EP4096980A1

EP4096980A1 - Asymmetric failsafe system architecture

Info

Publication number: EP4096980A1
Application number: EP20704436.3A
Authority: EP
Inventors: Oliver WULF; Andreas Goers; Thomas Dieckmann
Original assignee: ZF CV Systems Global GmbH
Current assignee: ZF CV Systems Global GmbH
Priority date: 2020-01-31
Filing date: 2020-01-31
Publication date: 2022-12-07
Also published as: US20220363276A1; CN115023380A; WO2021151501A1

Abstract

The invention relates to a method (1) for controlling a vehicle (2) having an autonomous vehicle system (5), which has an autonomous operating driving system (9) that is designed to perform a dynamic driving task (FA) in a fault-free mode of the autonomous operating driving system (9) and a redundant driving system (11) that is designed to perform a reduced driving task (FAR). The autonomous operating driving system (9) performs trajectory planning and provides a planned trajectory (TR) for the reduced driving task (FAR) to the redundant driving system (11). If a fault (E1) is detected with the operating driving system (9), the redundant driving system (11) actuates at least one vehicle actuator (7) in order to perform the reduced driving task (FAR) using the planned trajectory (TR). The invention furthermore relates to an autonomous vehicle system (5) and to a vehicle (2) having an autonomous vehicle system (5).

Description

ASYMMETRIC FAILSAFE SYSTEM ARCHITECTURE

The invention relates to a method for controlling a vehicle, in particular a commercial vehicle, with an autonomous vehicle system that is designed to control the vehicle by means of several vehicle actuators, the vehicle system having: An autonomous operational driving system that is used to perform a dynamic driving task is designed in error-free operation of the autonomous operational driving system, the autonomous operational driving system controlling at least one of the vehicle actuators for performing the dynamic driving task in error-free operation, and a redundancy driving system. The invention also relates to an autonomous vehicle system.

Autonomous vehicle systems are designed to control one or more actuators of a vehicle in such a way that a driving task of the vehicle is carried out. Autonomous vehicle systems regulate the lateral and longitudinal acceleration of vehicles partially or completely independently of a human user. In order to operate a vehicle without a driver, many different sensors are required to record the environment as well as high computing power to evaluate the sensor data streams. Based on sensor data, the autonomous vehicle system determines a trajectory for the vehicle's driving task. While the vehicle follows the trajectory, the autonomous vehicle system monitors the environment and modifies the trajectory if necessary.

A common five-stage scheme for classifying the degree of automation of vehicles that are controlled by means of an autonomous vehicle system was developed by the Society of Automotive Engineers (SAE). Even in the event of a fault, the vehicle must be able to continue to operate safely until it can no longer pose a risk. In autonomy levels 3 to 5, the driving environment is monitored by the autonomous Driving system, whereby in level 3 the human user takes over the entire vehicle control in the event of an error in the autonomous driving system. In the autonomy levels 4 and 5, redundancy systems are provided which, in the event of a failure of an autonomous operational driving system, at least partially carry out the driving task. Such redundancy systems are necessary in order to avoid collisions with other vehicles, people or the vehicle environment in the event of a system failure and, if necessary, to safely brake the vehicle to a standstill.

Although the redundancy system is only used extremely rarely or possibly never in the course of a vehicle's life, redundancy systems are in some cases designed as complete duplicates of the autonomous driving system including the highly complex sensors, which results in high costs for the overall system. Various approaches are known to avoid the high costs of a completely redundant system. For example, from DE 102015206496 A1 a control device for a vehicle with a number of driver assistance systems and a monitoring device is known, the driver assistance systems being designed to control the vehicle by means of a number of vehicle actuators. In one embodiment of the control device, a control device can also be provided which is designed to monitor a computing device and / or the monitoring device for errors. If an error is detected, the control device can output a warning signal at least to the driver assistance systems and prevent the monitoring device from limiting the control signals. In a further embodiment, the driver assistance systems can be designed to calculate an emergency trajectory for safely braking the vehicle to a standstill when the warning signal is received and to control the vehicle actuators in accordance with the calculated emergency trajectory. In this case, however, the system does not reveal any redundancy of the system in the event of failure of the driver assistance systems and / or the sensors connected therewith. Furthermore, the monitoring function is carried out permanently, which results in an increased energy requirement. DE 10 2018 126 270 A1 discloses a vehicle with a virtual vehicle control system with several platform controls for vehicle actuators. In the event of an error, a vehicle computer is programmed to receive recommendations for a minimum risk condition from the platform controls and to select an event from the recommendations received which is then carried out. In the event that one or more sensors fail, the minimum risk condition is carried out using the sensors that are still available. A redundancy of the sensors themselves is not disclosed.

US 2019 0171205 A1 discloses a method for operating a vehicle control system that includes at least one downstream system with at least one actuator. The downstream system receives signals from an upstream system and acts on movement of the vehicle using the signals. The method comprises the steps of: transmitting signals from the upstream system to the downstream system in real time; determine that a fault has occurred upstream of the downstream system; and using a downstream system response plan that defines an operational sequence of the at least one actuator of the downstream system and that has been previously stored in a memory accessible to the downstream system. Since the reaction plan has already been saved, the redundancy system cannot react to changed environmental conditions. Furthermore, the upstream system and the downstream system are arranged in a common circuit, with no redundancy being provided for a failure of the downstream system.

The disadvantage of the solutions mentioned is that insufficient redundancy is provided. For example, the systems do not offer sufficient redundancy in the event of a failure of the highly complex sensor system of the main system, the main computing unit and / or one or more actuators. Here- as a result, security in the event of a failure of the main system cannot always be adequately guaranteed.

There is therefore a need for methods for controlling a vehicle and for autonomous vehicle systems that are inexpensive or use inexpensive components and ensure sufficient safety in the event of a fault in the autonomous operational driving system.

The present invention solves the problem in a first aspect in a method for controlling a vehicle with an autonomous vehicle system in that the redundant driving system is designed to carry out a reduced driving task, the autonomous operational driving system being designed to plan trajectories perform in order to carry out a planned trajectory for the reduced driving task and make it available to the redundant driving system, the autonomous operating driving system and the redundant driving system being connected to one another and determining whether there is a fault in the other system, and the redundancy - Driving system controls at least one of the vehicle actuators after determining a fault in the autonomous operational driving system in order to carry out the reduced driving task using the planned trajectory.

The invention makes use of the knowledge that a reduced driving task can be carried out with the aid of a simplified redundant driving system, which is significantly more cost-effective than the autonomous operating driving system. Both the autonomous operational driving system and the redundant driving system are designed to control vehicle actuators. If there are no errors, the autonomous operating driving system preferably carries out the dynamic driving task completely independently of the redundant driving system. The dynamic driving task generally includes steering, braking and accelerating the vehicle while taking environmental conditions into account, as well as determining intermediate destinations and waypoints. As part of the dynamic driving task, the autonomous operational driving system must at least respond to other road users, signals and signs, Environmental influences and road conditions react. For example, the dynamic driving task can be autonomous driving of the vehicle on a public road from a first location to a second location, the second location being several kilometers away from the first location. The reduced driving task has a reduced scope of functions relative to the dynamic driving task.

The planned trajectory for the reduced driving task describes the planned movement path of the vehicle and is determined as part of a trajectory planning. The trajectory planning is preferably carried out taking into account the vehicle condition, in particular the speed, the mass and the lateral acceleration, as well as other environmental conditions and environmental influences. Such ambient conditions and environmental influences can be, for example, ambient temperature, road temperature, road conditions, lane widths, lane course and traffic volume. Since the planned trajectory for the reduced driving task is provided by the autonomous operating driving system on the redundant driving system, the redundant driving system does not have to carry out its own trajectory planning for the reduced driving task. This also makes it possible to increase the availability of the planned trajectory in the event of a fault. The redundancy driving system is preferably designed to carry out a driving assistance function in a non-autonomous operating case. The redundancy driving system particularly preferably performs an emergency braking function, a lane keeping assistance function or a distance keeping assistance function when the vehicle is not operating autonomously. The redundancy driving system preferably has a redundancy memory for storing the planned trajectory.

According to a first preferred embodiment, the redundancy driving system is designed to carry out reduced trajectory planning in order to obtain a reduced trajectory for the reduced driving task if no valid planned trajectory is provided by the autonomous operational driving system, the redundancy driving system according to Determine a fault in the autonomous operating driving system at least one of the Controls vehicle actuators in order to carry out the reduced driving task using the reduced trajectory. In the case of particularly serious errors, the autonomous operational driving system cannot carry out trajectory planning and cannot provide a planned trajectory for the redundant driving system. Furthermore, the planned trajectory can be invalid, for example due to a transmission error or the expiry of a time stamp. In order to still be able to carry out the reduced driving task, the redundancy driving system can carry out a reduced trajectory planning, the functional scope of which is limited compared to the trajectory planning. For example, in the case of the reduced trajectory planning, a parameter set that is reduced compared to the trajectory planning can be used. Furthermore, the reduced trajectory planning compared to the trajectory planning can be carried out based on qualitatively and / or quantitatively reduced data. Furthermore, the reduced trajectory can be limited compared to the planned trajectory. For example, the maximum length of the reduced trajectory can be reduced compared to the planned trajectory. Furthermore, a maximum length of the trajectory and / or a maximum length of time that a vehicle needs to travel the trajectory is preferably restricted.

The redundancy driving system is preferably designed to determine whether a planned trajectory provided by the autonomous operational driving system is suitable for performing the reduced driving task. Furthermore, the redundancy driving system is preferably designed to carry out the reduced trajectory planning in response to determining an invalidity of the planned trajectory in order to obtain a reduced trajectory for the reduced driving task.

The autonomous operational driving system preferably carries out the trajectory planning cyclically in order to obtain a planned trajectory, and in each case provides the planned trajectory to the redundant driving system. The redundancy driving system uses the last planned trajectory provided to carry out the reduced driving task. By means of a cyclical As a result of the trajectory planning, the planned trajectory can be adapted to changed conditions of the vehicle or the vehicle environment. This is advantageous, for example, if another vehicle changes lanes after trajectory planning has been carried out and the planned trajectory is blocked as a result. Particularly preferably, a cycle time between two successive trajectory planning has a range of 1 ms to 10 seconds, preferably 1 ms to 1 second, preferably 1 ms to 500 ms, more preferably 1 ms to 20 ms, particularly preferably about 10 ms.

The shorter the cycle time between two successive trajectory planning, the lower the probability that the planned trajectory for the reduced driving task is unsafe due to changed conditions. In general, however, the energy requirement of the autonomous operating driving system increases with a decreasing cycle time.

In a further preferred embodiment, the autonomous operational driving system has one or more primary sensors which provide sensor data to a central control unit of the autonomous operational driving system, the central control unit executing the trajectory planning using the sensor data. The primary sensors preferably have highly complex sensors, such as at least one 3D lidar scanner, an imaging radar, a stereo camera, a mono camera, a receiver for V2X data, a receiver for GPS information, a fusion of imaging sensors, an acceleration sensor, a yaw rate sensor, a wheel speed sensor and / or a steering wheel angle sensor.

The central control unit is designed to evaluate the sensor data and to generate information about a vehicle state and / or the vehicle environment therefrom. For example, the central control unit can use the sensor data to determine the course of a lane in which the vehicle is located. The primary sensors allow a particularly precise determination of the vehicle condition and / or the vehicle environment. By using the sensor data for trajectory planning, a high accuracy and / or security of the planned trajectory can be ensured.

According to a further preferred embodiment, the redundancy driving system has one or more simple redundancy sensors that provide redundancy sensor data to a central redundancy control unit, where the central redundancy control unit uses the redundancy sensor data to determine whether there is an obstacle on the planned trajectory or the reduced trajectory and modify the planned trajectory or the reduced trajectory using the redundancy sensor data when an obstacle is determined on the planned trajectory or the reduced trajectory. In comparison to the particularly highly complex primary sensors, the redundancy sensors are preferably simple and inexpensive sensors, the quality of the redundancy sensor data provided by the redundancy sensors being lower compared to the sensor data. For example, a resolution of the vehicle environment can be restricted. The redundancy sensors preferably have a radar and / or a camera. The redundancy sensors are particularly preferably sensors that are used in common driver assistance systems, such as, for example, a lane keeping assistance system or an emergency braking assistance system. Sensors of common assistance systems are widely used and are therefore comparatively inexpensive. A functional scope of the central redundancy control unit is preferably restricted in comparison to the central control unit. For example, the computing power and / or the storage capacity of a memory can be designed to be lower. This enables financial resources to be saved in the context of the initial equipment as well as reduced energy consumption. Since the redundancy driving system has its own redundancy sensors, the reduced driving task can also be carried out safely if there is a fault in the highly complex primary sensors. Furthermore, in the event of a complete failure of the operational driving system, the redundancy driving system can ensure that the reduced task is carried out safely even if, after the trajectory planning or the reduced trajectory planning, there is an obstacle along the planned trajectory and / or the reduced trajectory occurs. For example, a planned trajectory for moderate braking of the vehicle can be modified to the trajectory of full braking of the vehicle if the central redundancy control unit uses the redundancy sensor data to determine that there is an obstacle on the planned trajectory.

According to a preferred embodiment, the redundancy driving system is supplied from a redundancy voltage supply that is independent of the operating driving system. A further potential source of error which endangers the safe operation of the autonomous vehicle system can be excluded by such a configuration. Even if there is an error in the autonomous operating driving system due to a failure of a main voltage supply, the redundant driving system can be supplied with voltage by the redundant voltage supply and carry out the reduced driving task. The redundancy voltage supply preferably has a lower capacity than a main voltage supply. As a result, the costs for the redundancy voltage supply can be reduced in comparison to the costs of the main voltage supply. Due to the lower range of functions of the redundant driving system, its energy consumption is reduced compared to the autonomous operational driving system, so that the supply is also possible with a redundant power supply with a lower capacity.

The redundancy sensors preferably also provide the redundancy sensor data to the central control unit. It can thus be achieved that the central control unit can also use the redundancy sensor data when performing the trajectory planning. Thus, the quality of the trajectory planning and the planned trajectory obtained therefrom can preferably be further improved. The central control unit is preferably designed to verify at least part of the sensor data of the primary sensors by means of the redundancy sensor data. The reduced driving task is preferably a controlled braking maneuver in which the redundant driving system prevents the wheels of one axle of the vehicle from locking. Blocking the wheels of the vehicle can lead to uncontrolled movement of the vehicle, so that the planned trajectory or the reduced trajectory may not be able to be adhered to. In addition, a braking distance of the vehicle when the wheels are locked is lengthened. The planned trajectory and / or the reduced trajectory for the controlled braking maneuver is preferably designed in such a way that the vehicle is decelerated with moderate acceleration values and an available braking distance is thus used. With moderate values of the acceleration, the vehicle or a trailer can be prevented from breaking away, the vehicles following behind and / or damage to the vehicle load can be avoided. However, it should be understood that the controlled braking maneuver can also be an emergency braking of the vehicle if necessary. This is the case, for example, when there is no sufficient braking distance available for moderate braking. The controlled braking maneuver can ensure that the vehicle is safely braked to a standstill. If the autonomous operating driving system fails, the vehicle is safely brought to a standstill by the redundant driving system, collisions with other vehicles and / or obstacles in the vehicle environment being avoided by the redundant driving system.

The controlled braking maneuver is preferably a lane keeping braking maneuver in which the vehicle maintains a lane, and / or a lane change braking maneuver in which the vehicle is steered and decelerated onto an existing drivable alternative lane, preferably a hard shoulder, the central redundancy control unit monitors compliance with the planned trajectory or the reduced trajectory using the redundancy sensor data. In a lane keeping braking maneuver, which is also referred to as a stop-in-lane braking maneuver, the planned trajectory and / or the reduced trajectory runs along a lane in which the vehicle is located. It should be understood that the lane also can be curved or can have a curve. The lane-keeping braking maneuver is preferably carried out if there is no alternative lane that can be driven on. This is the case, for example, when the vehicle is driving on a single-lane road or when a hard shoulder is blocked by a defective vehicle. The planned trajectory and / or the reduced trajectory for a lane change braking maneuver runs from a first lane in which the vehicle is located to a further lane which can be driven on.

It should be understood that the planned trajectory and / or the reduced trajectory for the lane change braking maneuver can also run over more than two lanes. The central redundancy control unit is preferably designed to modify the planned trajectory or the reduced trajectory using the redundancy sensor data. The lane change braking maneuver, which is also referred to as a stop-on-hard-shoulder braking maneuver, is preferably carried out. The redundancy driving system is particularly preferably designed to determine whether a lane change braking maneuver is possible. The redundancy control unit is preferably designed to use the redundancy sensor data to determine whether there is an obstacle in the lane in which the vehicle is located or in the alternative lane.

In a preferred embodiment, if there is no error, the central control unit carries out an operating trajectory planning in order to obtain an operating trajectory, and provides the operating trajectory to an operating controller and a redundancy controller, the operating controller and / or the Redundancy controller control at least one of the vehicle actuators in order to keep the vehicle on the pre-planned operating trajectory. Here, the operating trajectory is planned by the central control unit of the autonomous operating driving system, the operating controller controlling the vehicle actuators using the from the central Control unit be provided operating trajectory controlled in such a way that the vehicle is kept on the pre-planned operating trajectory. The autonomous operating driving system is preferably of modular design, the central control unit carrying out the planning and the operations controller carrying out the planned driving task executes. The redundancy controller represents a redundancy level for the operating controller. In the event of an error in the operating controller, the planned operating trajectory is provided by the central control unit to the redundancy controller so that at least some of the vehicle actuators can continue to be controlled. The operations controller and / or the redundancy controller is preferably designed to determine whether there is a fault in a vehicle actuator. The operation controller and / or the redundancy controller is particularly preferably designed to provide a detected fault in a vehicle actuator to the central control unit and / or the redundancy control unit.

It is also preferred that the vehicle actuators have at least one vehicle actuator from the group: transmission, engine, main brake system, redundancy brake system or steering actuator. Preferably the transmission is an automatic transmission. The main brake system and / or the redundancy brake system is preferably designed as a pneumatic brake system. Furthermore, before given to the main brake system and / or the redundancy brake system is an electronic brake system. Furthermore, the main brake system and / or the redundancy brake system preferably regulates a brake pressure of brake cylinders of the wheels individually.

According to a further preferred embodiment, the central redundancy control unit provides the planned trajectory or the reduced trajectory of the reduced driving task to the operations controller and the redundancy controller, the operations controller and / or the redundancy controller controlling at least one of the vehicle actuators in order to move the vehicle on the trajectory of the to keep reduced driving task if there is no operating trajectory in the event of a fault in the operating driving system. The trajectory of the reduced driving task can be the planned trajectory or the reduced trajectory. The operations controller and the redundancy controller are preferably designed to accept the planned trajectory or the reduced trajectory of the reduced driving task only if no operating trajectory is received from the central control unit of the autonomous operating system. Driving system is provided. The central control unit is preferably connected to the operations controller and the redundancy controller and the central redundancy control unit is also connected to the operations controller and the redundancy controller. Safe operation of the vehicle can thus also be ensured if, for example, the central control unit and the redundancy controller fail at the same time. As a result, the security of the system can advantageously be improved. Furthermore, safe operation of the vehicle is ensured even if the autonomous operating driving system or the redundant driving system fail completely.

The operations controller preferably monitors an error status of the redundancy controller and the redundancy controller monitors an error status of the operations controller. The operation controller and the redundancy controller are particularly preferably designed to provide an error status of the respective other component at the central control unit and / or the redundancy control unit if there is an error in the respective other component. The central control unit preferably carries out the trajectory planning and / or the operating trajectory planning using the error status of the operating controller and / or the redundancy controller. Likewise, the central redundancy control unit carries out the reduced trajectory planning, preferably using the error status of the operation controller and / or the redundancy controller. With such a configuration, it is possible to take into account within the framework of the operational trajectory planning, the trajectory planning and / or the reduced trajectory planning if one or more vehicle actuators cannot be activated due to an error in the operation controller and / or the redundancy controller.

In a preferred embodiment, in the event that a main brake system of the operational driving system fails, the vehicle is braked by means of a redundancy braking system that is independent of a main voltage supply of the operational driving system. However, it can advantageously be achieved that even if the main brake system fails, the vehicle can be safely braked to a standstill. The control of the redundancy braking system can be carried out by the operation controller as well as by the redundancy controller. It should be understood, however, that the main braking system can be supplied from the redundancy voltage supply and the redundancy braking system can be supplied from the main voltage supply.

According to a further preferred embodiment, the vehicle is steered by means of a steering actuator which is controlled by the redundancy controller and is independent of a main voltage supply of the operational driving system. It is thus also possible to steer the vehicle in the event that the main voltage supply of the operational driving system fails. The main brake system and the steering actuator are particularly preferably supplied by different power supplies. It should be understood that the steering actuator is controlled by the redundancy controller or the operating controller in error-free operation using the operating trajectory provided by the central control unit.

In the event that a steering actuator of the operational driving system fails, emergency steering of the vehicle is carried out by means of a main braking system, the main braking system preferably being controlled by the redundancy controller. Likewise, the main brake system can preferably also be activated by the operation controller. The main brake system is preferably supplied from the main voltage supply. However, it can also be provided that the main brake system is independent of the main voltage supply and is supplied with voltage by means of the redundancy. The emergency steering is preferably carried out by selective braking of individual wheels, preferably individual front wheels, of the vehicle. If, for example, the left front wheel of a commercial vehicle is braked, the steering wheel of the commercial vehicle can be turned to the left due to the special axle kinematics of commercial vehicles. The emergency steering enables the vehicle to be kept in a lane even in the event of a fault in the steering actuator, the autonomous operating driving system and / or the voltage supply connected to the steering actuator. Preferably, the emergency steering also enables the vehicle to change lanes.

According to a second aspect, the invention solves the task set at the beginning with an autonomous vehicle system for controlling a vehicle, in particular a special commercial vehicle, comprising: An autonomous operating driving system that is used to control at least one vehicle actuator of the vehicle to carry out a dynamic driving task in error-free operation of the autonomous operational driving system is designed, a redundancy driving system that is designed to perform a reduced driving task, wherein the autonomous operational driving system is designed to obtain a ge planned trajectory for the reduced driving task to carry out a trajectory planning and the planned trajectory on the Provide redundancy driving system, the autonomous operational driving system and the redundant driving system being connected to one another and designed to determine whether there is a fault in the other system, the redundant driving system for controlling at least one F. ahrzeugaktuators is designed to perform the reduced driving task when determining a fault in the autonomous operating driving system using the planned trajectory.

In error-free operation, the driving task is taken over by the autonomous operating driving system, while the redundant driving system is provided as a fall-back level in the event of an error in the autonomous operating driving system. However, it should be understood that the autonomous operating driving system for performing the autonomous driving task can preferably also control one or more subcomponents of the redundant driving system and / or can provide an operating trajectory to subcomponents of the redundant driving system. The autonomous operational driving system preferably controls a larger number of vehicle actuators than the redundant driving system. According to a first preferred embodiment, the redundancy driving system is designed to carry out reduced trajectory planning in order to obtain a reduced trajectory for the reduced driving task if no valid planned trajectory is provided by the autonomous operational driving system, and the redundancy driving system is designed to control at least one vehicle actuator in order to carry out the reduced driving task when determining a fault in the autonomous operating driving system using the reduced trajectory.

According to a preferred development, the operational driving system has one or more primary sensors for determining sensor data, a central control unit connected to the sensors and a main voltage supply for the operational driving system planned trajectory using the sensor data if there is no error. There is preferably no redundancy for the primary sensors, as a result of which procurement costs and / or production costs of the autonomous vehicle system can be reduced.

The operational driving system preferably also has an operational controller connected to the central control unit, which is designed to control at least one vehicle actuator and / or a first group of vehicle actuators of the vehicle system. The central control unit preferably carries out a trajectory planning and an operational trajectory planning, and provides the planned trajectory and the operational trajectory to the operational controller. The operation controller controls at least one vehicle actuator and / or the first group of vehicle actuators so that the vehicle follows the planned trajectory or the operating trajectory. The autonomous vehicle system preferably has several groups of vehicle actuators.

A first group of vehicle actuators preferably comprises a transmission, a motor and / or a main brake system, the vehicle actuator or actuators being supplied with the main voltage supply of the operational driving system. are bound. It should be understood that the first group of vehicle actuators can also have only one or two of the vehicle actuators mentioned. In any case, a main brake system is preferably provided. Those vehicle actuators which influence a longitudinal acceleration of the vehicle are preferably assigned to the first group of vehicle actuators. However, it can also be provided that the first group of vehicle actuators is also or exclusively assigned to one or more vehicle actuators that influence a transverse acceleration of the vehicle. It should be understood that a vehicle actuator can influence both the longitudinal acceleration and the transverse acceleration of the vehicle. This is the case, for example, when the vehicle's wheels are braked asymmetrically.

Alternatively, the first group of vehicle actuators can comprise a steering actuator and / or a redundant braking system, the vehicle actuator or actuators being connected to the main voltage supply of the operational driving system. The alternatives mentioned differ in which vehicle actuators are controlled by the operation controller.

The redundancy driving system preferably has one or more simple redundancy sensors for determining redundancy sensor data, which are connected to the central control unit of the operational driving system and to a central redundancy control unit of the redundant driving system. The use of the redundancy sensor data is therefore preferably possible within the framework of operational trajectory planning, reduced trajectory planning, trajectory planning and / or monitoring of the driving task or the reduced driving task. In error-free operation, the central control unit of the operational driving system carries out the operational trajectory planning, preferably using the sensor data from the primary sensors and the redundancy sensor data from the redundancy sensors. In the event of an error in the autonomous operational driving system, the redundancy control unit can carry out reduced trajectory planning for the reduced driving task and / or the reduced driving task along the planned trajectory or the reduced trajectory Monitor trajectory using the redundancy sensor data. The redundancy sensors thus form a redundancy level for the primary sensors. The redundancy sensors have a reduced range of functions compared to the primary sensors and are more cost-effective. For example, a data acquisition frequency, a resolution, an accuracy or a measuring principle of the redundancy sensors can be implemented more simply than corresponding comparison values of the primary sensors. Furthermore, a total number of primary sensors is preferably greater than a number of redundancy sensors.

According to a preferred development, the redundancy driving system also has a redundancy voltage supply for supplying the redundancy driving system and a redundancy controller which is designed to control a vehicle actuator and / or a second group of vehicle actuators of the vehicle system. The central control unit of the operational driving system preferably also provides the operational trajectory to the redundancy controller. The redundancy controller can thus be provided in the context of the autonomous driving task to control the second group of vehicle actuators. The redundancy controller is preferably designed to control the second group of vehicle actuators using the planned trajectory of the reduced driving task only when no operating trajectory of the autonomous driving task is provided by the central control unit. The second group of vehicle actuators is consequently also controlled to carry out the autonomous driving task in error-free operation. If no operating trajectory is provided by the central control unit due to a fault in the operating driving system, the redundancy controller controls the second group of vehicle actuators according to the reduced driving task.

The second group of vehicle actuators preferably comprises a steering actuator and / or a redundancy brake system, which are connected to the redundancy voltage supply of the redundancy driving system. Alternatively, the second group of vehicle actuators can comprise a transmission and / or an engine and / or a main brake system, wherein the driving tool actuators are connected to the redundancy voltage supply of the redundancy driving system. In any case, a main brake system is preferably provided. The steering actuator and the main brake system of the autonomous driving system are preferably assigned to different groups of vehicle actuators which are supplied by different voltage supplies of the autonomous vehicle system. It can thus be ensured that, in the event of a fault in the main voltage supply or the redundancy voltage supply, the vehicle can still be steered using the steering actuator or the vehicle can be steered in an emergency using the main brake system. Furthermore, the main brake system and the redundant brake system are preferably assigned to different groups of vehicle actuators that are supplied by different voltage supplies of the autonomous vehicle system. Thus, in the event of a fault in the main voltage supply or the redundancy voltage supply, braking of the vehicle by means of the redundancy braking system or the main braking system can be ensured. It should be understood that other assignments of the vehicle actuators to the groups of vehicle actuators are also preferred.

In a preferred embodiment, the redundancy sensors have a vehicle side sensor, in particular a side radar, a side ultrasound and / or a side lidar sensor, which is designed to determine a distance from a side lane boundary. Furthermore, the vehicle side sensor can also be designed to determine whether there is an obstacle in a side area of the vehicle. The vehicle sensor is particularly preferably designed to monitor a blind spot of a vehicle. The vehicle side sensor enables and / or improves a monitoring of a lane keeping ability of the vehicle when the vehicle performs the reduced driving task using the planned trajectory and / or the reduced trajectory. Furthermore, the trajectory planning, the operational trajectory planning and / or the reduced trajectory planning are preferably carried out using side sensor data from the vehicle side sensor.

It should be understood that the primary sensors may preferably include one or more primary side sensors. The redundancy sensors preferably include a short-range front frame and / or a wide-angle lidar sensor, which are designed to determine a drivable area up to the edges of the vehicle. The drivable area is the area around the vehicle that can be safely driven into by the vehicle. The detection up to the edges of the vehicle, for example the front, rear and / or side surfaces, of the vehicle ensures that obstacles in the vicinity of the vehicle are also detected. It should be understood that the primary sensors are preferably designed to determine a drivable space up to the edges of the vehicle.

According to a preferred development, the operation controller is designed to determine a fault status of the first group of vehicle actuators and to make it available to the central control unit. The central control unit is preferably designed to use the error status of the first group of vehicle actuators to determine whether there is an error in one or more of the vehicle actuators of the first group, and particularly preferably to determine which of the vehicle actuators has an error. The central control unit is preferably also designed to carry out the trajectory planning and / or the operating trajectory planning using the ascertained error status of the first group of vehicle actuators.

Furthermore, the redundancy controller is preferably designed to determine an error status of the second group of vehicle actuators and to provide it to the central redundancy control unit and / or to the central control unit. The central control unit and / or the redundancy control unit are preferably designed to use the error status of the second group of vehicle actuators to determine whether there is an error in one or more of the vehicle actuators of the second group, and particularly preferably to determine which of the vehicle actuators has an error . The central control unit is preferably designed to plan the trajectories and / or plan the operational trajectories using the average error status of the second group of vehicle actuators. Likewise, the redundancy control unit can also be designed to carry out the reduced trajectory planning using the error status of the second group of vehicle actuators.

In a third aspect of the invention, the aforementioned object is achieved by a vehicle, in particular a commercial vehicle, having a vehicle system according to one of the preferred embodiments described above of an autonomous vehicle system according to the second aspect of the invention, which is used to carry out a method according to one of the above-described preferred embodiments of the method according to the first aspect of the invention is formed. It should be understood that the method for controlling a vehicle according to the first aspect of the invention, the autonomous vehicle system according to the second aspect of the invention and the vehicle according to the third aspect of the invention have the same or similar sub-aspects as in particular in the dependent claims are laid down. In this respect, reference is made in full to the above description for these aspects.

Embodiments of the invention will now be described below with reference to the drawings. These are not necessarily intended to represent the embodiments to scale, rather the drawings, if this is useful for the explanation, are made in a schematic and / or slightly distorted form. With regard to additions to the teachings immediately recognizable from the drawings, reference is made to the relevant prior art. It must be taken into account that various modifications and changes relating to the shape and detail of an embodiment can be made without departing from the general idea of the invention. The features of the invention disclosed in the description, in the drawings and in the claims can be essential for the development of the invention both individually and in any combination. In addition, all combinations of at least two of the features disclosed in the description, the drawings and / or the claims fall within the scope of the invention. The general idea of the invention is not restricted to the exact form or the detail of the preferred embodiments shown and described below or restricted to an object that would be restricted in comparison to the object claimed in the claims. In the case of specified measurement ranges, values within the stated limits should also be disclosed as limit values and be able to be used and claimed as required. For the sake of simplicity, the same reference symbols are used below for identical or similar parts or parts with an identical or similar function.

Further advantages, features and details of the invention emerge from the following description of the preferred embodiments and with reference to the drawings; these show in:

FIG. 1 shows a schematic representation of a vehicle with an autonomous vehicle system according to a first exemplary embodiment;

FIG. 2 shows a schematic illustration of the autonomous vehicle system according to the first exemplary embodiment;

FIG. 3 shows a schematic illustration of the autonomous vehicle system according to the first exemplary embodiment, which illustrates the provision of control commands, trajectories and error information;

FIG. 4 shows a schematic illustration of the autonomous vehicle system according to a second exemplary embodiment, which clarifies the provision of control commands, trajectories and error information;

FIG. 5 shows a schematic illustration of an autonomous vehicle system according to a third exemplary embodiment; FIG. 6 shows a schematic illustration of a vehicle with an autonomous vehicle system, the vehicle executing a lane-keeping braking maneuver;

FIG. 7 shows a schematic illustration of a vehicle with an autonomous vehicle system, the vehicle executing a lane change braking maneuver;

FIG. 8 shows a schematic illustration of a vehicle with an autonomous vehicle system, the vehicle performing an autonomous driving task;

FIG. 9 shows a schematic flow diagram for a preferred exemplary embodiment of the method when there is no error in the autonomous operating driving system; and

FIG. 10 shows a schematic flow chart for a further preferred exemplary embodiment of the method when there is a fault in the autonomous operating driving system.

A vehicle 2, in particular a commercial vehicle 3, has an autonomous vehicle system 5 with an operational driving system 9 and a redundant driving system 11 (see FIGS. 1, 2 and 5). The vehicle 2 is shown here as a utility vehicle 3 with a first flat axle HA1, a second rear axle HA2 and a front axle VA. Front wheels 100.1, 100.2 of the front axle VA are designed to be steerable. Rear wheels 102.1, 102.2, 102.3, 102.4 of the first rear axle HA1 and the second rear axle HA2 are designed here as non-steerable wheels. However, it can also be provided that the rear wheels 102.1,

102.2 of the first rear axle HA1 and / or the rear wheels 102.3, 102.4 of the second rear axle HA2 are designed to be steerable. For this purpose, first and second rear axle steering actuators can be provided (not shown). As illustrated by the arrows shown in FIG. 1, primary sensors 13 of the autonomous operational driving system 9 provide sensor data SD to a central control unit 15 of the operational driving system 9. Furthermore, redundancy sensors 17 also provide redundancy sensor data SDR to the central control unit 15. In addition, the redundancy sensors 17 also provide the redundancy sensor data SDR to a central redundancy control unit 19. The sensor data and / or the redundancy sensor data SDR can represent information about a vehicle state and / or the vehicle environment.

A number of the individual primary sensors 13.1, 13.2, 13.3 is preferably greater than a number of the individual redundancy sensors 17.1, 17.2. The primary sensors 13 have an increased range of functions compared to the redundancy sensors 17, and can be characterized as highly complex sensors. A data volume of the primary sensor data SD is preferably greater than a data volume of the redundancy sensor data SDR. Furthermore, a frequency of providing the primary sensor data SD to the central control unit 15 can be greater than a frequency of providing the redundancy sensor data SDR to the central control unit 15 and the redundancy control unit 19 9 and at the central redundancy control unit 19, a data volume provided at the central control unit 15 is greater than a data volume provided at the redundancy control unit 19. Therefore, the redundancy control unit 19 of the redundant driving system 11 can be designed with a smaller range of functions than the central control unit 15 of the operational driving system 9. For example, the redundancy control unit 15 can have a lower computing power than the central control unit 15 or a limited scope of executable operations . Here, a first primary sensor 13.1 is designed as a 3D lidar scanner, a second primary sensor 13.2 as a stereo camera and a third primary sensor 13.3 as an imaging radar. The primary sensors 13 shown in FIG. 1 are designed here as sensors that are designed to acquire data about a vehicle environment 24. Further The primary sensors 13 can also detect information about a vehicle status, such as a vehicle speed. A first redundancy sensor 17.1 is designed here as a radar, while a second redundancy sensor 17.2 is a mono camera.

As illustrated by the double arrow arranged between the central control unit 15 and the redundancy control unit 19 in FIG. 1, the central control unit 15 is designed to determine whether there is an error E2 (cf. FIGS. 3, 4) in the redundancy control unit 19. In an analogous manner, the redundancy control unit 19 is designed to determine whether there is an error E1 in the central control unit 15. It should be understood that an error E1, E2 can also be determined based on the absence of a signal and / or based on a time-out signal from the central control unit 15 and / or the redundancy control unit 19. Furthermore, the central control unit 15 and / or the redundancy control unit 19 can be designed to output an error signal E1, E2 directly.

The central control unit 15 is designed here to carry out operational trajectory planning in order to obtain an operational trajectory TRB for an autonomous driving task FA. The operational trajectory planning takes place using the sensor data SD provided by the primary sensors 13 and / or the redundancy sensor data SDR provided by the redundancy sensors 17. Furthermore, the central control unit 15 is designed to carry out a trajectory planning for a reduced driving task FAR in order to obtain a reduced trajectory TR. The reduced driving task FAR is preferably carried out when there is an error E1 in the autonomous operating driving system 9, so that the autonomous driving task FA cannot be carried out by the operating driving system 9. The central control unit 15 preferably carries out the operational trajectory planning cyclically, preferably with a frequency in a range from 0.1 to 1000 Hz, more preferably 1 to 1000 Hz, more preferably 2 to 1000 Hz, more preferably 10 to 1000 Hz preferably 50 to 1000 Hz, particularly preferably 100 Hz. Particularly preferably, a cycle time ZT corresponds to the trajectory planning of a ner cycle time ZTB of the operational trajectory planning. However, it can also be provided that a cycle time ZT of the trajectory planning is greater than the cycle time ZTB of the operational trajectory planning. This can be particularly desirable in order to reduce energy consumption, a memory requirement of a memory 23 of central control unit 15 and / or computing power of central control unit 15. The trajectory TR for the reduced driving task FAR is made available to the redundancy control unit 19. If no trajectory TR is provided to the redundancy control unit 19 due to an error in the central control unit 15, the redundancy control unit 19 can carry out reduced trajectory planning in order to obtain a reduced trajectory TRR. It should be understood that the redundancy control unit 15 can also perform the reduced trajectory planning cyclically. A cycle time ZTR of the reduced trajectory planning, measured between the provision of two successive reduced trajectories TRR, preferably has a range from 0.1 to 1000 Hz, more preferably 1 to 1000 Hz, more preferably 2 to 1000 Hz, more preferably 10 to 1000 Hz, further preferably 50 to 1000 Hz, particularly preferably 100 Hz. Furthermore, it can also be provided that the reduced trajectory planning is only carried out if the redundancy control unit 15 determines that there is an error E1 in the central control unit 15.

An error E1 of the central control unit 15 can be present, for example, if a main voltage supply 21 of the autonomous operating driving system 9 fails and the central control unit 15 is not supplied with voltage. In order to prevent failure of the entire autonomous vehicle system 5 in the event of a failure of the main voltage supply 21, the redundancy driving system 11 has a redundancy voltage supply 22 (see FIGS. 1 and 2) so that at least the redundancy driving system 11 remains ready for use. Due to the limited scope of functions of the central redundancy control unit 19, this has a lower energy requirement compared to the central control unit 15, so that the redundancy voltage supply 22 can be made smaller and / or more cost-effective than the main voltage supply 21. The main voltage supply 21 of the The autonomous operational driving system 9 also supplies an operational controller 29 and a first group 41 of vehicle actuators 7.1, 7.2, 7.3, as illustrated by the dashed lines shown in FIG. 1. In an analogous manner, the redundancy driving system 11 comprises a redundancy controller 31 and a second group 53 of vehicle actuators 7.4, 7.5, which are supplied by the redundancy voltage supply 22.

The operation controller 29 is designed to monitor an error status ES2 of the redundancy controller 31. In an analogous manner, the redundancy controller 31 is designed to monitor an error status ES1 of the operating controller 29 (see FIGS. 3 and 4). The monitoring can preferably take place by sending an error status ES1, ES2, by querying an error status ES1, ES2 and / or by receiving a time-out signal from the respective controller 29, 31. The operational controller 29 and / or the redundancy controller 31 are preferably designed to provide the error status ES2 of the redundancy controller 31 or the error status ES1 of the operational controller 29 to the central control unit 15 and / or the redundancy control unit 19.

In error-free operation, the central control unit 15 provides the operating trajectory TRB to the operating controller 29 and the redundancy controller 31. Furthermore, the redundancy control unit 19 provides the trajectory TR or the reduced trajectory TRR to the operation controller 29 and the redundancy controller 31 in parallel. However, it can also be provided that the redundancy control unit 19 is designed to provide the trajectory TR or the reduced trajectory TRR only when an error E1 of the central control unit 15 is determined. The operating controller 29 and the redundancy controller 31 are designed to use the trajectory TR or the reduced trajectory TR only when the central control unit 15 does not provide a valid operating trajectory TRB. For this purpose, the operating controller 29 and / or the redundancy controller 31 are preferably designed to carry out a trajectory prioritization. Furthermore, the central control unit 15 can also be designed to control the operating trajectory Provide TRB with a higher priority to the operation controller 29 and the redundancy controller 31 than a priority of the trajectory TR or reduced trajectory TRR provided by the redundancy control unit 19. This preferably ensures that in error-free operation the autonomous driving task FA is carried out using the operating trajectory TRB, and the trajectory TR and the reduced trajectory TRR are not taken into account for carrying out the autonomous driving task FA. If no operating trajectory TRB is provided by the central control unit 15 due to an error in the autonomous operating driving system 9, the reduced driving task FAR is preferably carried out using the trajectory TR or the reduced trajectory TRR, which are provided by the redundancy control unit 19.

The operation controller 29 is designed to control the first group 41 of vehicle actuators 7.1, 7.2, 7.3 in order to carry out the autonomous driving task FA or the reduced driving task FAR. The operating controller 29 controls at least one of the vehicle actuators 7.1, 7.2, 7.3 of the first group 41 in such a way that the vehicle 2 is moved along the operating trajectory TRB, the trajectory TR or the reduced trajectory TRR. The operating controller 29 is preferably adapted to carry out a stability control for the vehicle 2 independently of the central control unit 15 in order to keep the vehicle 2 stable on the operating trajectory TRB, the trajectory TR or the reduced trajectory TRR. In an analogous manner, the redundancy controller 31 is designed to control the second group 53 of vehicle actuators 7.4, 7.5 in order to carry out the autonomous driving task FA or the reduced driving task FAR. The redundancy controller controls at least one of the vehicle actuators 7.4, 7.5 of the second group 53 in such a way that the vehicle 2 is moved along the operating trajectory TRB, the trajectory TR or the reduced trajectory TRR. The redundancy controller 31 is preferably adapted to carry out a stability control for the vehicle 2 independently of the redundancy control unit 19. The operation controller 29 and the redundancy controller 31 preferably work together to regulate the stability of the vehicle 2. men. It should be understood that in error-free operation, both vehicle actuators 7.1, 7.2, 7.3 of the first group 41 and vehicle actuators 7.4, 7.5 of the second group 53 can be controlled in order to carry out the autonomous driving task FA. The redundancy is ensured by the fact that, in the event of a failure of the autonomous operating driving system 9, at least the second group 53 of vehicle actuators 7.4, 7.5 can be activated in order to carry out the reduced driving task FAR. If there is only one error E1 in the central control unit 15, the reduced driving task FAR can also be carried out by the operations controller 29 and / or the redundancy controller 31, the trajectory TR or the reduced trajectory TRR from the redundancy control unit 19 to the operations controller 29 and the redundancy controller 31 is provided. The autonomous operational driving system 9 is preferably also designed to carry out the reduced driving task FAR when it is determined that an error E2 of the redundant driving system 11 is present. As a result, it is achieved that immediately after an error E1, E2 of the autonomous operating driving system 9 or the redundant driving system 11 has been determined, the reduced driving task FAR is carried out. The central control unit 15 preferably also provides the reduced trajectory TRR to the operation controller 29.

According to this exemplary embodiment, an error status ES3 of the first group 41 of vehicle actuators 7 can be determined by the operation controller 29 and particularly preferably made available to the central control unit 15 and / or the redundancy control unit 19. In an analogous manner, an error status ES4 of the second group 53 of vehicle actuators 7 can be determined by the redundancy controller 31, and particularly preferably provided to the central control unit 15 and / or the redundancy control unit 19. The central control unit 15 can thus carry out the operational trajectory planning and / or the trajectory planning using the error status ES3 of the first group 41 of vehicle actuators 7. The central control unit 15 is preferably designed, depending on the determined error status ES3 of the first group 41 of vehicle actuators 7 and / or the determined error status ES4 of the second group 53 of vehicle updates gates 7 to decide whether the reduced driving task FAR or the autonomous driving task FA is carried out. The redundancy control unit 19 can also preferably be adapted to take into account the error status ES3 of the first group 41 and / or the error status ES4 of the second group 53 of vehicle actuators 7 in the reduced trajectory planning.

According to the first exemplary embodiment (FIGS. 1, 2, 3) the first group of vehicle actuators 41 comprises a motor 7.1, a transmission 7.2 and a main brake system 7.3 of the vehicle 2. The second group of vehicle actuators 53 then preferably comprises a redundant brake system 7.4 and one Steering actuator 7.5. The redundancy brake system 7.4 is designed to enable the vehicle 2 to be decelerated if the main brake system 7.3 fails. A functional scope of the redundancy brake system 7.4 is preferably reduced in comparison to the main brake system 7.3. The redundancy braking system 7.4 can thus be implemented more cost-effectively. For example, an adjustment accuracy of the redundancy brake system 7.4 can be less than a corresponding adjustment accuracy of the main brake system 7.3. Furthermore, individual control of individual wheels 100.1, 100.2, 100.3,

100.4, 100.5, 100.6 of the respective axes VA, FIA1, FIA2 must only be possible using the Flaupt brake system 7.3. The main brake system 7.3 and the redundant brake system 7.4 are preferably connected in such a way that braking of the vehicle 2 can only be carried out with one of the brake systems 7.3, 7.4. In addition, it can be provided that the main brake system 7.3 and the redundant brake system 7.4 are pneumatically interconnected in such a way that braking of the vehicle 2 by means of the redundant brake system 7.4 is only possible if the main brake system 7.3 fails. According to the first exemplary embodiment of the autonomous vehicle system 5, the reduced driving task FAR is carried out by the second group 53 of vehicle actuators if the first group 41 of vehicle actuators 7 cannot be controlled due to an error E1 in the operational driving system 9. Since in such a case braking by means of the main brake system 7.3 is not possible, the braking of the vehicle 2 takes place by means of the redundancy brake system. tems 7.4, while the vehicle 2 steered by means of the steering actuator 7.5 who can.

According to a second exemplary embodiment (FIG. 4), the first group 41 of vehicle actuators 7 comprises the redundancy brake system 7.4 and the steering actuator 7.5. The second group 53 of vehicle actuators 7 then comprises the engine 7.1, the transmission 7.2 and the main brake system 7.3. Regarding the design of the main brake system 7.3 and the redundancy brake system 7.4, reference is made in full to the above description of the first exemplary embodiment. If, in an autonomous vehicle system 5 according to the second exemplary embodiment, there is an error E1 in the autonomous operating driving system 9, the vehicle 2 can be braked by means of the main braking system 7.3. If it is not possible to control the steering actuator 7.5 due to the error E1 of the operating driving system 9, the vehicle 2 can be emergency-steered using the main brake system 7.4. During emergency steering, individual wheels 100 of the vehicle 2, in particular front wheels 100.1, 100.2 of the front axle VA, are individually braked using the main brake system 7.3 so that the vehicle 2 can be kept in a lane 25. The main brake system 7.3 can also preferably be designed to enable the vehicle 2 to change lanes and / or to turn a corner as part of the emergency steering.

It should be understood that the emergency steering in the context of the reduced driving task FAR only takes place when the steering actuator 7.5 cannot be activated.

The autonomous driving system 5 according to a third exemplary embodiment (FIG. 5) is designed essentially analogously to the autonomous driving system 5 according to the first exemplary embodiment. The autonomous driving system 5 can be divided into structural levels: the primary sensors 13 and the redundancy sensors 17 are assigned to the structural level “detect”. The central control unit 15 and the redundancy control unit 19 belong to the structure level “control”, while the vehicle actuators 7 are assigned to the structure level “activate”. Furthermore, according to this exemplary embodiment, the structural level “detect” comprises manual control devices 54 which enable a user to specify a manual driving task FAM. Manual control commands from a user are provided to the operating controller 29 and the redundancy controller 31, which are arranged between the “control” and “activate” levels and control the vehicle actuators 7 using the manual control commands.

The dashed line 83 emanating from the main braking system 7.3 illustrates emergency steering in the event of a fault in the steering actuator 7.5, while the dashed line 85 emanating from the redundant braking system 7.4 illustrates decelerating the vehicle by means of the redundant braking system 7.4. The autonomous vehicle system 5 preferably also has a communication unit 51. This is assigned to the “connect” level and designed to enable communication with other road users (not shown) and / or objects in the vehicle environment 24 and / or with a central traffic control system (not shown). For example, information can be received via the communication unit 51 that describes the volume of traffic on a planned route and is used by the central control unit 15 in the context of operational trajectory planning. Furthermore, by means of the communication unit 51, a warning signal can be sent to vehicles located in the vehicle surroundings 24 when the reduced driving task FAR is carried out.

The reduced driving task FAR is preferably a lane keeping braking maneuver BMSFI illustrated in FIG. 6 or a lane changing braking maneuver MBSW illustrated in FIG. 7. Figure 6 shows a vehicle 2, which is designed here as a utility vehicle 3, and moves along a lane 25 of a road 28 be. The road 28 has no hard shoulder 57 here. If an error E1 of the autonomous operating driving system 9 is determined, the autonomous driving system 5 performs the reduced driving task FAR using the reduced one Trajectory TRR or the trajectory TR. The central control unit 15 is preferably designed to carry out the lane-keeping / braking maneuver BMSH when no alternative lane 26 is available. The alternative lane 26 may not be available, for example, if only one lane 25 is present, or other existing lanes cannot be used due to another vehicle or an obstacle. The redundancy driving system 11 is preferably designed to carry out the lane change braking maneuver BMSW. The lane-keeping braking maneuver BMSFI is therefore preferably only carried out when the lane-changing braking maneuver MBSW is not possible or is not completely possible. As illustrated by the arrows extending from a vehicle front 65 of vehicle 2 forwards, ie upwards in FIG. 6, vehicle 2 is kept in lane 25 and decelerated to a standstill. According to this exemplary embodiment, the lane 25 is free in the direction of travel of the vehicle 2, so that a moderate deceleration of the vehicle 2 to a standstill is possible. It should be understood that the lane keeping braking maneuver BMSFI can also be an emergency braking of the vehicle 2. This is particularly the case when, due to a flicker that is arranged in the lane 25, there is no sufficient braking distance available for moderate deceleration of the vehicle 2.

The reduced driving task FAR, which is carried out by the vehicle 2 shown in FIG. 7, which is designed here as a utility vehicle 3, is a lane change braking maneuver BMSW. The vehicle 2 is arranged on the lane 25 in a position P1 at the beginning of the trajectory. At the end of the trajectory TR, the vehicle 2 is at a standstill on the hard shoulder 27. The deceleration of the vehicle 2 is illustrated by the length of the arrows representing the trajectory TR, which decreases starting from the position P1 to the position P2 of the vehicle 2. It should be understood that the reduced driving task FAR can also be carried out using the reduced trajectory TRR that is provided by the redundancy control unit 19. The lane change braking maneuver BMSW is carried out because the Be ten stripes 27 is available and passable. It should be understood that the lane change braking maneuver BMSW can also include the lane change to an alternative lane 26 that is not a hard shoulder 27. The lane change braking maneuver BMSW and / or the lane keeping braking maneuver BMSH can preferably also include a brief acceleration of the vehicle 2. Furthermore, the reduced driving task FAR is preferably carried out by the operational driving system 9 when an error E2 in the redundant driving system 11 is determined.

The autonomous driving task FA can consist of coping with a wide variety of driving situations in normal road traffic or off-road. An overtaking maneuver of vehicle 2 is shown in FIG. 8 as an example of an autonomous driving task. The autonomous driving system 5 controls the vehicle 2, which is shown here as a utility vehicle 3, at constant speed along the operating trajectory TRB from a third position P3 via a fourth position P4 to a fifth position P5. At the beginning of the autonomous driving task FA, the vehicle 2 drives at constant speed in the lane 25. Using the sensor data SD of the primary sensors 13 and / or the redundancy sensor data SDR of the redundancy sensors 17, the central control unit 15 determines that a second vehicle 67 is with them moves at a speed lower than the vehicle 2 in the lane 25, so that a distance between the front of the vehicle 65 and the second vehicle 67 traveling ahead is reduced. Using the sensor data SD and / or the redundancy sensor data SDR, the central control unit 15 carries out an operating trajectory planning in order to obtain the operating trajectory TRB. The operating trajectory TRB is provided to the operating controller 29 and the redundancy controller 31. The operation controller 29 and / or the redundancy controller 31 control the vehicle actuators 7 in such a way that the vehicle 2 is steered onto a free second lane 28. After the second vehicle 67 has been overtaken, the vehicle actuators 7 are controlled in such a way that the vehicle 2 is steered back onto the lane 25. It should be understood that the autonomous operational driving system 9 monitors a vehicle environment 24 in order to be able to adapt the operational trajectory TRB if necessary. In this exemplary embodiment (FIG. 6), the vehicle 2 has a side sensor 55, which is a side radar 56 here. The lateral radar 56 is preferably designed to determine a distance A between a lateral lane boundary 57 and a lateral vehicle edge 63 and to provide it to the central control unit 15 and / or the redundancy control unit 19. It should be understood that the side sensor 55 can also only provide side sensor data SDSS, and that the distance A is then determined by the central control unit 15 and / or the redundancy control unit 19. It can also be provided that the autonomous vehicle system 5 has several side sensors 55. Furthermore, the side sensor 55 can also be designed to detect whether a second vehicle 67, a hindrance and / or a non-drivable section is located next to the vehicle 2. A section that is not drivable can be, for example, a road ditch or an embankment. The central control unit 15 and / or the redundancy control unit 19 are preferably designed to take into account vehicle parameters of the vehicle 2 for the trajectory planning, the operational trajectory planning and / or the reduced trajectory planning. Vehicle parameters can be, for example, dimensions of vehicle 2, weight of vehicle 2, weight of a load on vehicle 2 and / or acceleration capacity of vehicle 2. It should be understood that the vehicle parameters can contain a large number of other parameters and are not restricted to the parameters mentioned. The vehicle parameters are preferably pre-stored in a memory 23 of the central control unit 15 and / or in a redundancy memory 33 of the redundancy control unit 19. However, it can also be provided that the central control unit 15 and / or the redundancy control unit 19 determine the vehicle parameters using vehicle parameter data provided at the central control unit 15 or the redundancy control unit 19.

The redundancy sensor data 17 also have a short-range front radar 59, a short-range spot radar 60 and two wide-angle lidar sensors 61, the wide-angle lidar sensors 61 being arranged on vehicle edges 63 on the sides. The short-range front radar 59 is on Arranged vehicle front 65, while the short-range rear radar 60 is arranged on a vehicle rear 66 of the vehicle 2. The short-range front radar 59, the short-range spot radar 60 and the wide-angle lidar sensors 61 are designed to detect a vehicle environment 24, which is shown schematically here, up to the vehicle edges 62, which include the lateral vehicle edges 63, the vehicle front 65 and the Vehicle rear 66 include to monitor. Furthermore, the redundancy sensor data 17 can also have a height sensor (not shown) which is designed to determine a drivable fleas of the vehicle surroundings 24. It should be understood that the primary sensors 13 can also be designed to monitor the vehicle environment 24 up to the vehicle front 65, the vehicle rear 66 and the lateral vehicle edges 63.

FIG. 9 illustrates a sequence of a preferred embodiment of the method 1 for controlling a vehicle 2 by means of an autonomous vehicle system 5. In a first step S1, primary sensors 13 and redundancy sensors 17 provide sensor data SD and redundancy sensor data SDR to the central control unit 15 of the autonomous operating Driving system 9 ready. Using the sensor data SD and the redundancy sensor data SDR, the central control unit 15 carries out a trajectory planning S2 and an operating trajectory planning S3 in order to obtain a planned trajectory TR and an operating trajectory TRB. Here, the trajectory planning S2 with the cycle time ZT and the operating trajectory planning S3 with the cycle time TZB are repeated cyclically. In a step S4, the central control unit 15 provides the planned trajectory TR to the central redundancy control unit 19 of the redundancy driving system 11. Furthermore, the central control unit 15 provides both the planned trajectory TR and the operating trajectory TRB to the operating controller 29 and to the redundancy controller 31 (step S5). At the same time, the central redundancy control unit 19 provides the planned trajectory TR to the operation controller 29 and the redundancy controller 31 in a step S6. The operating controller 29 and the redundancy controller 31 determine in a step S7 that an operating trajectory TRB is provided and control vehicle actuators 7 in order to carry out the autonomous driving task FA to be carried out (step S8). It should be understood that the autonomous operating driving system 9 and the redundant driving system 11 monitor in parallel with steps S1 to S8 whether there is an error E1 in the operating driving system 9 (step S9) and / or whether an error E2 of the redundant driving system 11 is present (step S10).

FIG. 10 illustrates the sequence of a preferred embodiment of the method 1 when the operational driving system 9 fails due to an error E1 and does not provide a trajectory TR. In step S11, the redundancy driving system 11 determines that there is an error E1 and that no valid trajectory TR is being provided by the central control unit 15. Using redundancy sensor data SDR, which are provided by redundancy sensors 17 in step S12, the central redundancy control unit 19 carries out reduced trajectory planning in step S13 in order to obtain a reduced trajectory TRR for the reduced driving task FAR. The reduced trajectory TRR is then made available to the operation controller 29 and to the redundancy controller 31 (step S14). The redundancy controller 31 uses the error status ES1 of the operating controller 29 to determine that the operating controller 29 has failed. Furthermore, the redundancy controller 31 determines that there is no valid trajectory TR or operating trajectory TRB. It should be understood that step S15 can also be carried out in parallel with or before steps S11 to S14. The redundancy controller 31 then controls the second group 53 of vehicle actuators 7 in order to carry out the reduced driving task FAR (step S17). In parallel to performing the reduced driving task FAR (step S17), the central redundancy control unit 19 monitors the vehicle environment 24 (step S18) by means of redundancy sensor data SDR provided by the redundancy sensors 17. If an impossibility of the reduced driving task FAR is determined, the reduced trajectory planning (step S13) is carried out again. The reduced driving task FAR becomes impossible, for example, if a hindrance is determined in the course of the reduced trajectory TRR. It should be understood that the method 1 or steps S1 to S18 of the method illustrated in FIGS. 9 and 10 are preferably repeated cyclically.

List of reference symbols (part of the description):

1 procedure

2 vehicle

3 commercial vehicle

5 Autonomous Vehicle System

7 vehicle actuators

7.1 Motor

7.2 transmission

7.3 Main braking system

7.4 Redundancy braking system

7.5 Steering actuator 9 Operating driving system 11 Redundancy driving system 13 Primary sensors

13.1 First primary sensor

13.2 Second primary sensor

13.3 Third primary sensor 15 Central control unit 17 Redundancy sensors

17.1 First redundancy sensor

17.2 Second redundancy sensor 19 Central redundancy control unit 21 Main power supply 22 Redundancy power supply

23 memory

24 Vehicle environment

25 lane

26 alternative lane

27 hard shoulder

28 Second lane 29 Operations controller 31 redundancy controller

33 redundancy memory

41 First group of vehicle actuators

53 Second group of vehicle actuators

54 Manual control device

55 side sensor

56 side radar

57 Lateral lane boundary

59 Short-range front radar

60 Short-range spot radar 61 Wide-angle lidar sensor 62 Vehicle edges 63 Lateral vehicle edges

65 vehicle front

66 Rear of vehicle 67 Second vehicle 83 Dashed line 85 Dashed line

100.1, 100.2 front wheels

102.1, 102.2, 102.3, 102.4 Flinter wheels A distance

BMSH Lane Keeping Braking Maneuvers

BMSW lane change braking maneuvers

ES1 Error status operating controller

ES2 error status redundancy controller

ES3 error status of the first group of

Vehicle actuators

ES4 error status of the second group of

Vehicle actuators

FA driving task

FAM manual driving task FAR Reduced driving task

HA1 First flinter axle

HA2 Second rear axle

SD sensor data

SDR redundancy sensor data

SDSS site sensor data

S1 - S18 steps

TR trajectory

TRB operating trajectory

TRR Reduced trajectory

VA front axle

ZT cycle time trajectory planning

ZTB cycle time operating trajectory planning

Claims

1. Method (1) for controlling a vehicle (2), in particular commercial vehicle (3), with an autonomous vehicle system (5) which is designed to control the vehicle (2) by means of several vehicle actuators (7), the Vehicle system (5) has: an autonomous operational driving system (9) which is designed to carry out a dynamic driving task (FA) in error-free operation of the autonomous operational driving system (9), the autonomous operational driving system (9 ) controls at least one of the vehicle actuators (7) to carry out the dynamic driving task (FA) in error-free operation, and a redundancy driving system (11) which is designed to carry out a reduced driving task (FAR), the autonomous operational driving system ( 9) is designed to carry out trajectory planning in order to carry out a planned reduced trajectory (TRR) for the reduced driving task (FAR) in addition to the operating trajectory (TRB) and to use it on the redundancy driving system (1 1), the autonomous operational driving system (9) and the redundant driving system (11) being connected to one another and determining whether there is an error (E1, E2) in the other system (9, 11), and the redundancy -Drive system (11) after determining an error (E1) of the autonomous operating driving system (9) controls at least one of the vehicle actuators (7) in order to carry out the reduced driving task (FAR) using the planned trajectory (TR).

2. The method (1) according to claim 1, wherein the redundancy driving system (11) is designed to carry out a reduced trajectory planning in order to obtain a reduced trajectory (TRR) for the reduced driving task (FAR) if no valid planned trajectory (TR) is provided by the autonomous operating driving system (9), and wherein the redundant driving system (11) controls at least one of the vehicle actuators (7) after an error (E1) has been determined in the autonomous operating driving system (9), around perform the reduced driving task (FAR) using the reduced trajectory (TRR).

3. The method (1) according to claim 1 or 2, wherein the autonomous operating driving system (9) carries out the trajectory planning cyclically in order to obtain a planned trajectory (TR), and in each case the planned trajectory (TR) on the redundant driving system ( 11) provides.

4. The method (1) according to any one of the preceding claims, wherein the autonomous operating driving system (9) has one or more primary sensors (13, 13.1, 13.2, 13.3), the sensor data (SD) to a central control unit (15) of the provide autonomous operational driving system (9), and wherein the central control unit (15) executes the trajectory planning (TR) using the sensor data (SD).

5. The method (1) according to any one of the preceding claims, wherein the redundancy driving system (9) has one or more simple redundancy sensors (17, 17.1, 17.2) which provide redundancy sensor data (SDR) to a central redundancy control unit (19), wherein the central redundancy control unit (19) using the redundancy sensor data (SDR) determines whether there is an obstacle on the planned trajectory (TR) or the reduced trajectory (TRR) and using the planned trajectory (TR) or the reduced trajectory (TRR) the redundancy sensor data (SDR) is modified when an obstacle is detected on the planned trajectory (TR) or the reduced trajectory (TRR).

6. The method (1) according to claim 5, wherein the redundancy driving system (11) is supplied by a redundancy voltage supply (21) independent of the operational driving system (9).

7. The method (1) according to claim 5 or 6, wherein the redundancy sensors (17, 17.1, 17.2) also provide the redundancy sensor data (SDR) at the central control unit (15). 8. The method (1) according to any one of the preceding claims, wherein the redu ed driving task (FAR) is a controlled braking maneuver (BM) in which the redundant driving system (11) locks the wheels (100.1, 100.2, 102.1,

102.2, 102.3, 102.4) of an axle (VA, HA1, FIA2) of the vehicle (2) prevented.

9. The method (1) according to any one of claims 5 to 7 and 8, wherein the con trolled braking maneuver (BM) is a lane keeping braking maneuver (SFI-BM) in which the vehicle (1) maintains a lane (25), and / or a lane change braking maneuver (SW-BM) in which the vehicle (1) is steered and decelerated onto an existing drivable alternative lane (26), preferably a hard shoulder (27), the central redundancy control unit (19) compliance with the planned trajectory (TR) or the reduced trajectory (TRR) is monitored using the redundancy sensor data (RSD).

10. The method (1) according to any one of claims 4 to 9, wherein the central control unit (15) if there is no error (E1) carries out an operating trajectory planning in order to obtain an operating trajectory (TR-B), and the Provides operating trajectory (TR-B) to an operating controller (29) and a redundancy controller (31), the operating controller (29) and / or the redundancy controller (31) controlling at least one of the vehicle actuators (7) in order to control the vehicle ( 1) to keep to the planned operating trajectory (TR-B).

11. The method (1) according to claim 10, wherein the vehicle actuators (7) to at least one vehicle actuator (7) from the group: gearbox (7.1), engine (7.2), flaupt brake system (7.3), redundancy brake system (4) or steering actuator (7.5 ) exhibit.

12. The method (1) according to claim 10 or 11, wherein the central redundancy control unit (19) the planned trajectory (TR) or the reduced trajectory (TRR) of the reduced driving task (FAR) on the operation controller (29) and the redundancy controller (31), the operation controller (29) and / or the redundancy controller (31) controlling at least one of the vehicle actuators (7) in order to guide the vehicle (1) on the reduced trajectory (TRR) of the reduced driving task (FAR) hold if there is no operating trajectory (TRB) in the event of a fault in the operating driving system (9).

13. The method according to claim 10 or 11, wherein the operating controller (29) monitors an error status (ES2) of the redundancy controller (31), and wherein the redundancy controller (31) monitors an error status (ES1) of the operating controller (29).

14. The method (1) according to any one of the preceding claims, wherein in the event that a main braking system (7.3) of the operational driving system (9) fails, the vehicle (2) is braked by means of a redundant braking system (7.4) which is supplied by a main voltage supply (37) of the operating driving system (9) is independent.

15. The method (1) according to claim 14, wherein the vehicle (2) is steered by means of a steering actuator (39) which is controlled by the redundancy controller (31) and is independent of a main voltage supply (37) of the operational driving system (9) is.

16. The method (1) according to any one of claims 1 to 12, wherein in the event that a steering actuator (39) of the operational driving system (9) fails, an emergency steering of the vehicle (1) by means of a main brake system (7.3) takes place , which is preferably controlled by the redundancy controller (31).

17. Autonomous vehicle system (5) for controlling a vehicle (2), in particular a commercial vehicle (3), comprising: an autonomous operational driving system (9) which is used to control at least one vehicle actuator (7) of the vehicle (2) to carry out a dynamic driving task (FA) is designed in an error-free operation of the autonomous operating driving system (9), a redundancy driving system (11) which is designed to carry out a reduced driving task (FAR), the autonomous operational driving system (9) being designed to plan a trajectory to obtain a planned trajectory (TR) for the reduced driving task (FAR) perform and provide the planned trajectory (TR) to the redundant driving system (11), the autonomous operating driving system (9) and the redundant driving system (11) being connected to one another and designed to determine whether an error ( E1, E2) of the other system (9, 11) is present, the redundancy driving system (11) being designed to control at least one vehicle actuator (7) in order to perform the reduced driving task (FAR) when determining an error (E1) of the autonomous Operational driving system (9) to be carried out using the planned trajectory (TR).

18. Autonomous vehicle system (5) according to claim 17, wherein the redundancy driving system (11) is designed to carry out a reduced trajectory planning in order to obtain a reduced trajectory (TRR) for the reduced driving task (FAR) if not a valid one Planned trajectory (TR) is provided by the autonomous operational driving system (9), and wherein the redundancy driving system (11) is designed to control at least one vehicle actuator (7) in order to perform the reduced driving task (FAR) when determining an error (E1) of the autonomous operating driving system (9) using the reduced trajectory (TRR) to be carried out.

19. Autonomous vehicle system (5) according to claim 17 or 18, wherein the operational driving system (9) has one or more primary sensors (13, 13.1, 13.2) for determining sensor data (SD), one with the primary sensors (13, 13.1, 13.2 ) connected central control unit (15) and a main voltage supply (37) for the operational driving system (9), the central control unit (15) being designed to carry out a trajectory planning for obtaining a planned trajectory (TR) using the Carry out sensor data (SD) if there is no error (E1).

20. The autonomous vehicle system (5) according to claim 19, wherein the operating driving system (9) further comprises an operating controller (29) connected to the central control unit (15), which is used to control at least one vehicle actuator (7) and / or a first Group (41) of vehicle actuators (7) of the vehicle system (2) is formed.

21. Autonomous vehicle system (5) according to claim 20, wherein the first group (41) of vehicle actuators (7) comprises a transmission (7.1), a motor (7.2) and / or a Flauptbremssystem (7.3), which with the Flauptspannungs- supply (37) of the operating driving system (9) are connected.

22. Autonomous vehicle system (5) according to claim 20, wherein the first group (41) of vehicle actuators (7) comprises a steering actuator (7.5) and / or a redundancy brake system (7.4) which is connected to the main voltage supply (37) of the operational driving system ( 9) are connected.

23. Autonomous vehicle system (5) according to one of claims 19 to 22, wherein the redundancy driving system (11) has one or more simple redundancy sensors (17) for determining redundancy sensor data (SDR), which with the central control unit (15) of the Operating driving system (9) and are connected to a central redundancy control unit (19) of the redundant driving system (11).

24. The autonomous vehicle system (5) according to claim 23, wherein the redundancy driving system (11) further comprises a redundancy voltage supply (51) for supplying the redundancy driving system (11) and a redundancy controller (31) which is used to control a vehicle actuator (7 ) and / or a second group (53) of vehicle actuators (7) of the vehicle system (5).

25. Autonomous vehicle system (5) according to claim 21 and 24, wherein the second group (53) of vehicle actuators (7) is a steering actuator (7.5) and / or a redundancy braking system (7.4), which are connected to the redundancy voltage supply (51) of the redundancy driving system (11).

26. Autonomous vehicle system (5) according to claim 22 and 24, wherein the second group (53) of vehicle actuators (7) comprises a transmission (7.1), a motor (7.2) and / or a Flauptbremssystem (7.3) with the redundancy voltage supply (51) of the redundancy driving system (11) are connected.

27. Autonomous vehicle system (5) according to one of claims 23 to 26, wherein the redundancy sensors (17) have a vehicle side sensor (55), in particular a special side radar, a side ultrasound and / or a side lidar sensor, which is designed to have a To determine the distance (A) to a lateral lane boundary (57).

28. Autonomous vehicle system (5) according to one of claims 23 to 27, wherein the redundancy sensors (177) comprise a short-range front radar (59) and / or a wide-angle lidar sensor (61) which are used to determine a drivable area up to the edges of the vehicle (62) are formed.

29. Autonomous vehicle system (5) according to claim 20, wherein the operation controller (29) is designed to determine an error status (ES3) of the first group (41) of vehicle actuators (7) and to the central control unit (15) provide.

30. Autonomous vehicle system (5) according to claim 24, wherein the redundancy controller (31) is designed to determine an error status (E4) of the second group (53) of vehicle actuators (7) and to the central redundancy control unit (19) and / or at the central control unit (15).

31. Vehicle (2), in particular commercial vehicle (3), having an autonomous vehicle system (5) according to one of claims 17 to 30, which is designed for executing a method (1) according to one of claims 1 to 16.