SE541389C2

SE541389C2 - System and Method for Controlling a Motor Vehicle to Drive Autonomously

Info

Publication number: SE541389C2
Application number: SE1751580A
Authority: SE
Inventors: Johan Svahn; Naveen Mohan; Per Roos
Original assignee: Scania Cv Ab
Priority date: 2017-12-20
Filing date: 2017-12-20
Publication date: 2019-09-10
Also published as: DE112018005794T5; WO2019125268A1; SE1751580A1

Abstract

A motor vehicle (MV) is controlled to drive autonomously via a bank of control units (1 10) generating nominal control signals (NCS), which are adapted to cause the motor vehicle (MV) to move in agreement with a nominal path. A data storage (140) contains a set of boundary conditions ({bc}) that the nominal path shall satisfy in order to be considered safe. Inter alia based on sensor signals (SS) reflecting a current status of the motor vehicle (MV), a safety unit (120) receives a set of safety-related parameters (P, R, S, H) describing condition(s) under which the motor vehicle (MV) is currently operated. In response thereto, the safety unit (120) repeatedly generates at least one command ({cmd}) that updates the boundary conditions ({bc}) aiming at confining the nominal path within limits given by a current state of the set of safety-related parameters (P, R, S, H). The bank of control units (1 10) reads out the set of boundary conditions ({bc}) from the data storage (140) and controls the motor vehicle (MV) to move in such a manner that the nominal path satisfies the boundary conditions ({bc}).

Description

System and Method for Controlling a Motor Vehicle to Drive Autonomously TECHNICAL FIELD The invention relates generally to autonomous vehicles. In particular, the present invention concerns a system for controlling a motor vehicle to drive autonomously in agreement with a nominal path and a corresponding method. The invention also relates to a computer program and a non-volatile data carrier.

BACKGROUND Today, there is a strong trend towards fully autonomous vehicles. Naturally, since there is no human driver involved, safety issues are very important. Functional safety standards, such as ISO 26262 stipulate the diagnosis functionality required with respect to safety. In general, these standards place significant overhead on diagnosis and the safe handling of functional failures. Moreover, the verification of the provability of functional safety is a very extensive process. Typically, the overhead increases dramatically with growing numbers of functions and the complexity of the functions involved. As a result, automated driving and functions related thereto provide one of the largest challenges in terms of complexity in the automotive domain so far.

US 2017/0277194 describes how an operation related control of a vehicle is facilitated. Here, a finite set of candidate trajectories of the vehicle is generated that begin at a location of the vehicle as of a given time. The candidate trajectories are based on a state of the vehicle and on possible behaviors of the vehicle and of the environment as of the location of the vehicle and the given time. A putative optimal trajectory is selected from among the candidate trajectories based on costs associated with the candidate trajectories. The costs include costs associated with violations of rules of operation of the vehicle. The selected putative optimal trajectory is used to facilitate the operation related to control of the vehicle.

EP 2 317 412 shows a safety management system for equipment adapted to operate autonomously in a real-time environment. Deterministic and a non-deterministic processors are provided for processing incoming alerts and generating control signals in response. The non-deterministic processor can deal with unrehearsed, complex and unpredictable situations by providing essentially open-ended procedures working in large search spaces with no guarantee of a solution. The deterministic processor monitors behavior of the non-deterministic processor and validates control signals produced by it against safety policies. The deterministic processor also provides an intelligent interface to the non-deterministic processor, which receives alerts only from the deterministic processor, and enforces time-critical delivery of responses.

US 2015/0057869 discloses apparatuses, methods and a storage medium associated with computerized assist or autonomous driving of vehicles. A computing device may receive a plurality of data associated with vehicles driving at various locations within a locality; and based thereon, generate one or more locality specific policies for computerized assisted or autonomous driving of vehicles at the locality.

Thus, there are known examples of solutions for controlling motor vehicles to drive autonomously in agreement with specific rules and policies while handling complex and unpredictable traffic situations.

However, there is yet no solution in this area that enables convenient and efficient integration of new and/or updated vehicle functions while maintaining fulfillment of the relevant safety standards. Typically, therefore, for each new/updated function, a respective individual verification is required. This procedure is costly and very time-consuming.

SUMMARY One object of the present invention is therefore to render the updating of existing functions in an autonomous driving system more efficient and convenient. It is also an object of the invention to facilitate addition of new functions to such a system.

According to one aspect of the invention, these objects are achieved by a system for controlling a motor vehicle to drive autonomously, where the system contains: a bank of control units, a safety unit and a data storage. The bank of control units, in turn, contains a number of auto control units that are configured to generate nominal control signals adapted to cause the motor vehicle to move autonomously in agreement with a nominal path. For example, a first auto control unit may implement a highway pilot, a second auto control unit may implement a traffic jam pilot, a third auto control unit may implement a platooning pilot, and so on. The safety unit is configured to supervise a set of safety-related parameters describing at least one condition under which the motor vehicle is currently operated. The set of safety-related parameters is at least partly based on sensor signals received from the motor vehicle, which sensor signals describe a current status of the motor vehicle. The data storage contains a set of boundary conditions that the nominal path shall satisfy in order to be considered safe. The bank of control units is configured to read out the set of boundary conditions from the data storage, and the bank of control units is further configured to control the motor vehicle to move in such a manner that the nominal path satisfies the boundary conditions. The safety unit is arranged to receive the set of safety-related parameters, and in response thereto, repeatedly generate at least one command configured to update the boundary conditions aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters.

This system is advantageous because it spontaneously adapts the automatic control of the motor vehicle not only to any variations in the dynamic environment around the vehicle, but also in response to any modifications of the vehicle as such (and its resulting altered capabilities). Consequently, updating existing vehicular functions and adding new functions to the motor vehicle become straightforward tasks.

According to one embodiment of this aspect of the invention, the set of safety-related parameters includes: a collection of requirements and/or policies to be followed during operation of the motor vehicle, at least one signal reflecting current characteristics of a physical environment around the motor vehicle, and / or vehicle-health data representing a functional status of the motor vehicle. Thereby, the set of safety-related parameters can be efficiently influenced by different kinds of highly relevant factors.

According to another embodiment of this aspect of the invention, the system further contains a first data-interface unit configured to receive and store at least one safety policy describing a respective mission-related rule to be followed during operation of the motor vehicle. The at least one safety policy may relate to: a minimum distance that the motor vehicle shall keep to a followed vehicle, a speed limit that the motor vehicle shall keep, and/or definitions of safe stop locations that the motor vehicle shall be capable of reaching in case of a fault in the motor vehicle. The first data-interface unit is communicatively connected to the safety unit so as to provide the at least one safety policy to the safety unit. Hence, the motor vehicle can be controlled to follow any general behavior-related rules in a straightforward manner.

According to yet another embodiment of this aspect of the invention, the system further contains a second data-interface unit configured to receive and store at least one regulatory requirement that shall be followed during operation of the motor vehicle. The second data-interface unit is communicatively connected to the safety unit so as to provide the at least one regu latory requirement to the safety unit. Consequently, the motor vehicle can also be conveniently controlled to follow specific traffic rules.

According to an additional embodiment of this aspect of the invention, the system includes a risk-assessment unit configured to dynamically assess a respective estimated risk that the motor vehicle collides with each of any other road user and/or obstacle located in proximity to the motor vehicle. The respective estimated risk is expressed by at least one signal, and the risk-assessment unit is communicatively connected to the safety unit so as to provide said at least one signal to the safety unit. As a result, collision avoidance functionality is resourcefully implemented.

According to still another embodiment of this aspect of the invention, the risk-assessment unit is also configured to monitor an environment around the motor vehicle to determine if the motor vehicle is currently operating within a range of parameters under which it is designed to operate. Thus, if the motor vehicle is found to be outside said range, adequate actions can be taken immediately.

According to another embodiment of this aspect of the invention, the risk-assessment unit is further configured to determine an estimated risk that the motor vehicle and/or any other road user in proximity thereto violates a traffic rule. The at least one signal further reflects said estimated risk. Thereby, the vehicle control implemented by the auto control units can be effected such that the overall risk of violations of the traffic regulations is reduced.

According to yet another embodiment of this aspect of the invention, the system includes a system-health-supervision unit configured to monitor the received sensor signals. Based on the received sensor signals, the system-health-supervision unit derives the vehicle-health data that reflect any faults comprised in the functional status of the motor vehicle. The system-healthsupervision unit is communicatively connected to the safety unit so as to provide the vehicle-health data to the safety unit. Thereby, the fault detection and handling will also be weighed into the vehicle control implemented by the auto control units.

According to still another embodiment of this aspect of the invention, the safety unit is further configured to determine if the set of safety-related parameters describes a condition under which the motor vehicle is currently operated is such that a risk that the motor vehicle cannot move autonomously in agreement with the nominal path exceeds a failure-risk threshold. If this failure-risk threshold is exceeded, the safety unit is configured generate safety control signals adapted to cause the motor vehicle to move autonomously in agreement with a safe path. The safe path takes precedence over the nominal path represented by the nominal control signals. In other words, if the safety control signals are present, the motor vehicle is configured to ignore any received nominal control signals. Consequently, even in emergency situations, a safe vehicle handling is ensured.

Alternatively, or in addition thereto, the safety unit may be configured to generate a control signal indicating whether or not the failure-risk threshold is exceeded. Furthermore, the system includes a control switch arranged in communicative connection with the bank of control units. The control switch is arranged in communicative connection with the bank of control units and the safety unit, and the control switch is configured to: receive the control signal; receive the nominal control signals and any safety control signals respectively; and in response to the control signal, forward either the nominal control signals or the safety control signals to the motor vehicle. In such a case, the motor vehicle itself does not need to take any measures to ensure that the safe path takes precedence over the nominal path.

According to further embodiments of this aspect of the invention, either each of the auto control units is individually configured to generate a set of the nominal control signals adapted to cause the motor vehicle to move autonomously in agreement with a respective nominal path; or two or more of the auto control units are configured to generate a conjoint set of the nominal control signals adapted to cause the motor vehicle to move autonomously in agreement with the nominal path. This provides a high degree of freedom as how to implement the system.

According to still another embodiment of this aspect of the invention, the system includes a platform interface, which is configured to receive the sensor signals from the motor vehicle; and send out the nominal control signals to the motor vehicle. Hence, the communication between the system and the motor vehicle can be made efficient and flexible.

According to another aspect of the invention, the above objects are achieved by a method of controlling a motor vehicle to drive autonomously. The method involves: generating, via a bank of control units, nominal control signals adapted to cause the motor vehicle to move autonomously in agreement with a nominal path; supervising, via a safety unit, a set of safety-related parameters describing at least one condition under which the motor vehicle is currently operated; receiving sensor signals from the motor vehicle, which sensor signals describe a current status of the motor vehicle and at least partly form a basis for the set of safety-related parameters; sending out the nominal control signals to the motor vehicle; storing, in a data storage, a set of boundary conditions that the nominal path shall satisfy in order to be considered safe; reading out, from the data storage, the set of boundary conditions into the bank of control units; generating, via the bank of control units, the nominal control signals such that the motor vehicle is controlled to move in such a manner that the nominal path satisfies the boundary conditions; receiving, in the safety unit, the set of safety-related parameters; and in response thereto, generating, repeatedly at least one command configured to update the boundary conditions aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters.

The advantages of this method, as well as the preferred embodiments thereof, are apparent from the discussion above with reference to the proposed system.

According to a further aspect of the invention the objects are achieved by a computer program containing instructions which, when executed on at least one processor, cause the at least one processor to carry out the above-described method.

According to another aspect of the invention the objects are achieved by a non-volatile data carrier containing such a computer program.

Further advantages, beneficial features and applications of the present invention will be apparent from the following description and the dependent claims.

BRIEF DESCRIPTION OF THE DRAWINGS The invention is now to be explained more closely by means of preferred embodiments, which are disclosed as examples, and with reference to the attached drawings.

Figure 1 schematically depicts systems according to embodiments of the invention; Figure 2 schematically shows a system according to another embodiment of the invention; and Figure 3 illustrates, by means of a flow diagram, the general method according to the invention.

DETAILED DESCRIPTION Referring to Figure 1, we will describe a system according to one embodiment of the invention for controlling a motor vehicle MV to drive autonomously. The system includes a bank of control units 1 10, a safety unit 120 and a data storage 140.

The bank of control units 1 10, in turn, contains a number of auto control units ACU1, ..., ACUn that are configured to generate nominal control signals NCS adapted to cause the motor vehicle MV to move autonomously in agreement with a nominal path, i.e. along a particular trajectory on the ground surface.

Either each of the auto control units ACU1, ..., ACUn is configured to generate a set of the nominal control signals NCS, which set of the nominal control signals NCS is adapted to cause the motor vehicle MV to move autonomously in agreement with a respective nominal path; or two or more of the auto control units ACU1, ..., ACUn are configured to generate a conjoint set of the nominal control signals NCS, which conjoint set of the nominal control signals NCS is adapted to cause the motor vehicle MV to move autonomously in agreement with the nominal path. For instance, one auto control unit may be adapted to control the motor vehicle MV in a longitudinal direction, while another auto control unit is adapted to control the motor vehicle MV in a transverse direction. Alternatively, a first auto control unit ACU1 may implement a highway pilot, a second auto control unit may implement a traffic jam pilot, a third auto control unit may implement a platooning pilot, and so on, up to an n:th auto control unit ACUn that may for example be configured to operate the motor vehicle MV in a mining environment. Although, of course, the auto control units ACU1, ..., ACUn may be implemented in hardware, it is advantageous if they are realized in software. In such a case, there may either be a specific software module for each auto control unit in the bank of control units 1 10, or the entire bank of control units 110 may be represented by a common piece of software.

The safety unit 120 is configured to supervise a set of safety-related parameters P, R, Sjand H that describes at least one condition under which the motor vehicle MV is currently operated. The set of safety-related parameters P, R, Sjand H is at least partly based on sensor signals SS received from the motor vehicle MV. According to one embodiment of the invention, the system includes a system-health-supervision unit 150, which is configured to monitor the received sensor signals SS, and based thereon derive vehicle-health data H as one part of the set of safety-related parameters.

The sensor signals SS describe a current status of the motor vehide MV, and these signals may be received from the motor vehicle MV via a platform interface 130. Preferably the platform interface 130 is bi-directional, and is thus also configured to send out the nominal control signals NCS to the motor vehicle MV. Nevertheless, according to the invention, even if the platform interface 130 is included in the design, one or more of the sensor signals SS may be received through alternative channels and/or one or more of the nominal control signals NCS may be fed to the motor vehicle MV in other ways than via the platform interface 130.

The data storage 140 contains a set of boundary conditions {bc} that the nominal path shall satisfy in order to be considered safe, for instance as specified by a safety standard, such as ISO 26262.

The bank of control units 1 10 is configured to read out the set of boundary conditions {bc} from the data storage 140. This process may either be implemented as a pull function initiated from the bank of control units 1 10, or as a push function driven by the data storage 140. In any case, the bank of control units 1 10 is configured to control the motor vehicle MV to move in such a manner that the nominal path satisfies the boundary conditions {bc}. As will be discussed further below, the boundary conditions {bc} are dynamic and depend on the set of safety-related parameters P, R, Sjand H.

More precisely, the safety unit 120 is arranged to receive the set of safety-related parameters P, R, Sjand H. In response thereto, the safety unit 120 is adapted to repeatedly generate at least one command {cmd} configured to update the boundary conditions {bc} aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters P, R, Sj, and H.

According to one embodiment of the invention, the set of safetyrelated parameters may contain: a collection of requirements R and/or policies P to be followed during operation of the motor vehicle MV; one or more signals Sjreflecting current characteristics of a physical environment around the motor vehicle MV; and/or vehicle-health data H representing a functional status of the motor vehicle MV. As mentioned above, the vehicle-health data H may be derived by the system-health-supervision unit 150, and the vehicle-health data H may reflect any faults comprised in the functional status of the motor vehicle MV. The system-health-supervision unit 150 is communicatively connected to the safety unit 120 so as to provide the vehicle-health data H to the safety unit 120.

According to one embodiment of the invention, the system contains a first data-interface unit 163, which is configured to receive and store at least one safety policy P describing a respective mission-related rule to be followed during operation of the motor vehicle MV. Thereby, the automatic control of the motor vehicle MV may be conveniently adapted to any changes in the safety policies P by a mere updating of the first data-interface unit 163.

For example, the at least one safety policy P is enumerated at mission time and may relate to a minimum distance that the motor vehicle MV shall keep to a followed vehicle, a speed limit that the motor vehicle MV shall keep; and/or definitions of safe stop locations that the motor vehicle MV shall be capable of reaching in case of a fault in the motor vehicle MV. The at least one safety policy P may further provide rules, determined at design time, about which classes of safe stop locations that must be reachable under faults in the motor vehicle MV. In addition, the at least one safety policy P may provide a minimum number of preferred safe stop locations of each desirability class that should be available to the motor vehicle MV at each road segment.

The first data-interface unit 163 is communicatively connected to the safety unit 120 so as to provide the at least one safety policy P to the safety unit 120, and thus enable the safety unit 120 to generate the at least one command {cmd} based on the at least one safety policy P.

According to one embodiment of the invention, the system contains a second data-interface unit 165, which is configured to receive and store at least one regulatory requirement R that shall be followed during operation of the motor vehicle MV. Examples of regulatory requirement R are market specific regulations enumerated at mission start time, for example relating to traffic rules (e.g. right/left hand traffic, local road laws and various street signs).

Analogous to the first data-interface unit 163, the second datainterface unit 165 is communicatively connected to the safety unit 120 so as to provide the at least one regulatory requirement R to the safety unit 120, and thus enable the safety unit 120 to generate the at least one command {cmd} based on the at least one regulatory requirement R.

According to one embodiment of the invention, the system contains a risk-assessment unit 167, which is configured to dynamically assess a respective estimated risk that the motor vehicle MV collides with each of any other road user and/or obstacle ID-cated in proximity to the motor vehicle MV. Said dynamic assessment is based on a number of sensor signals conveying information about an environment around the motor vehicle MV. However, also sensor signals from within the motor vehicle MV may be utilized by the risk-assessment unit 167. Consequently, the risk-assessment unit 167 may receive one or more of the sensor signals SS (not shown).

An estimated risk that the motor vehicle MV collides with a particular road user may involve so-called intent estimation for that road user and a currently expected path associated with the road user in question. The respective estimated risks that the motor vehicle MV collides with a particular road user and/or obstacle are expressed by one or more signals Sjbeing forwarded to the safety unit 120 via a communicative connection to the risk-assessment unit 167. Thus, the signal(s) Sjmay form a basis for the at least one command {cmd}.

Additionally, it is preferable if the risk-assessment unit 167 is configured to monitor the environment around the motor vehicle MV to determine if the motor vehicle MV is currently operating within a range of parameters under which it is designed to operate.

Moreover, the risk-assessment unit 167 may be configured to determine an estimated risk that the motor vehicle MV and/or any other road user in proximity thereto violates a traffic rule. The assessment may involve lane markings monitoring, and if no sufficiently clearly detectable lane markings are found, the at least one signal Sjreflects this in the form of an estimated risk of traffic-rule violation.

According to one embodiment of the invention, the safety unit 120 is further configured to determine if the set of safety-related parameters P, R, Sjand H describes one or more conditions under which the motor vehicle MV is currently operated, which condition(s) is(are) such that a risk that the motor vehicle MV cannot move autonomously in agreement with the nominal path exceeds a failure-risk threshold.

If this failure-risk threshold is exceeded, the safety unit 120 is configured to generate safety control signals SCS adapted to cause the motor vehicle MV to move autonomously in agreement with a safe path. The safe path constitutes an alternative to the nominal path, and the safe path shall be followed instead of the nominal path calculated by the bank of control units 1 10. In other words, the safe path takes precedence over the nominal path represented by the nominal control signals NCS.

In one embodiment shown in Figure 1, the motor vehicle MV itself effects said precedence by being configured to ignore any received nominal control signals NCS if the safety control signals SCS are received, for example via the platform interface 130 as illustrated in Figure 1. Consequently, even in emergency situations, a safe vehicle handling is ensured.

Figure 2 schematically shows a system according to another embodiment of the invention. Here, all units, signals, commands and parameters that are also represented in Figure 1 denote the same units, signals, commands and parameters as described above with reference to Figure 1.

In the system exemplified in Figure 2, the safety unit 120 is configured to generate a control signal Ctrl that indicates whether or not the failure-risk threshold is exceeded.

The system also includes a control switch 210, which is arranged in communicative connection with the bank of control units 1 10 and the safety unit 120. The control switch 210 is configured to: receive the control signal Ctrl; receive the nominal control signals NCS and any safety control signals SCS respectively.

The control switch 210 is configured to forward either the nominal control signals NCS or the safety control signals SCS to the motor vehicle MV. Specifically, if the safety unit 120 generates the safety control signals SCS, the safety unit 120 also generates the control signal Ctrl in such a manner that upon receipt thereof in the control switch 210, the control switch 210 prevents the nominal control signals NCS from being forwarded to the motor vehicle MV. Instead, the control signal Ctrl forwards the safety control signals SCS to the motor vehicle MV. This mitigates the requirements of the motor vehicle MV in terms of not being required to select between nominal control signals NCS and the safety control signals SCS; and analogous to the above, a safe handling of the motor vehicle MV is ensured even in emergency situations.

Analogous to the auto control units ACU1, ..., ACUn , the safety unit 120, the system health-supervision unit 150, the first data interface 163, the second data interface 165, the risk-assessment unit 167 and/or the control switch 210 may be implemented partly or entirely in software. Such, software, in turn, may be installed to run on one or more processors. Further, a common piece of software may implement two or more of said units and interfaces.

For example, the safety unit 120 may contain a processing unit with processing means including at least one processor, such as one or more general purpose processors. Further, this processing unit is further preferably communicatively connected to a data carrier 125 in the form computer-readable storage medium, such as a Random Access Memory (RAM), a Flash memory, or the like. The data carrier 125 contains computer-executable instructions, i.e. a computer program 127, for causing the processing unit and the other units of the system to perform in accordance with the embodiments of the invention as described herein, when the computer-executable instructions are executed on the at least one processor of the processing unit.

In order to sum up, and with reference to the flow diagram in Figure 3, we will now describe the general method according to the invention for controlling a motor vehicle to drive autonomously.

In a first step 310, sensor signals are received from the motor vehicle. The sensor signals describe a current status of the motor vehicle.

Then, in a step 320, a set of safety-related parameters are generated at least partly based on the sensor signals. The set of safety-related parameters describes one or more conditions under which the motor vehicle is currently operated.

Subsequently, a step 330 supervises the safety-related parameters; and in a step 340 following thereafter, boundary conditions are read out from a data storage into a bank of control units. In a first run of the procedure, the data storage contains default boundary conditions. In subsequent runs, the boundary conditions will have been updated through the below-described step 370.

In a step 350 after step 340, nominal control signals are generated via the bank of control units, and on the basis of the boundary conditions. The nominal control signals are adapted to cause the motor vehicle to move autonomously in agreement with a nominal path.

Thereafter, in a step 360, the nominal control signals are sent out to the motor vehicle for controlling the motor vehicle to move in agreement with the nominal path.

In a subsequent step 370, at least one command is generated through which the boundary conditions are updated aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters. The thus updated boundary conditions are stored in the data storage, and then the procedure loops back to step 310.

Naturally, although the method according to the invention is performed in a general sequential order as shown in Figure 3, it should be pointed out that a subsequent step of the procedure may be initiated before a preceding step has ended. In fact, basically all steps are active all the time. For example, sensor signals are preferably received in step 310 with respect to a particular time interval while the boundary conditions are updated in step 370 in relation to a set of safety-related parameters referring to a time interval preceding said particular time interval, and so on.

All of the process steps, as well as any sub-sequence of steps, described with reference to Figure 3 above may be controlled by means of at least one programmed processor. Moreover, although the embodiments of the invention described above with reference to the drawings comprise processor and processes performed in at least one processor, the invention thus also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The program may be in the form of source code, object code, a code intermediate source and object code such as in partially compiled form, or in any other form suitable for use in the implementation of the process according to the invention. The program may either be a part of an operating system, or be a separate application. The carrier may be any entity or device capable of carrying the program. For example, the carrier may comprise a storage medium, such as a Flash memory, a ROM (Read Only Memory), for example a DVD (Digital Video/Versatile Disk), a CD (Compact Disc) or a semiconductor ROM, an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), or a magnetic recording medium, for example a floppy disc or hard disc. Further, the carrier may be a transmissible carrier such as an electrical or optical signal which may be conveyed via electrical or optical cable or by radio or by other means. When the program is embodied in a signal which may be conveyed directly by a cable or other device or means, the carrier may be constituted by such cable or device or means. Alternatively, the carrier may be an integrated circuit in which the program is embedded, the integrated circuit being adapted for performing, or for use in the performance of, the relevant processes.

The term “comprises/comprising” when used in this specification is taken to specify the presence of stated features, integers, steps or components. Flowever, the term does not preclude the presence or addition of one or more additional features, integers, steps or components or groups thereof.

The invention is not restricted to the described embodiments in the figures, but may be varied freely within the scope of the claims.

Claims

1. A system for controlling a motor vehicle (MV) to drive autonomously, the system comprising: a bank of control units (1 10) containing a number of auto control units (ACU1, ..., ACUn ) configured to generate nominal control signals (NCS) adapted to cause the motor vehicle (MV) to move autonomously in agreement with a nominal path; and a safety unit (120) configured to supervise a set of safetyrelated parameters (P, R, Sj, H) describing at least one condition under which the motor vehicle (MV) is currently operated, the set of safety-related parameters (P, R, Sj, H) being at least partly based on sensor signals (SS) received from the motor vehicle (MV), and which sensor signals (SS) describe a current status of the motor vehicle (MV), characterized in that the system further comprises a data storage (140) containing a set of boundary conditions ({bc}) that the nominal path shall satisfy in order to be considered safe; the bank of control units (1 10) is configured to read out the set of boundary conditions ({bc}) from the data storage (140), and the bank of control units (1 10) is configured to control the motor vehicle (MV) to move in such a manner that the nominal path satisfies the boundary conditions ({bc}); and the safety unit (120) is arranged to receive the set of safety-related parameters (P, R, Sj, H), and in response thereto, repeatedly generate at least one command ({cmd}) configured to update the boundary conditions ({bc}) aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters (P, R, Sj, H).

2. The system according to claim 1, wherein the set of safetyrelated parameters comprises at least one of: a collection of requirements (R) and/or policies (P) to be followed during operation of the motor vehicle (MV), at least one signal (Sj) reflecting current characteristics of a physical environment around the motor vehicle (MV), and vehicle-health data (H) representing a functional status of the motor vehicle (MV).

3. The system according to claim 2, further comprising a first data-interface unit (163) configured to receive and store at least one safety policy (P) describing a respective mission-related rule to be followed during operation of the motor vehicle (MV), the at least one safety policy (P) relating to at least one of: a minimum distance that the motor vehicle (MV) shall keep to a followed vehicle, a speed limit that the motor vehicle (MV) shall keep, and definitions of safe stop locations that the motor vehicle (MV) shall be capable of reaching in case of a fault in the motor vehicle (MV), the first data-interface unit (163) being communicatively connected to the safety unit (120) so as to provide the at least one safety policy (P) to the safety unit (120).

4. The system according to any one of claims 2 or 3, further comprising a second data-interface unit (165) configured to receive and store at least one regulatory requirement (R) that shall be followed during operation of the motor vehicle (MV), the second data-interface unit (165) being communicatively connected to the safety unit (120) so as to provide the at least one regulatory requirement (R) to the safety unit (120).

5. The system according to any one of claims 2 to 4, further comprising a risk-assessment unit (167) configured to dynamically assess a respective estimated risk that the motor vehicle (MV) collides with each of any other road user and/or obstacle located in proximity to the motor vehicle (MV), the respective estimated risk being expressed by at least one signal (Sj), and the risk-assessment unit (167) being communicatively connected to the safety unit (120) so as to provide said at least one signal (Sj) to the safety unit (120).

6. The system according to claim 5, wherein the risk-assessment unit (167) is further configured to monitor an environment around the motor vehicle (MV) to determine if the motor vehicle (MV) is currently operating within a range of parameters under which it is designed to operate.

7. The system according to any one of claims 5 or 6, wherein the risk-assessment unit (167) is further configured to determine an estimated risk that the motor vehicle (MV) and/or any other road user in proximity thereto violates a traffic rule, and the at least one signal (Sj) further reflecting said estimated risk.

8. The system according to any one of claims 2 to 7, further comprising a system-health-supervision unit (150) configured to monitor the received sensor signals, and based thereon derive the vehicle-health data (H) reflecting any faults comprised in the functional status of the motor vehicle (MV), the system-healthsupervision unit (150) being communicatively connected to the safety unit (120) so as to provide the vehicle-health data (H) to the safety unit (120).

9. The system according to any one of the preceding claims, wherein the safety unit (120) is further configured to: determine if the set of safety-related parameters (P, R, Sj, H) describes at least one condition under which the motor vehicle (MV) is currently operated, which at least one condition is such that a risk that the motor vehicle (MV) cannot move autonomously in agreement with the nominal path exceeds a failurerisk threshold, and if the failure-risk threshold is exceeded generate safety control signals (SCS) adapted to cause the motor vehicle (MV) to move autonomously in agreement with a safe path, which safe path takes precedence over the nominal path represented by the nominal control signals (NCS).

10. The system according to claim 9, wherein the safety unit (120) is configured to generate a control signal (Ctrl) indicating whether or not the failure-risk threshold is exceeded, and the system further comprises a control switch (210) arranged in communicative connection with the bank of control units (1 10) and the safety unit (120), and the control switch (210) is configured to: receive the control signal (Ctrl), receive the nominal control signals (NCS) and any safety control signals (SCS) respectively, and in response to the control signal (Ctrl), forward either the nominal control signals (NCS) or the safety control signals (SCS) to the motor vehicle (MV).

11. 1 1. The system according to any one of the preceding claims, wherein each of the auto control units (ACU1, ..., ACUn) is configured to generate a set of the nominal control signals (NCS), which set of the nominal control signals (NCS) is adapted to cause the motor vehicle (MV) to move autonomously in agreement with a respective nominal path.

12. The system according to any one of claims 1 to 10, wherein two or more of the auto control units (ACU1, ..., ACUn) are configured to generate a conjoint set of the nominal control signals (NCS), which conjoint set of the nominal control signals (NCS) is adapted to cause the motor vehicle (MV) to move autonomously in agreement with the nominal path.

13. The system according to any one of the preceding claims, further comprising a platform interface (130) configured to: receive the sensor signals (SS) from the motor vehicle (MV); and send out the nominal control signals (NCS) to the motor vehicle (MV).

14. A method of controlling a motor vehicle (MV) to drive autonomously, the method comprising: generating, via a bank of control units (1 10), nominal control signals (NCS) adapted to cause the motor vehicle (MV) to move autonomously in agreement with a nominal path; supervising, via a safety unit (120), a set of safety-related parameters (P, R, Sj, H) describing at least one condition under which the motor vehicle (MV) is currently operated; receiving sensor signals (SS) from the motor vehicle (MV), which sensor signals (SS) describe a current status of the motor vehicle (MV) and at least partly form a basis for the set of safety-related parameters (P, R, Sj, H); and sending out the nominal control signals (NCS) to the motor vehicle (MV), characterized by storing, in a data storage (140), a set of boundary conditions ({bc}) that the nominal path shall satisfy in order to be considered safe; reading out, from the data storage (140), the set of boundary conditions ({bc}) into the bank of control units (1 10) generating, via the bank of control units (1 10), the nominal control signals (NCS) such that the motor vehicle (MV) is controlled to move in such a manner that the nominal path satisfies the boundary conditions ({bc}); receiving in, the safety unit (120), the set of safety-related parameters (P, R, Sj, H), and in response thereto, generating, repeatedly at least one command ({cmd}) configured to update the boundary conditions ({bc}) aiming at confining the nominal path within limits that are given by a current state of the set of safety-related parameters (P, R, Sj, H).

15. The method according to claim 14, wherein the set of safety-related parameters comprises at least one of: a collection of requirements (R) and/or policies (P) to be followed during operation of the motor vehicle (MV), at least one signal (Sj) reflecting current characteristics of a physical environment around the motor vehicle (MV), and vehicle-health data (H) representing a functional status of the motor vehicle (MV).

16. The method according to claim 15, further comprising: receiving and storing, in a first data-interface unit (163), at least one safety policy (P) describing a respective mission-related rule to be followed during operation of the motor vehicle (MV), the at least one safety policy (P) relating to at least one of: a minimum distance that the motor vehicle (MV) shall keep to a followed vehicle, a speed limit that the motor vehicle (MV) shall keep, and definitions of safe stop locations that the motor vehicle (MV) shall be capable of reaching in case of a fault in the motor vehicle (MV), the first data-interface unit (163) being communicatively connected to the safety unit (120) so as to provide the at least one safety policy (P) to the safety unit (120).

17. The method according to any one of claims 15 or 16, further comprising: receiving and storing, in a second data-interface unit (165), at least one regulatory requirement (R) that shall be followed during operation of the motor vehicle (MV), the second data-interface unit (165) being communicatively connected to the safety unit (120) so as to provide the at least one regulatory requirement (R) to the safety unit (120).

18. The method according to any one of claims 15 to 17, further comprising: assessing, dynamically, in a risk-assessment unit (167), a respective estimated risk that the motor vehicle (MV) collides with each of any other road user and/or obstacle located in proximity to the motor vehicle (MV), the respective estimated risk being expressed by at least one signal (Sj), and the riskassessment unit (167) being communicatively connected to the safety unit (120) so as to provide said at least one signal (Sj) to the safety unit (120).

19. The method according to claim 18, further comprising: monitoring, via the risk-assessment unit (167), an environment around the motor vehicle (MV) to determine if the motor vehicle (MV) is currently operating within a range of parameters under which it is designed to operate.

20. The method according to any one of claims 18 or 19, further comprising: determining, via the risk-assessment unit (167), an estimated risk that the motor vehicle (MV) and/or any other road user in proximity thereto violates a traffic rule, and the at least one signal (Sj) further reflecting said estimated risk.

21. The method according to any one of claims 15 to 20, further comprising: receiving the sensor signals (SS) in a system-health-supervision unit (150) for monitoring, deriving, based on the sensor signals (SS), the vehiclehealth data (H) that reflect any faults comprised in the functional status of the motor vehicle (MV), and forwarding the vehicle-health data (H) from the systemhealth-supervision unit (150) to the safety unit (120).

22. The method according to any one of claims 14 to 21, further comprising: determining, in the safety unit (120), if the set of safety-related parameters (P, R, Sj, H) describes at least one condition under which the motor vehicle (MV) is currently operated, which at least one condition is such that a risk that the motor vehicle (MV) cannot move autonomously in agreement with the nominal path exceeds a failure-risk threshold, and if the failure-risk threshold is exceeded generating, in the safety unit (120), safety control signals (SCS) adapted to cause the motor vehicle (MV) to move autonomously in agreement with a safe path, which safe path takes precedence over the nominal path represented by the nominal control signals (NCS).

23. The method according to claim 22, further comprising: generating, in the safety unit (120), a control signal (Ctrl) indicating whether or not the failure-risk threshold is exceeded, and directing, via a control switch (210) and in response to the control signal (Ctrl), either the nominal control signals (NCS) or any safety control signals (SCS) to be forwarded through the platform interface (130) to the motor vehicle (MV).

24. A computer program (127) comprising instructions which, when executed on at least one processor, cause the at least one processor to carry out the method according to any one of the claims 14 to 23.

25. A non-volatile data carrier (125) containing the computer program of claim 24.