangement 310 can be used with the other in-vehicle units, such as the sensors 110 , 120 , 130 , 140 and / or actuators, for example communicate via a communication bus. The communication bus can include, for example, a Controller Area Network (CAN) bus, a Media Oriented Systems Transport (MOST) bus or the like. However, the data connection can alternatively take place via a wireless connection that includes any wireless communication technology such as Wi-Fi, Bluetooth, etc., or is at least inspired by this.

In the embodiment shown, a message appears on the display 330 displayed in order to make a potential driver / passenger aware of the observed and recorded anomaly and to make it easier for him to understand. However, it may not be a display at all 330 in the vehicle 100 available.

The tax arrangement 310 can be configured for image recognition / computer vision and object recognition.

Computer vision is a technical field that includes methods of capturing, processing, analyzing, and understanding images and, more generally, high-dimensional data from the real world to generate numerical or symbolic information. One theme in developing this field has been to duplicate the capabilities of human vision through electronic perception and understanding of an image. Understanding in this context means the conversion of visual images (the input of the retina) into Descriptions of the world that can be linked to other thought processes and evoke corresponding actions. This image understanding can be seen as the untangling of symbolic information from image data using models constructed using geometry, physics, statistics and learning theory. Computer vision can also be described as the endeavor of automating and integrating a wide range of processes and representations for image perception.

The image data from the sensors 110 , 120 , 130 , 140 can take many forms, such as images, video sequences, views from multiple cameras, or multidimensional data from a scanner.

By comparing an expected / normal state from the database 320 has been taken with the sensor data of the current state as received from one or more sensors 110 , 120 , 130 , 140 have been detected, an expected state can be confirmed. Alternatively, an anomaly can also be recorded. In the scenario shown, a crack in the headlight lens is detected.

In some exemplary embodiments, the driver / front passenger / owner can also be shown a recommendation for further action. If a crack is detected in the windshield, the driver / passenger / owner can be advised to cover the crack from the outside with a piece of transparent adhesive tape and then to drive to a glass repair shop. If there is nobody in the vehicle 100 the vehicle can 100 in some exemplary embodiments decide to drive to the workshop anyway. A wireless Internet connection can be used to search for such workshops near the vehicle's geographic location 100 and / or in the direction of travel 105 of the vehicle 100 can be carried out, and a recommendation can be made based, for example, on a price comparison, a check of the immediate service availability and / or the customer satisfaction of previous customers, if such information is available.

3C Fig. 10 shows another example of a vehicle interior of the vehicle 100 and depicts how a scenario in which a broken headlight glass from inside an autonomous vehicle 100 and by a vehicle owner (or other person responsible for the vehicle 100 is responsible) via a display device external to the vehicle 200 can be perceived at a distance from the vehicle 100 is located.

The vehicle 100 can in addition to the control device already described 310 , the data storage device 320 and the sensors 110 , 120 , 130 , 140 a wireless transmitter or transceiver 150 exhibit. The transmitter 150 can be wireless with the display device 200 of the vehicle owner / supervisor.

Communication can take place via a wireless communication interface, such as one of those listed above, or similar.

In the exemplary embodiment shown, the sensor data comparison showed that the vehicle 100 has a defective headlight glass on the left side. The detected anomaly thus results from a malfunction of a physical vehicle part. Since driving with defective headlights is illegal (at least in some jurisdictions), the vehicle was 100 parked on the roadside and the geographical position of the vehicle 100 to the display device 200 sent.

This allows the owner / the relevant responsible person / the autonomous repair bot to be informed about the situation and take appropriate measures, such as bringing the correct spare parts and tools, informing a transport recipient (if available) about the delay and asking someone to come to the vehicle 100 to drive to fix it.

The geographic position of the vehicle 100 can from the positioning unit 340 in the vehicle 100 which can be based on a satellite navigation system such as the Navigation Signal Timing and Ranging (Navstar) Global Positioning System (GPS), Differential GPS (DGPS), Galileo, GLONASS or the like.

The geographic location of the positioning unit 340 (and thus also of the vehicle 100 ) can be carried out continuously with a certain predetermined or configurable time interval according to various exemplary embodiments.

The positioning via satellite navigation is based on the distance measurement by means of triangulation of several satellites 350a , 350b , 350c , 350d . In this example there are four satellites 350a , 350b , 350c , 350d shown, but this is just an example. There can also be more than four satellites 350a , 350b , 350c , 350d used to increase accuracy or to create redundancy. The satellites 350a , 350b , 350c , 350d continuously send information about time and date (e.g. in coded form), identity (which satellite 350a , 350b , 350c , 350d sends), status and where the satellite is located 350a , 350b , 350c , 350d at a certain point in time. The GPS satellites 350a , 350b , 350c , 350d send information encoded with different codes, for example, but not necessarily, based on Code Division Multiple Access (CDMA). This allows the information of a single satellite 350a , 350b , 350c , 350d can be distinguished from the information of the other based on a unique code for each respective satellite 350a , 350b , 350c , 350d . This information can then be transmitted to the correspondingly adapted positioning device in the vehicle 100 to be received.

According to some exemplary embodiments, the distance measurement may include the measurement of the time difference that each respective satellite signal emitted by the respective satellite 350a , 350b , 350c , 350d is sent, required to the positioning unit 340 to reach. Since the radio signals move at the speed of light, the distance to the respective satellite can be 350a , 350b , 350c , 350d can be calculated by measuring the signal propagation time.

The positions of the satellites 350a , 350b , 350c , 350d are known because they are continuously monitored by approx. 15 to 30 ground stations, which are mainly located along and near the earth's equator. This allows the geographic position, ie latitude and longitude, of the vehicle 100 by determining the distance to at least three satellites 350a , 350b , 350c , 350d can be calculated by triangulation. According to some exemplary embodiments, the signals from four satellites 350a , 350b , 350c , 350d be used.

The geographic position of the vehicle 100 can alternatively be determined, for example by transponders, which are at known positions around the route of the vehicle 100 positioned around, and a dedicated sensor in the vehicle 100 to recognize the transponders and thereby determine the position; through the detection and recording of WiFi networks (WiFi networks along the route can be mapped to specific geographic positions in a database); by receiving a bluetooth beacon signal associated with a geographic location or other signatures of wireless signals such as triangulating signals broadcast by a plurality of fixed base stations with known geographic locations. The position can alternatively be determined by a passenger in the vehicle 100 can be entered.

After the geographic position of the positioning unit 340 (or otherwise) it can be displayed on the display device 200 are shown, for example on a map, on which, in some exemplary embodiments, the position of the vehicle 100 can be marked.

3D Fig. 10 shows another example of a vehicle interior of the vehicle 100 and describes a scenario in which a detected anomaly comprises a plausible deviation of information in a digital map which is based on at least a part of the sensor data and which represents the vehicle environment.

According to some exemplary embodiments, the acquired sensor data can be compared with a card status. Such a comparison can lead to the fact that in reality a different number of lanes is recorded than according to the map data, for example due to a recently completed construction site or simply due to an error in the stored map data or a malfunction of the navigation device 340 . This is just one example of such a possible deviation from reality, as shown by the vehicle sensors 110 , 120 , 130 , 140 is captured. Other examples can be a new street / entrance / exit; a new speed limit on an existing road; that a street has been changed to a one-way street, etc. The sensors 110 , 120 , 130 , 140 can continuously record and collect information from the road, traffic signs, etc. while driving, and it can make a comparison with map data and information relating to the vehicle's geographical position 100 related, such as speed limits and other restrictions.

If the correspondence between the reality and the stored map data could not be confirmed, an alarm can be issued in order to inform a person responsible for the digital map of the anomaly detected. Such an alarm can also be sent to the front passenger, if present, via the display 330 and / or a vehicle owner / supervisor on the display device 200 be communicated.

For autonomous vehicles it is important that the map data can be trusted for the navigation, as there may not be a driver present who notices and reacts to deviations from the map data, e.g. due to a road construction site, an accident or the like.

In some embodiments, the on-board sensors 110 , 120 , 130 , 140 Record indications of an accident or dangerous situation on or near the road, such as a stationary vehicle on a motorway; a reversing vehicle on a freeway; a vehicle traveling in the opposite direction of travel on a road; a vehicle traveling in a pedestrian zone or a bicycle lane; People or animals lying on the street, etc. in one such a case can be in addition to slowing down and / or stopping your own vehicle 100 the information about the recorded accident report is sent to a police station, a traffic monitoring center, an emergency call center or a similar facility.

the 4A until 4B show an example of a procedure 400 according to an embodiment. The flowchart in the 4A until 4B shows the procedure 400 for use in a vehicle 100 . The procedure 400 aims to provide vehicle self-diagnosis.

The vehicle 100 can for example be a truck, a bus, a car or a similar means of transport, as already mentioned, which is configured for autonomous driving.

The vehicle 100 can use a variety of sensors 110 , 120 , 130 , 140 include going in different directions around the vehicle 100 can be aligned around and each have a monitoring area that is at least partially part of your own vehicle 100 covers.

• Schritt 401 umfasst ein Durchführen einer ersten Maßnahme des Fahrzeugs 100, von der zu erwarten steht, dass sie einen Alarm oder Fehlercode auslöst. Die erste Maßnahme kann das Absenken des Drucks der Fahrzeugbremsanlage, den Versuch, die Fahrt mit aktivierter Feststellbremse zu starten, das Öffnen einer Tür oder Motorhaube, den Versuch, die Fahrt mit aktivierter Betriebsbremse zu starten, oder Ähnliches umfassen.

In order to be able to carry out the self-diagnosis of the vehicle correctly, the method 400 a series of steps 401 until 411 include. Some of these steps 401 until 411 however, can be done in several alternative ways. Some method steps may only be carried out in a few optional exemplary embodiments, such as the steps, for example 405 until 409 and or 411 . Furthermore, the steps described 401 until 411 be carried out in a slightly different chronological order than the numbering suggests. The procedure 400 can include the following steps:

• step 401 comprises performing a first measure on the vehicle 100 that can be expected to trigger an alarm or error code. The first measure can include lowering the pressure of the vehicle brake system, attempting to start driving with the parking brake activated, opening a door or bonnet, attempting to start driving with the service brake activated, or the like.

The purpose of performing the first action is to cause the alarm / error code to be triggered, thereby verifying that the action is being taken and that the alarm system is working as expected.

step 402 comprises detecting the alarm or error code generated by the first action carried out 401 was triggered.

The triggered warning / error code depends on the first measure and can be, for example, an alarm when the brake pressure is low, an alarm that the parking brake is activated, an alarm that a door / hood is open, that the service brake is active when attempting to drive, etc. include.

By checking the triggered alarm / error code, it is verified that the first action taken 401 has been carried out correctly and that the alarm system is working as expected, at least as far as the triggered alarm is concerned.

step 403 comprises performing a second measure of the vehicle 100 expected to clear the alarm / error code.

The second measure can therefore be related to the first measure carried out 401 and the triggered alarm / error code and include, for example, starting a compressor to build up the brake pressure, releasing the parking brake, closing the door / hood, releasing the service brake, etc.

step 404 comprises detecting that the first measure carried out 401 triggered alarm / error code is canceled, ie that the previously recorded alarm 402 is canceled, such as the alarm for low brake pressure, the alarm that the parking brake is activated, the alarm that a door / hood is open, that the service brake is activated when trying to drive, etc.

This is to determine that the second action was taken correctly and to verify / confirm that the alarm is working as expected.

In some exemplary embodiments, it can also be checked that the first (s) and / or second (s) measures carried out 401 , 402 have not activated any alarms other than those expected.

step 405 , which may only be carried out in a few particular exemplary embodiments, comprises obtaining a confirmation which confirms that a result of a measure carried out matches an expected result.

Failure to obtain the confirmation may, in some embodiments, be the result of a malfunction of a physical vehicle part or a malfunction of communication between vehicles.

Furthermore, in some embodiments, failure to obtain confirmation of the carried out measure from a deviation from an expected state of the vehicle 100 result under current driving conditions. The anomaly / deviation can, for example, be the sending of a defined input command to an actuator in the vehicle 100 include, for example, an instruction to turn the drive wheel 10 degrees. After a certain period of time, the angle of rotation of the drive wheel can be measured, and a comparison can be made between the command issued to the actuator and the result of the actuator operation resulting therefrom. If the difference between the compared values exceeds a threshold, such as 5%, it can be concluded that an anomaly has been detected.

Another example may be to activate the horn, listen to the sound of the horn with a noise-sensitive sensor and confirm that the result of the action taken matches the expected result; or, alternatively, to conclude that an anomaly was detected if the sound of the horn could not be detected in the expected time range.

Still other examples can be increasing / decreasing the vehicle speed, determining the speed of the vehicle 100 after a period of time, comparing the resulting speed with an expected speed and confirming that the result of the measure carried out matches the expected result; or alternatively, infer that an anomaly has been detected when the difference between the two values exceeds a threshold, such as 5%, 10%, 20%, etc.

Other examples are the activation of lights on the vehicle 100 such as headlights, parking lights, turn signals, etc., the search for the activated light with a vehicle's own sensor and the confirmation of the correctness or non-confirmation of the correctness of the action taken and / or the conclusion that an anomaly has been detected if the switched on light is not in could be recorded in the expected time range.

In some exemplary embodiments, the confirmation can be carried out on the basis of image recognition of sensor data obtained from an external vehicle sensor 230 come.

step 406 , which is possibly only carried out in a few particular exemplary embodiments in which step 405 has performed includes taking a third action to identify a cause for not obtaining the confirmation 405 to determine the effects of the lack of confirmation 405 to eliminate or at least reduce.

The third measure can, for example, take sensor data from a database 320 , retrieving error code information, requesting service / maintenance / cleaning from a service provider, contacting a vehicle owner or other responsible person and informing about the error of the action confirmation and similar actions.

step 407 , which is possibly only carried out in a few particular exemplary embodiments, comprises checking the functionality of a wireless communication between a control arrangement 310 of the vehicle 100 and a functional unit external to the vehicle 200 .

So can a communication failure in the wireless communication of the vehicle 100 with functional units 200 can be detected in the environment. Since the traffic safety of autonomous vehicles in particular in a 5G traffic environment depends to a large extent on correct wireless communication, a communication failure can have devastating consequences, which is why the vehicle is unable to communicate wirelessly 100 prevent you from driving. In some embodiments, the vehicle 100 be allowed to drive only below a maximum speed, e.g. 50 km / h, to the nearest workshop for maintenance.

step 408 , which is possibly only carried out in a few particular exemplary embodiments, comprises checking the functionality of a communication between a control arrangement 310 of the vehicle 100 and a vehicle sensor 110 , 120 , 130 , 140 .

For an autonomous vehicle, the lack of environmental sensor data or insufficient environmental data can be devastating to road safety. The inability to get sensor data from the vehicle sensors 110 , 120 , 130 , 140 Obtaining can be equated to driving a manned vehicle blindfolded, hence the inability to receive communications is driving the vehicle 100 can make completely impossible.

Of course, this depends on which sensor (s) 110 , 120 , 130 , 140 no information can be received. In the event that a redundant sensor, ie a sensor with a coverage area that can be monitored by one or more other sensors, is not able to communicate, the vehicle can 100 Drive at a limited speed such as 50 km / h to the nearest workshop, e.g. for maintenance.

step 409 , which may only be performed in some particular exemplary embodiments, includes estimating the braking performance and the friction between the tires of the vehicle 100 and the underground 115 .

In this way, an icy road can be detected at an early stage while driving and, for example, a more careful driving mode can be selected; or a tire change service vehicle can be alerted that comes and swaps tires for winter tires. Driving can be completely prohibited if the estimated braking power and / or the friction is lower than a first threshold value. In some embodiments, the vehicle 100 be allowed to travel at a limited speed, for example 50 km / h, if the estimated braking power and / or friction is higher than the first threshold value but lower than a second threshold value.

step 410 includes determining driving the vehicle 100 to approve / prohibit based on the outcome of the first action taken 401 , of capturing 402 the alarm triggered, the second action taken 403 and / or acquisition 404 of the canceled alarm.

So if the first measure taken 401 does not result in a triggered alarm that could be detected 402 and / or the triggered alarm cannot be canceled, it is determined that the trip is not authorized.

In some embodiments in which step 405 has performed, it may be determined 410 whether to proceed based on the obtained confirmation 405 or the confirmation not obtained 405 to approve / prohibit.

In some embodiments in which step 406 may be performed on the basis of the result of the third action performed 406 determine whether driving is permitted or prohibited.

In some embodiments in which step 407 carried out can be based on the result of the functionality test carried out 407 it can be determined whether driving should be permitted / prohibited.

In some embodiments in which step 408 carried out can be based on the result of the functionality test carried out 408 it can be determined whether driving should be permitted / prohibited.

In some embodiments in which step 409 has been performed, it can be determined based on the estimated 409 braking performance and friction whether 410 driving will continue to be permitted / prohibited.

By carrying out the first measure to consciously trigger the "error detection" and the subsequent review of the acknowledgment of the alarm / error code and the subsequent reversal of the process by carrying out the second measure to remove the alarm / error code, it is ensured that the vehicle 100 can continue a so-called "Safe Take Off" in autonomy mode. The measures implemented ensure that the entire chain for handling error codes actually works. If the driving permit cannot be issued, the deviation can be treated differently depending on the type and severity.

step 411 , which may only be performed in some particular exemplary embodiments, if it has been determined 410 that the vehicle is being driven 100 not approved, the performance of an activity or action to correct an anomaly or a reason why an action taken cannot be confirmed, and the authorization to drive the vehicle 100 include.

The activity / action can be to send a signal to a communication device 200 of the owner or another responsible person, e.g. in a traffic monitoring tower.

The action taken 411 may include the output of an alarm to a person responsible for the vehicle 100 about not attaining 405 a confirmation of an implemented measure.

Information regarding the error / anomaly detection / non-confirmation can be stored in a vehicle inspection file, which in various exemplary embodiments is located in an on-vehicle / off-vehicle data storage device 220 , 320 or at another suitable location.

This makes the vehicle inspection easier, as important information can be saved and made available to a mechanic who, thanks to the vehicle inspection file, can immediately understand and deduce which Problems with the vehicle 100 appeared. After the vehicle has been inspected and any anomalies detected have been resolved, the vehicle 100 the driving permit will be issued.

5 Figure 3 shows an embodiment of a system 500 in a vehicle 100 for vehicle self-diagnosis. The system 500 can at least some of the method steps described above 401 until 411 according to that described above and in 4A and 4B procedure shown 400 carry out.

The system 500 comprises at least one control arrangement 310 in the vehicle 100 , for self-diagnosis of the vehicle. The tax arrangement 310 is configured to receive a command to perform a first action on the vehicle 100 that is expected to trigger an alarm / error code. Furthermore, the control arrangement 310 configured to capture the alarm / fault code triggered by the first action taken. In addition, the control arrangement 310 configured to receive a command to perform a second action of the vehicle 100 that is expected to clear the alarm. The tax arrangement 310 is also configured to detect that the alarm triggered by the first action taken has been cleared. The tax arrangement 310 is also configured to determine that the vehicle is being driven based on the result of the first action taken, the detection of the triggered alarm, the second action taken, and / or the detection of the canceled alarm 100 approved / prohibited.

In some embodiments, the control arrangement is 310 configured to obtain an attestation confirming that a result of an action taken matches an expected result. In addition, the control arrangement 310 configured to drive the vehicle 100 allow / deny based on obtained / non-obtained confirmation.

In some exemplary embodiments, the confirmation that has not been obtained may have resulted from a defective physical vehicle part. Furthermore, according to some exemplary embodiments, the confirmation not obtained may indicate a deviation from an expected state of the vehicle 100 under current driving conditions. In some particular embodiments, the anomaly can be a deviation of information in a digital map and / or an error in a positioning device 340 include.

The tax arrangement 310 may, in some exemplary embodiments, be configured to take action to determine the cause of the non-obtained confirmation, to eliminate or at least reduce the effects of the non-obtained confirmation, and / or to further anomalies of the vehicle 100 that are caused by the same cause that led to the non-obtained confirmation. In addition, the control arrangement 310 be further configured to determine the driving of the vehicle based on the result of the third measure carried out 100 to approve / prohibit.

In addition, the control arrangement 310 in some exemplary embodiments, the functionality of wireless communication between the control arrangement 310 of the vehicle 100 and a functional unit external to the vehicle 200 check. The tax arrangement 310 may also be configured to determine whether the vehicle is driving based on the result of the functional test performed 100 is approved or prohibited.

The tax arrangement 310 can be configured to include the functionality of a communication between the control arrangement 310 and a vehicle sensor 110 , 120 , 130 , 140 to check. Communication typically takes place via a wired or wireless bus. The tax arrangement 310 can additionally be configured to determine, on the basis of the result of the functional test carried out, whether it is driving the vehicle 100 approves or prohibits.

In some further exemplary embodiments, the control arrangement 310 also be configured to control the braking performance and / or the friction between the tires of the vehicle 100 and the underground 115 appreciate. The tax arrangement 310 can also be configured to drive the vehicle 100 allow / deny based on the estimated braking power / friction.

The tax arrangement 310 can also be configured to - when it has determined that driving the vehicle 100 is not approved - a measure to enable the vehicle to be driven 100 perform.

Also can in the control arrangement 310 If the success of the action taken cannot be confirmed, the action taken may include the output of an alarm to a person in charge of the vehicle 100 to inform about the missing confirmation of measures.

The system 500 may comprise an actuator in order to carry out the first and / or the second measure.

Furthermore, the system 500 also a sensor 110 , 120 , 130 , 140 of the vehicle 100 include to sensor data related to the vehicle 100 capture.

The system 500 In some embodiments, an external vehicle sensor can be used 230 include.

The system 500 can also have a data memory 220 , 320 for storing acquired sensor data of a normal state of the vehicle 100 include.

The system 500 can also be a functional unit external to the vehicle 200 for wireless communication with the control arrangement 310 include.

The tax arrangement 310 can be a receiving circuit 510 that is configured to receive a signal from the sensors 110 , 120 , 130 , 140 , 230 ; and / or from the data storage device 320 to recieve.

Furthermore, the control arrangement 310 in accordance with some embodiments, a processing circuit 520 that is configured to include at least some of the method steps 401 until 411 the procedure described above 400 perform.

Such a processing circuit 520 may include one or more instances of processing circuitry, ie, a central processing unit (CPU), processing unit, processing circuitry, application specific integrated circuit (ASIC), microprocessor, or other processing logic capable of interpreting and executing instructions. The term “processing circuit” as used herein may thus represent / include a variety of processing circuits, such as one, some, or all of the circuits enumerated above.

In addition, the control arrangement 310 in some embodiments, a memory 525 include. The optional memory 525 may comprise a physical device that is used to temporarily or permanently store data or programs, ie command sequences. According to some embodiments, the memory 525 include integrated circuits with silicon based transistors. The memory 525 For example, a memory card, a flash memory, a USB memory, a hard disk or another similar volatile or non-volatile storage unit for storing data such as ROM (read-only memory), PROM (programmable read-only memory) Memory), EPROM (Erasable PROM - Erasable PROM), EEPROM (Electrically Erasable PROM - Electrically Erasable PROM), etc. in various exemplary embodiments.

Furthermore, the control arrangement 310 in some embodiments a signal transmitter 530 include. The signal transmitter 530 can be configured to send a signal to the presentation device, for example 200 , the data storage device 320 and / or to send to an actuator.

The ones described above, in the vehicle 100 steps to take 401 until 411 can through the one or more processing circuits 520 within the control arrangement 310 together with a computer program product for performing at least some of the functions of the steps 401 until 411 implemented. Thus, a computer program product that contains instructions for performing the steps 401 until 411 in the control arrangement 310 includes the procedure 400 that at least some of the steps 401 until 411 for vehicle diagnosis includes, perform when the computer program in the one or more processing circuits 520 the tax arrangement 310 is loaded.

Furthermore, some embodiments of the invention can be a vehicle 100 with the control arrangement 310 for vehicle self-diagnosis according to at least some of the method steps 401 until 411 include.

The computer program product described above can be provided, for example, in the form of a data carrier, the computer program code for performing at least some of the steps 401 until 411 According to some embodiments, when entering the one or more processing circuits 520 the tax arrangement 310 is loaded. The data carrier can be, for example, a hard disk, a CD-ROM disk, a memory stick, an optical storage device, a magnetic storage device or another suitable medium such as a disk or a tape, which can store machine-readable data in a non- ephemeral way may contain. The computer program product can also be made available as computer program code on a server and remotely, for example via an Internet or intranet connection, to the control arrangement 310 downloaded.

The terminology used in the description of the exemplary embodiments as shown in the accompanying drawings is not intended to restrict the method described 400 , the tax arrangement 310 , the computer program, of the system 500 and / or the vehicle 100 to understand. Various changes, substitutions and / or modifications can be made without departing from the exemplary embodiments according to the invention as set out in the appended claims.

As used herein, the term “and / or” includes any combination of one or more of the associated listed items. The term "or" used here is to be interpreted as a mathematical OR, i.e. as an inclusive disjunction; not as a mathematical exclusive OR (XOR) unless expressly stated otherwise. In addition, the singular forms “a”, “an” and “der / die / das” are to be interpreted as “at least one” and can therefore also include a large number of similar functional units, unless expressly stated otherwise. It is also evident that the terms “comprises”, “comprises”, “including” and / or “containing” specify the presence of the named features, measures, integers, steps, operations, elements and / or components, but specify the presence or Not excluding the addition of one or more other characteristics, measures, integers, steps, operations, elements, components and / or groups thereof. A single unit, such as a processing circuit, can fulfill the functions of several elements listed in the claims. The mere fact that certain measures are specified in mutually different dependent claims does not mean that a combination of these measures cannot be used advantageously. A computer program can be stored / distributed on any suitable medium, such as an optical storage medium or solid state medium supplied with or as part of other hardware, but it can also be distributed in other forms, such as over the Internet or another wired or wireless communication system.

QUOTES INCLUDED IN THE DESCRIPTION

This list of the documents listed by the applicant was generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Patent literature cited

• US 20170269593 A [0011]
• US 20170205824 A [0013]
• WO 2019/088893 [0015]

Claims (19)

Method (400) in a vehicle (100) for vehicle self-diagnosis, the method (400) comprising the following steps: Carrying out (401) a first measure of the vehicle (100) which is expected to trigger an alarm; Detecting (402) the alarm triggered by the performed (401) first action; Executing (403) a second action of the vehicle (100) which is expected to clear the alarm; Detecting (404) that the alarm triggered by the performed (401) first action is cleared; and Determining (410) to allow / forbid driving the vehicle (100) based on the result of the performed (401) first action, the detection (402) of the triggered alarm, the performed (403) second action and / or the Detection (404) of the canceled alarm. Method (400) according to Claim 1 further comprising the step of: obtaining (405) confirmation confirming that a result of an action taken matches an expected result; and wherein the determining (410) to allow / prohibit driving is further performed based on the obtained (405) confirmation. Method (400) according to Claim 2 further comprising, if no confirmation is obtained (405), the step of: performing (406) a third action to determine a cause for not obtaining (405) the confirmation of the effect of not obtaining the confirmation eliminate or at least reduce; and wherein the step of determining (410) to allow / prohibit driving is further carried out based on the result of the executed (406) third action. Method (400) according to one of the Claims 1 until 3 further comprising the step of: checking (407) the functionality of a wireless communication between a control arrangement (310) of the vehicle (100) and a unit (200) external to the vehicle; and wherein the step of determining (410) to allow / prohibit driving is further performed based on the result of the performed functional test (407). Method (400) according to one of the Claims 1 until 4th further comprising the step of: checking (408) the functionality of a communication between a control arrangement (310) of the vehicle (100) and a vehicle sensor (110, 120, 130, 140); and wherein the step of determining (410) to allow / prohibit driving is further performed based on the result of the functional test (408) performed. Method (400) according to one of the Claims 1 until 5 further comprising the step of: estimating (409) braking performance and friction between the tires of the vehicle (100) and a ground (115); and wherein the step of determining (410) to allow / prohibit driving is further performed based on the estimated (409) braking performance and friction. Method (400) according to one of the Claims 1 until 6th which, when determined (410) to prohibit the vehicle (100) from driving, further comprises the step of: performing (411) an anomaly recovery activity to enable the vehicle (100) to be allowed to drive. Method (400) according to Claim 7 wherein the performed (411) activity comprises the outputting of an alarm in order to inform a person responsible for the vehicle (100) about the inability to drive the vehicle (100). A control arrangement (310) in a vehicle (100) for vehicle self-diagnosis, the control arrangement (310) being configured to: generate a command to carry out a first measure of the vehicle (100) which is expected to trigger an alarm; detect the alarm triggered by the first action taken; generate a command to take a second action on the vehicle (100) that is expected to clear the alarm; record that the alarm triggered by the first action taken has been cleared; and to determine to allow / prohibit driving of the vehicle (100) based on the result of the first action taken, the detection of the triggered alarm, the performed second action and / or the detection of the canceled alarm. Control arrangement (310) according to Claim 9 further configured to: obtain confirmation confirming that a result of an action taken matches an expected result; and further determine, based on the obtained confirmation, to allow / prohibit driving of the vehicle (100). Control arrangement (310) according to Claim 10 further configured to: if no confirmation is obtained confirming that a The result of an action taken matches an expected result in order to determine a cause for the failure to obtain the confirmation; obtain, eliminate, or at least mitigate the effects of failure to obtain attestation; and determine to allow / prohibit driving of the vehicle (100) based on the result of the third action performed. Control arrangement (310) according to one of the Claims 9 until 11 further configured to: verify wireless communication functionality between the control arrangement (310) and an off-vehicle unit (200); and determine to allow / prohibit driving of the vehicle (100) based on the result of the functional test performed. Control arrangement (310) according to one of the Claims 9 until 12th further configured to: check the functionality of a communication between the control arrangement (310) and a vehicle sensor (110, 120, 130, 140); and determine to allow / prohibit driving of the vehicle (100) based on the result of the functional test performed. Control arrangement (310) according to one of the Claims 9 until 13th further configured to: estimate braking performance and friction between the tires of the vehicle (100) and the ground (115); and determine to allow / prohibit driving of the vehicle (100) based on the estimated braking performance and friction. Control arrangement (310) according to one of the Claims 9 until 14th further configured to, when determined to prohibit driving of the vehicle (100), perform an anomaly recovery activity to enable driving of the vehicle (100). Control arrangement (310) according to Claim 15 wherein the activity carried out comprises the outputting of an alarm in order to inform a person responsible for the vehicle (100) of the prevented driving of the vehicle (100). Computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method (400) according to one of the Claims 1 until 8th to execute. A computer-readable medium comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method (400) according to one of the Claims 1 until 8th to execute. Vehicle (100) with a control arrangement (310) according to one of the Claims 9 until 16 .

Images