WO2015155133A1

WO2015155133A1 - System for autonomous vehicle guidance and motor vehicle

Info

Publication number: WO2015155133A1
Application number: PCT/EP2015/057383
Authority: WO
Inventors: Klaus Rink; Bernhard Schmid; Ulrich STÄHLIN; Holger Faisst
Original assignee: Continental Teves Ag & Co. Ohg; Continental Automotive Gmbh
Priority date: 2014-04-09
Filing date: 2015-04-02
Publication date: 2015-10-15
Also published as: DE102014213171A1

Abstract

The invention relates to a system for autonomous vehicle guidance, which is designed so that at least limited and/or temporally restricted vehicle guidance is still possible even in the event of failure of some of the system components. The invention also relates to a vehicle comprising such a system.

Description

System for autonomous vehicle guidance and motor vehicle

The invention relates to a system for autonomous vehicle guidance, which has a plurality of electrical and / or electronic components, wherein the components are adapted to cooperatively perform an autonomous vehicle guidance durchzu ^¬. The invention further relates to a motor vehicle with such a system.

It is known to equip vehicles such as cars, trucks or buses so that they can drive completely or partially autonomous. Ready for production are currently Einparkassis ^¬ tents for autonomous maneuvering in a parking space, traffic jam assistants to keep lane and distance at low speeds or Abstandstempomate for automatically holding a speed-dependent distance to a vehicle in front. Such systems can significantly relieve the driver in certain situations by taking him at least part of the vehicle guidance. Thus, they contribute to increased safety and also to increased ride comfort. For such driver assistance systems, for example, components such as cameras, ultrasonic sensors or radars are used.

It may be referred to as a general development goal to equip motor vehicles so that they take as many tasks as possible from the driver in as many situations as possible. It would be desirable, for example, for a vehicle to be able to drive completely autonomously on roads which allow it to travel long distances under largely defined conditions, for example on motorways. As is often driven to overcome long distances with very high speeds, an autonomous ride with appropriate design a represent a clear safety benefit. For example, an electronic vehicle management system can rely on special means of communication to obtain information from other vehicles or even from infrastructure about road conditions and possible hazards. In addition, electronic systems have a faster responsiveness than a human driver and are free of emotion.

However, it is understood that a possible gain in security can only be achieved if the system for autonomous vehicle guidance itself has a high degree of security, for example against failure of individual components of the security system. Otherwise, for example, there would be a risk that in case of failure of essential components, the vehicle is suddenly no longer controlled correctly, so for example, no longer follows a roadway or no other vehicles considered. This would have a high probability of a true ^¬ accident.

It is therefore an object of the invention to provide a system for autonomous vehicle guidance, which is improved, for example, in terms of safety. It is a further object of the invention to provide a motor vehicle with such a system.

This is inventively achieved by a system according to claim 1 and a motor vehicle according to claim 28. Advantageous embodiments are included, for example, in the respective subclaims. The content of the claims is made by express reference to the content of the description.

The invention relates to a system for autonomous vehicle guidance, which has a plurality of electrical and / or electronic components, wherein the components are designed for this purpose are, cooperatively an autonomous vehicle leadership lead durchzu ^¬ .

According to the invention, it is provided that

- Each of the components is assigned to a first set of components or a second set of components, wherein the components of the first set are adapted to perform an at least limited and / or temporary autonomous vehicle guidance even in case of failure of the components of the second set, and

wherein the components of the second set are adapted to perform an at least limited and / or temporary autonomous vehicle guidance even in case of failure of the components of the first set.

The system according to the invention is not only designed to autonomously control a vehicle when all components are functioning. Rather, it is additionally designed to control the vehicle autonomously, at least to a limited extent and / or for a limited time, when some of the components fail. A failure of a component, for example, by a defective

Power supply, a board break, a lightning strike or another rare but possible event. In the event of such a failure, however, the vehicle is not left uncontrolled, which would most likely lead to an accident, but is continued in order to avoid an accident.

Under a restricted vehicle guidance can be understood for example, that the vehicle can only be driven with a lower speed, with poor directional stability, less accurate posi tion ^¬ specifications or greater distance from the preceding vehicle. Unless the autonomous vehicle ^¬ conduct is limited possible, the allotted time can, in which the vehicle will continue to operate autonomously, play, be sufficient in ^¬ that a driver's

Vehicle guidance takes over or the vehicle is placed in a safe state, such as a ride cu ^¬ rigerer speed or the achievement of a parking position, for example on a hard shoulder.

Autonomous vehicle guidance can mean complete or partially autonomous vehicle guidance. Under a completely autonomous vehicle guidance can be understood, for example, that the vehicle travels routes without intervention of the driver, the vehicle ideally takes independently on parameters such as route, road condition and other vehicles consideration. Under a partially autonomous vehicle guidance can be understood, for example, that the vehicle performs individual driving tasks such as holding the speed, keeping the distance to the vehicle in front or keeping the lane itself, but other driving tasks

be taken over by the driver at the same time. Autonomous vehicle assistance can also be understood as autonomous assistance functions, such as construction site assistant, highway ^driving or traffic jam assistant.

Preferably, some or all of the components are communicatively connected to each other for data exchange. This allows the exchange of data such as measured values, sensor data, calculation results or driving commands. For example, the components may be the ^¬ particular a CAN fieldbus, via a fieldbus. The use of wireless communication such as Bluetooth or WLAN is conceivable. It should be understood that the components may also be communicatively connected to one another by a plurality of systems for data exchange. According to a preferred embodiment, it is provided that the system has a first vehicle electrical system and a second vehicle electrical system,

wherein the first set of components is connected to the first electrical system and the second set of

Components is connected to the second electrical system.

The electrical systems are used in particular for powering the components. They may be at least partially or entirely implemented as components of a wiring harness. By be ^¬ prescribed distribution is ensured that even with complete loss of a vehicle electrical system and a possible in this case, complete failure of all the components of the two quantities a safe onward travel of the vehicle while continuing the autonomous control system, although they may be limited and / or limited in time , is possible.

According to respective preferred embodiments, it is provided that the first set of components comprises one or more of the following elements:

Device for trajectory planning,

Device for coarse localization, in particular by means of satellite navigation and / or dead reckoning, device for determining input parameters for actuators (motion control),

Actuators, in particular steering, engine control, and / or brake,

Environment sensors, in particular cameras, radars, Lidargeräte, ultrasonic sensors, temperature sensors, rain sensors and / or road condition sensors.

The first set is also referred to as the "seeing path" because of the possible uptake of visual function components. .

b

The device for trajectory planning may, for example, be an electronic arithmetic unit which may be designed independently or as part of another arithmetic and logic unit executing further functions. The performed Traj ektorienplanung is used in particular the Vo ^{¬ out} calculation of a desired and / or suitable driving route, which can also be referred to as a trajectory. In other words, with the help of trajectory planning, the system specifies along which route the vehicle should move. The Traj ektorienplanung can preferably plan ahead continuously for a certain period of, for example, 5 s or 10 s.

For satellite navigation can be used on known systems such as GPS or GLONASS, which is usually a

Position determination with high accuracy allows. For dead reckoning, for example, data from various sensors such as speed sensors or steering angle sensors can be used. From the data of such sensors, the distance traveled can be calculated and thus the position can be calculated relative to a reference point.

Also in the device for calculating input parameters for actuators, which can also be referred to as motion control, it may be a computing unit, which may be executed ei ^¬ genständig or as part of another, other functions executing arithmetic unit. Thus, for example, control commands for actuators such as steering, brake and / or engine control are calculated, by means of which the calculated trajectory is driven by the vehicle.

The first set of components preferably has a camera for determining input data for a localization function. Thus, for example, lanes and / or landmarks as guardrails, guide posts or traffic signs are detected, which enables a particularly accurate position determination ^¬ light, especially if the system, the exact locations of the landmarks are known. For this purpose, a suitable card or database can be present, wherein such cards or databases can also be provided, for example, by a central server system to which the vehicle has access via wireless data transmission. Traffic signs can also be evaluated to obtain information about applicable traffic rules, which can be used, for example, in the context of autonomous vehicle navigation.

As indicated, the localization function input data is one or more of the following information:

Visual odometry (motion estimation), localization by simultaneous localization and mapping (SLAM, Simultaneous Localization and Mapping),

- Estimation of pitch, roll and / or roll rate.

This input data can be generated for example by the camera itself or by another component, preferably from image and / or video data obtained from the camera. The camera or another component can also be designed to determine dynamic data from the image and / or video data.

Preferably, a component is designed to determine an absolute position based on visual landmarks by means of images or data supplied by the camera and preferably also by means of map data. Such landmarks may be, for example, the guardrails, delineators or traffic signs already mentioned above. Positions such Landmarks may be included, for example, in map data stored in the vehicle or retrievable from a server via wireless data transmission. It should be understood that the vehicle may, for example, also update a central database of landmarks, particularly if it finds a new landmark, has removed a landmark, or has changed the position of a landmark.

Data provided by the camera can also be fused with data from environmental sensors such as radar sensors or lidar sensors. The fused data thus obtained can be used, for example, for position determination or else made available to other components. Thus, for example, the load on communication centers, such as a field bus, can be reduced, in particular if less original data is thereby transmitted.

It should be understood that a fusion can basically be designed as a tightly coupling or as a loose coupling.

The camera may, for example, be a monocamera, a stereo camera or a topview camera. It can also be provided several cameras of the same or different types.

According to respective preferred embodiments, it is provided that the second quantity of components comprises one or more of the following elements:

Antenna interface, in particular for vehicle-to-X communication (C2X communication),

An apparatus for on-track positioning and / or localization, in particular by means Satellitenna ^¬ vigation, odometry, and / or landmark-based positioning, Vehicle-to-X communication means

(C2X communication means),

further device for determining input parameters for actuators (backup motion control),

- Other actuators (backup actuators), in particular

further steering (backup steering), further engine control (backup engine control) and / or additional brake (backup brake). The second set is also referred to as the "listening path" due to the possible inclusion of radio systems.

Vehicle-to-X communication, also referred to as C2X communication in short, is understood in particular to be a vehicle-to-vehicle communication and a vehicle-to-infrastructure communication. The former refers to a communication between vehicles, wherein, for example, data on speed, course, lane changeover ^views , breakdowns or special mission rights can be exchanged. Secondly, a communication between a vehicle and infrastructure, for example, can be sent by the vehicle information about breakdowns and the infrastructure information about traffic rules, speed limits, traffic conditions or diversions can be received.

The antenna interface can be dedicated to the

C2X communication be provided or have multiple functions, so that, for example, other communication means such as a car phone can use the antenna interface.

The device for accurate positioning of the track can be implemented, for example, by means of satellite navigation and / or by means of odometry, the latter case being used in the latter case. For example, data from driving dynamics sensors can be received and used. In particular, the device for accurate positioning of the second set may also be present in addition to the device for coarse positioning of the first set, in which case typically the device for accurate positioning of the track enables a more accurate position determination than the device for coarse positioning. The latter can be designed, for example, to determine the road on which the vehicle travels, while the former is designed to also determine the lane, which is particularly advantageous on motorways and other multi-lane roads.

A track-accurate positioning can be done in particular in a digital map or used for a digital map.

The C2X communication means may, for example, be in the form of a radio and / or data processing module for the

C2X communication be formed. They can also be designed as part of such a module, which has more functions.

In particular, the backup motion control and the backup actuators can be configured to assume the corresponding tasks in the event of a failure of the motivation control or one or more actuators from the first set. Thus, the second set of components can basically be put into the position to take over the vehicle guidance even if the corresponding components of the first set fail.

Preferably, the second amount, a number of environment sensors, in particular cameras, radar devices, lidar, ultrasonic ^¬ sensors, temperature sensors, rain sensors and / or road ßenzustandssensoren. These environment sensors may in particular be present in addition to environmental sensors which are assigned to the first quantity. This increases the safety of the system, especially in the event of failure of components of the first set, since the second set in this case has some ability to perceive the environment, although this capability will typically lag behind that of the first set. Preferably, the second amount to a number of Fahrdyna ^¬ miksensoren, in particular speed sensors, speed sensors, steering angle sensors, steering wheel angle sensors, acceleration sensors and / or rotational speed sensors. This makes it possible to acquire driving dynamics data, for example for use in a position determination or in a position-accurate positioning.

According to a preferred embodiment, the system is adapted to transfer a vehicle in the event of failure of a vehicle electrical system or in the event of failure of at least one component in a safe state. The safe state can, for example, be a transfer of the vehicle guidance to a driver, a reduction in the speed and / or a parking of the vehicle in a space provided for this purpose, for example a side strip. Thus, the failure can be accommodated in a suitable manner to prevent an accident as effectively as possible.

A driver can be warned in case of failure of a vehicle electrical system or failure of at least one component, for example, by optical, acoustic and / or haptic signals to take over the leadership of the vehicle. Thus, the driver can be quickly made aware that his intervention to avoid a dangerous situation is required. , ^

Some or all of the components may be configured to collect data and exchange captured data between components of both sets. The system may be designed to autonomously continue the vehicle in the event of failure of a vehicle electrical system or of components for a short period of time, in particular a period of 5 seconds to 10 seconds, by means of the information previously exchanged between the components of both quantities. At least one component of the second quantity is preferably designed to transmit data to at least one component of the first quantity when operating both vehicle systems and / or when operating all the components. According to respective implementations, the data communicated by components of the second set of components of the first set may be one or more of the following:

Vehicle position in a global reference system, in particular WGS 84,

-track positioning, for example, to United ^¬ application in a digital map,

Information from a vehicle-to-X communication, for example

dynamically changing objects which may be on a trajectory, such as left-over vehicles, construction sites, special-purpose vehicles and / or tailings,

Traffic sign information,

Vehicle dynamics data of other vehicles, in particular of preceding, approaching or moving vehicles, with which stable convoy travel can be made possible, Information about lane change intentions of others

Vehicles, in particular of preceding, approaching or moving vehicles, which relate to their own lane,

Vehicle dynamics data, for example

Yaw rate and / or 3D yaw rate,

Acceleration and / or 3D acceleration,

Steering angle,

Wheel speed,

Speed over ground,

Swim angle.

For example, this information may become autonomous

Vehicle guidance of components of the first quantity can be used. In particular, data from the vehicle-to-X communication, which relate to a trajectory that the vehicle is expected to drive, are relevant in this case.

Preferably, some or all of the information transmitted by components of the second set of components of the first set has a respective time stamp indicating the time of information capture. This enhances possibilities for evaluating or fusing the information, since it is known exactly when the particular information was recorded.

Particularly preferably, the time stamp is generated using global time information, in particular a time information obtained from satellite navigation. This also allows the comparison of time stamps, which were assigned in the own vehicle, with time stamps from other vehicles or infrastructure. A timestamp may, for example, have a data record which has a time in a specific format and possibly also a date. With a position transferred from a component of the second path, for example a device for accurate tracking positioning, a simple localization in at least one component of the first set can be continuously calibrated, which enables, for example, a track-accurate positioning in the trajectory planning. It is also possible to determine a driven actual trajectory by means of an internal localization, and from this an optimization of the actuator control by the motion control can be carried out. Thus, a closed control loop of Aktoransteuerung and resulting position change can be formed, which allows a particularly precise driving.

According to a preferred embodiment, the data transmitted by components of the second set of components of the first set include global time information, in particular a time information obtained from satellite navigation. This makes it possible, in particular in an advantageous manner, for the time information to be transferred to environment sensors and for the environment sensors to provide respective measured values with a time stamp based on the time information. For example, in the case of a fusion of the incoming data, such a time stamp can improve a time allocation of the data and thereby reduce a time blurring of the information generated in the fusion.

Particularly preferably, at least one component of the first quantity is designed to be used in the event of a failure of the second on-board network or at least one component of the second quantity, a traj ektorienplanung means of the components of the second Amount of components of the first amount transmitted information for a certain period, preferably between 5 s and 10 s to perform. This can be a time sufficient to perform a handoff of the vehicle control to a driver to be carried, in which to handover the vehicle is controlled to sufficiently ^¬ reliably to avoid an accident. Al ^¬ ternatively or additionally, it may be provided to convert the vehicle in a certain state such as a stop on a hard shoulder.

Preferably, at least one component of the first quantity is designed to operate when operating both vehicle systems

Traj ektorienplanung continuously passed to at least one component of the second set, wherein at least one component of the second set is adapted to operate in case of failure of the first electrical system or components of the first set using this Traj ektorienplanung autonomous driving for a certain period of time. Thus, even in the case of a failure on the part of the first set a safe, albeit possibly limited time further operation of the vehicle can be made possible until a driver has taken control or other measures are taken.

In the case of a failure of components of the first set, in particular in case of failure of a motion control or a number of actuators, preferably a backup motion control or backup actuators from the second set can be used.

A Traj is preferred in case of failure of components of the first set ektorienkontrolle performed by a positioning module of the second set and back ^¬ reported to the backup motion control, so that it can optimize its control. In case of failure of the first electrical system, in case of failure of at least one component of the first set, or even assuming the vehicle management alone by components of the second set for other reasons, the Traj ektorienplanung obtained from a component of the first set using data from a vehicle -to-X communication updated. This allows a longer safe driving time under autonomous vehicle guidance. According to a preferred embodiment, at least one component or a device not connected to the first on-board network or the second on-board network is designed to provide one or more vehicle-to-X communication means if the first on-board network and / or the second on-board network fails and / or individual components fail send multiple messages to other vehicles and / or infrastructure, the messages including the information that the vehicle is in emergency mode. Thus, other vehicles can be warned that the vehicle may not behave as in fully operable autonomous vehicle guidance. You can then, for example, maintain a greater distance or refrain from changing lanes.

According to a preferred embodiment, some or all of the data and / or information exchanged between the components has an integrity measure which indicates the quality of the data and / or information. This allows a better evaluation of the data, for example, in fusion or other calculations or evaluations. For example, the data with the best integrity measure can be used for certain calculations.

According to respective implementations, redundant location information of a component or multiple components and / or the system has a central component which executes a centrally monitoring algorithm and to which redundant location information is supplied, the algorithm being adapted to execute an autonomous vehicle control or individual functions of an autonomous vehicle control even if one of the

Bordnetze or at least one component fails. This achieves a particularly high degree of safety. Such an algorithm may preferably operate based on the integrity measures. The components that execute the centrally monitoring algorithm may be associated with both sets of components.

Preferably, the system includes one or more components to calculate a vehicle position in two ways, one being based at least on vehicle dynamics data and Sa ^¬ tellitennavigationsdaten, and on the other based at least on the camera data, and particularly preferably on map data. For an advantageous redundancy is achieved, which can be used in case of failure of a certain part of the system to other parts in order to obtain the necessary for a safe or at least limited driving with autonomous vehicle management functionality. In addition, a tolerance against common cause errors is achieved, ie it is very unlikely that the same error interferes with both types of computation in the same way. Particularly preferred is a component for calculating the vehicle position based on camera data and possibly also map data for the first set of components. More preferably, a component for calculating the vehicle position based on vehicle dynamics data and satellite navigation belongs to the second set of components.

According to a preferred embodiment, the system has one or more components to vehicle dynamics data, satellite navigation data and camera data, and preferably also map data to merge and provide as fused information to other components. Thus, for example, a load on an in-vehicle communication system such as a fieldbus can be reduced. Such components may belong to the first and / or second quantity.

According to a preferred embodiment, the first vehicle electrical system has a first power supply unit and the second vehicle electrical system has a second power supply unit, wherein the first power supply unit serves to supply the components connected to the first vehicle electrical system and the second power supply unit serves to supply the components connected to the second vehicle electrical system , Furthermore, the first vehicle electrical system preferably has a first battery, which, if the first power supply unit fails, takes over the power supply of the first vehicle electrical system. The second electrical system preferably has a second battery, which takes over the power supply of the second electrical system in case of failure of the second power ^¬ supply unit.

By providing batteries, extra security can be provided to avoid the need for some or all of the emergency measures mentioned above to be applied in the event of component failure. In case of failure of a power supply unit, which would otherwise lead to the failure of components, the operation of the components connected to the electrical system components can be further ensured by a battery in an advantageous manner. The time within which such a battery operation is possible, in particular, may be longer than the time within which a safe continued operation of the vehicle under autonomous vehicle guidance in case of failure is possible. Particularly preferably, the system further comprises at least one battery management system, which is designed so that in case of failure of the first power supply unit and the first battery, the second battery takes over the power supply of the first electrical system, and / or that in case of failure of the second power supply unit and the second battery first battery takes over the power supply of the second electrical system. Thus, even in the case in which a power supply unit and the associated battery fail simultaneously, the function of both electrical systems and thus all components of the system can be further ensured. This makes it even more unlikely that the emergency measures described above need to be used. These would rather only necessary if, for example, also fails the other battery or some other defect in ^¬ play, a platinum break in a component.

The invention further relates to a motor vehicle having a system according to the invention for autonomous vehicle guidance. Thus, the advantages described above for a motor vehicle can be utilized. Regarding the system can be used on all the described versions and variants. Illustrated benefits apply accordingly.

It should be understood that components of the autonomous vehicle management system may also be used for other purposes. For example, a steering angle sensor can be used both for autonomous vehicle guidance as well as for the control of a power steering.

Basically, computing units or other electrical or electronic components or elements of the system described can be, for example, by means of a microprocessor, a MicroControllers, an application specific integrated circuit (ASIC), a programmable logic controller (SPSS) or by other hard-wired or freely programmable components. For example, such computing units or other electronic

Have components or elements processor means and memory means, wherein in the memory means program code is stored, executed in the execution by the processor means, the Pro ^¬ zessormittel a particular method and / or a specific sequence of instructions.

In principle, a number of specific units should be understood as meaning either such a unit or a plurality of such units.

Further features and advantages will be apparent to those skilled in the embodiment described below with reference to the accompanying drawings. 1 shows an embodiment of a system for autonomous

Vehicle guidance,

Figure 2: An embodiment of a vehicle with such a system.

Figure 1 shows schematically an embodiment of a system 10 for autonomous vehicle guidance.

The system 10 includes a first set 100 of components and a second set 200 of components. These components will be described in detail below.

The first set 100 includes a device 110

Traj ektorienplanung, a device 120 for coarse local tion, a device 130 for determining input parameters for actuators, a number of actuators 140, a camera 150 and a number of further environment sensors 160. Due to the inclusion of a camera and other environment sensors, the components of the first set 100 are also referred to as a "seeing path".

The second set 200 has a vehicle-to-X antenna interface 210, a track-accurate positioning device 220, a further device 230 for determining input parameters for actuators, a number of further actuators 240, a vehicle-to-X Communication module 250, a number of environmental sensors 260, a number of driving dynamics sensors 270 and a computing unit 280 on. Due to the integration of external communication, the components of the first set are also referred to as the "listening path".

Overall, the system 10 is designed to autonomously control a vehicle in defined situations. It should be mentioned in particular that the system 10 can realize a stable Ko ^¬ Lonnenfahrt on a highway, so that the vehicle joins the flow of traffic and normally no intervention by the driver are necessary. In particular, steering angle, engine power and braking effect are controlled autonomously by the system 10 so that the direction of travel, curve radii, VELOCITY ^¬ ness, acceleration and deceleration are set automatically. If all of the components of the system 10 listed above are normally functional, ie in operation, the system 10 achieves its maximum functionality.

However, the system 10 is also designed to lead the vehicle even at least limited and limited in time autonomously, if one or more of the components fail. In particular, the system 10 is designed to restrict the vehicle in the event of failure of the components of the first set 100 or in the event of failure of the components of the second set 200 and for a limited time until a driver has taken over the vehicle control. In such a case, the driver is advised that the autonomous vehicle guidance system 10 is no longer fully functional and that he must take over the vehicle control himself. However, since the driver will not be prepared for this regularly, it usually takes a few seconds for the driver to check the traffic situation and take over the vehicle. During this time, the system 10 continues to operate the vehicle in a restricted manner, thereby preventing the vehicle from continuing without guidance and causing an accident. This is done in particular by means of those components which have not fallen out ^¬ . If, for example, the components of the first set 100 fail, the components of the second set 200 take over the vehicle control. In contrast, if the components of the second set 200 fail, the components of the first set 100 take over the vehicle control. Details will be described below.

All components of both sets 100, 200 are interconnected via a CAN fieldbus system (not shown) in such a way that they can exchange data with one another. Such fieldbus systems are known per se, which is why will not be discussed in detail.

The system 10 has a first vehicle electrical system 102 and a second vehicle electrical system 202. The components of the first set 100 are connected to the first on-board network 102 and the components of the second set 200 are connected to the two on-board network 202. The vehicle electrical systems 102, 202 serve to supply power to the components of the quantities 100, 200. ₂

The first vehicle electrical system 102 has a first power supply unit 104, which supplies the components of the first set 100 with electricity. The first vehicle electrical system 102 also has a first battery 106. The first battery 106 is adapted to the

Components of the first set 100 to supply power should the first power supply unit 106 should fail.

The second electrical system has a second power supply unit 204, which supplies the components of the second set 200 with electricity. The second vehicle electrical system 202 also has a second battery 206. The second battery 206 is configured to supply power to the components of the second set 200 should the second power supply unit 206 fail.

The described embodiment with the two power supply units 104, 204 and the two batteries 106, 206, the reliability of the system 10 is already substantially increased, because even upon failure of a respective power supply ^¬ unit 104, 204, for example due to an internal De ^¬ fekts, the respective battery 106, 206 can take over the power supply for at least a limited time.

To further increase the reliability of the system 10, this further comprises a battery management system 90. This is connected to both on-board networks 102, 202 and to both batteries 106, 206. In case of failure both the first

Power supply unit 104 as well as the first battery 106, the battery management system 90 ensures that the power supply of the first electrical system 102 is performed by the second battery 206. In case of failure both the second

Power supply unit 204 as well as the second battery 206, the battery management system 90 ensures that the power Supply of the second electrical system 202 by the first battery 106 is carried out.

In the event that the security functionality provided by the battery management system 90 should also fail, further security functionalities are implemented, which will be discussed in more detail below.

The device 110 for traj ektorienplanung and the device 130 for determining input parameters for actuators are designed in a conventional manner as electronic computing units. The device 130 for determining input parameters for actuators can also be referred to as motion control.

The coarse localization device 120 is implemented in a manner known per se as an electronic processing unit and in particular has a satellite navigation module which can calculate the position of the vehicle using satellite signals. Furthermore, it also receives information from the driving dynamics sensors 270 described below, by means of which the position calculation can be further refined. The actuators 140 in the present case are steering,

Engine control and brake. This makes it possible to control all important driving parameters such as course and speed of the vehicle. The actuators 140 receive their instructions from the input parameter determination device 130 for actuators, which constantly calculates these instructions.

The camera 150 looks in the direction of travel on the lane and detects landmarks such as traffic signs, lane boundaries and other helpful to determine the position of the vehicle Objects. The camera 150 is in particular designed to determine input data for a localization function from recorded images. For this purpose, the camera is designed to perform a visual odometry, ie to close the movement of the vehicle on the basis of the pictures taken. Dynamic data can also be determined. The information obtained from this is provided to the rough localization device 120, which can use the localization improvement information. In the event of a failure of the satellite navigation module or other components for determining the location of important components in the rough location device 120, the rough location device 120 may also calculate the position of the vehicle based solely on the information received from the camera 150. In addition, map data can be consulted.

The other environment sensors 160 in the present case are radars, ultrasound sensors, temperature sensors and rain sensors. These provide information about the distance of other vehicles, the weather and the road conditions to the CAN fieldbus system and thus to the other components.

The antenna interface 210 is configured to receive and transmit radio signals to the communication module 250 and to amplify and transmit radio signals generated by the communication module 250. For this purpose, the antenna interface 210 has a transmitting and receiving ^amplifier , which is connected to a vehicle ^outer antenna.

The device 220 for accurate tracking positioning is designed in a manner known per se as an electronic processing unit and has a further satellite navigation module to independently _,

2 b from the rough location device 120 to determine the position of the vehicle. The track-accurate positioning device 220 further receives images from the camera 150 and then evaluates them to include landmarks such as traffic signs or road boundaries. When such landmarks are detected, the track-accurate positioning device 220 uses them to improve the accuracy of position determination. For this purpose, the device also has a database of landmarks. In addition, the track-accurate positioning device 220 also receives data from the vehicle dynamics sensors 270 described in greater detail below to further improve positioning by odometry.

The further device 230 for determining input parameters for actuators and the further actuators 240 are units which are designed to be equivalent to the device 130 for determining input parameters for actuators and to the actuators 140. The further device 230 for determining input parameters for actuators and the further actuators 240 are provided in particular for assuming the functions of the device 130 for determining input parameters for actuators or the actuators 140 if these should fail. The further device 230 for determining input parameters for actuators can thus also be referred to as backup motion control. Likewise, the further actuators 240 may be referred to as backup actuators.

The vehicle-to-X communication module 250 is configured to communicate with other vehicles and with infrastructures via the antenna interface 210 and the external vehicle antenna connected thereto. The communication module 250 continuously sends out signals which contain ^information such as the current position of the vehicle, its speed and any lane change intentions. Likewise, the communication module 250 continuously receives signals from other vehicles and from infrastructures, for example about positions, speeds and events of other vehicles, about the traffic situation or about traffic regulations such as speed limits. This information is made available to the other components of the system 10.

The environment sensors 260 of the second set 200 in the present case have a camera and a radar device. These are in addition to the camera 150 and the environmental sensors 160 of the first set 100 and serve to give the second set 200 of components at least some ability to sense the environment so that in case of failure of the components of the first set 100 positioning and vehicle guidance can be improved.

In the present case, the driving dynamics sensors 270 have a number of rotational speed sensors, a steering angle sensor, a steering wheel angle sensor and an acceleration sensor. Thus, the driving state of the vehicle can be detected and displayed in comprising Fahrdyna ^¬ mikdaten, said vehicle dynamics data is supplied to the particular device 220 for accurately positioning track.

If one of the two vehicle electrical systems 102, 202 fails, the components of the respective quantity 100, 200 which are connected to the vehicle electrical system also fall out. In this case, the components of the other of the two sets 100, 200 may take over the control of the vehicle with limited functionality, as already described above. However, the accuracy of this control is sufficient only for a period of a few

Seconds. For this reason, the driver is promptly audible and visually prompted to take over the control of the vehicle in case of failure of a vehicle electrical system 102, 202 or even in case of failure of a component essential for the control. If the ^ ₀

Driver reacts and the controller actively takes over, so the autonomous vehicle control is turned off. Should not react but the driver, the vehicle is transferred from the func ^¬ onierend remaining components in a safe state. This means herein that the vehicle decelerates abge ^¬ and is brought to a halt on a page strip.

During correct operation, in particular when both vehicle electrical systems 102, 202 are functioning and the components of the first and second quantities 100, 200 connected thereto also function, components of the second quantity 200 continuously transmit data to components of the first quantity 100, namely to the device 110 to Traj ektorienplanung and the device 120 for coarse localization.

Specifically, the transmitted data is a vehicle position in the global reference system WGS 84 determined by the track accurate positioning device 220 and information from vehicle-to-X communication about other vehicles and traffic rules. Furthermore, the driving dynamics data already described above are also transmitted.

All data transmitted within the system 10 between the components of the two sets 100, 200 carry a respective time stamp. This is based on a global time reference obtained from the satellite navigation satellite navigation module included in the track accurate positioning apparatus 220. This time ^¬ reference 10 is provided to all components of the system are available. In particular, all measured values of the sensors contained in the system are each provided with a time stamp. This ensures, on the one hand, that all information can be assigned exactly to a particular time, which makes it possible to recognize temporal progressions and, in general, one Time blur reduced. On the other hand therefore also si ^¬ chergestellt is that derived from the system 10 data can be compared with obtained from outside the vehicle data, particularly from the vehicle-to-X-communication, in terms of time. Namely, these data were also time-stamped by the respective transmitting vehicles or infrastructures using the time reference obtained from satellite navigation. Should the second on-board network 202 fail, or should components of the second set 200 otherwise fail so that the data described above can no longer be sent to the trajectory planning device 120 and coarse location device 120, then the device 110 is to Traj at least for one

Period of about 10 s to continue the Traj ektorienplanung with an accuracy sufficient to ensure a safe onward journey of the vehicle. Within this time, the driver should have taken control.

The trajectory planning continuously performed by the device 110 for trajectory planning is continuously transmitted to the arithmetic unit 280. The arithmetic unit 280 is thus able, in case of failure of the first electrical system 102 or components of the first set 100 to an already done

Traj ektorienplanung from the first set of 100 fall back and thus take over the vehicle control. The

Traj ektorienplanung can be continued in the computing unit 280, in particular using data from the vehicle-to-X communication, the functionality of which does not depend on the first on-board network 102. Events such as the collapse of another vehicle in the calculated trajectory can be taken into account in this way. If at least one component of the system 10 fails and the functionality of the autonomous vehicle management system 10 is thus limited, the communication module 250 sends out a message via the antenna interface 210, which alerts other vehicles that the vehicle is in a state of repair Emergency operation is located. This will allow them to prepare for the vehicle not behaving as expected and to take appropriate precautionary measures to avoid an accident. For example, other vehicles can reduce their speed and maintain a greater distance.

Some data exchanged between the components of the system 10 have an integrity measure. This indicates the quality of the data. By way of example, a sensor which generates data based on measured values can determine the degree of integrity on the basis of its measuring accuracy. Other components can then estimate how accurate the data provided by this sensor is.

The computing unit 280 is further configured to fuse the vehicle dynamics data, satellite navigation data, camera data and map data already mentioned above, and to make the fused information thus obtained available to the other components. This allows a reduction in the required computing capacity in other components.

Figure 2 shows schematically a motor vehicle 5 with a system 10, which is formed as just described. The vehicle 5 further comprises a power supply device 8 with an alternator and a vehicle battery, which supply the system 10 with electrical energy. This allows a autonomous control of the vehicle 5 in the manner just described.

Below is a further description of features that may be relevant to the invention. It should be understood that individual features in this description may or may not be assigned features of the previous description by virtue of their functionality or other criteria. All features described below can be combined with all features described above in any combinations and sub-combinations. More particularly, the disclosure of this application also includes any selection, Kombina ^¬ functions or sub-combinations of above-described features, wherein one or more of the features described below are explicitly excluded from protection. The following statements may, for example, be understood as an independent description of an invention or as a specification of the invention already described above.

Vehicle-to-X communication systems (C2X systems) are already known in the art for both transport-related data transmission and various service data such as entertainment applications. The vehicle-to-X communication is based both on the data exchange between vehicles (vehicle-to-vehicle communication) and on the data exchange between vehicles and infrastructure facilities (vehicle-to-infrastructure communication). This data exchange can be based, for example, on the WLAN standard IEEE 802.11p, which is currently in pre-development. Likewise, various types of surrounding detection systems are known, which by means of different environment sensors, such as camera, radar, Lidar-, ultrasound and temperature sensors a Capture vehicle environment. Furthermore, it is known to combine vehicle-to-X communication systems and surroundings detection systems in order to create as complete a modeling of the vehicle environment as possible, thus enabling autonomous vehicle guidance.

However, there is still a need for safety concepts for autonomous vehicle guidance, since in a partial or complete system failure safe autonomous driving a vehicle is usually no longer guaranteed.

It is therefore proposed that a first part of the systems necessary for autonomous driving is connected to a first vehicle electrical system and a second part of the systems necessary for autonomous driving is connected to a second vehicle electrical system.

In a preferred embodiment, the environment sensors, the Traj ektorienplanung, simple localization, the motion control and the actuators (steering, engine control and brake) are supplied by the first electrical system in normal operation. Due to the integration of environmental sensors, this part is called "see- the path" is preferred to the second electrical system antennas ^¬ interface, the on-track positioning and localize ^¬ insurance unit, the C2X system, the backup motion control and. Backup actuators (backup steering, brake) as well as the motor control connected.Thanks to the antenna connection this part is also called "listening path".

In "normal mode", the "seeing path" is preferably fed by data from the "listening path", ie the data of the "seeing path" are supplemented by data of the "listening path". For example, this "listening path" data includes some, several, or all of the following information: the location in a global reference system (eg, WGS 84),

the accurate tracking positioning in a digital map, which also with information from the

C2X system (dynamically changing objects which can ektorie are on the Fahrtraj these are, for. Example, broken down vehicles, provide construction ^¬, SWAT vehicles, traffic congestion, United ^¬ traffic signs information, etc., but also driving dynamics data of vorrausfahrenden, approaching or traveling alongside Vehicles with which stable co-op could be made available, information on the lane change intent of other vehicles traveling in advance, approaching or moving in the direction of their own lane),

- the vehicle dynamics data (eg up to 3D yaw rate,

3D acceleration, steering angle, wheel speed, speed-over-ground, slip angle, etc.) and global time information. All transferred information preferably includes a timestamp that contains the exact time when the information was captured.

With the transferring position, the simple localization in the "seeing path" is preferably constantly calibrated, thus enabling a track-accurate positioning in the trajectory planning. Also, the driven actual trajectory is preferably determined by the self-localization, and optimization of the actuator control by the motion control is thereby preferably carried out. This creates a closed control loop of actuator control and the resulting change in position.

Similarly, from the "hearing-path" preferred time Informa ^¬ tions passed to the environment sensors so that the measurements are also provided as early as possible with a time stamp.

In the case of a fusion of the incoming data, the time stamp preferably serves for temporal allocation of the data and thereby for reducing the time blurring of the information generated in the fusion.

All data is designed to enable trajectory planning in the event of a failure of the "listening path" until the driver is taken over (eg 5-10sec after failure).

In the event of failure, the vehicle is preferably brought into a "safe state" as quickly as possible, ie the speed is reduced or a safe position on the roadside activated or the driver is warned by optical, acoustic or haptic signals, the leadership of the vehicle possibly without other road users running the risk of causing a collision with the vehicle or other road users.

Since in this case the environment sensors are still functional, the failure of the "Hearing_Path" is less serious than the failure of the "Seeing Path". In the event of a failure of the "seeing path", the "listening path" prefers a sufficiently far-sighted one

Traj ektorienplanung from the "seeing path" back, which was previously in "normal operation" before constantly passed to the "Listening_Path." The length of the Traj ektorienplanung is preferably chosen so that it is sufficient to the driver again to the driver transferred, or to bring the vehicle to a safe state. in the case of a failure of the "seeing-path" is preferably a back-up motion control module ektorie with the backup Traj ver ^¬ ensures that thus calculated the necessary actuator movements of the backup actuators , The Traj ektorienkontrolle is now preferably carried out directly from the positioning module in the "listening path" and returned to the motion control, so that this can optimize its control.

Likewise, the sufficiently forward looking trajectory planning (eg, 5-10sec) obtained from the "seeing path" is preferably continually updated with an update from the C2X system, so that events recorded by the C2X system prior to failure of the "seeing-path" were unknown, can be taken into ^account . This allows eg quick and short-term events that could lead to a collision (such. As a one ^¬ shearing another vehicle in the trajectory of the vehicle) with the Traj be included ektorienplanung.

Likewise, the "emergency operation" of the vehicle can preferably also be transmitted to other vehicles directly via C2X, so that they can, for example, maintain sufficient distance to the vehicle and avoid collapsing into the trajectory of the vehicle. A further embodiment provides that part of the environmental sensors, in particular the extensions for autonomous driving, is integrated with the second electrical system, so that a. The implementation of the security concept according to the invention in automated driving simultaneously makes the configuration of the vehicle scalable and

b. if the "seeing path" fails, the "listening path" also has a minimum of "vision" and can thus continue to back-up the trajectory planning in the event of sudden events, making it possible to make plausible the incidents recorded using the C2X system traffic ^¬ participants, or preferably not capable of C2X communication are detected. a further embodiment provides that the first vehicle electrical system powered by a battery management system, the second electrical system with energy, if the energy source of the second vehicle electrical system fails. the same occurs preferably vice versa also, if the power supply of the first electrical system fails.

In all cases, the safety concept works even if only individual functions fail from one of the wiring systems. In this case it is the ent ^¬ speaking main feature or the backup feature in the unaffected board network takes over the failed preferred function.

The security concept according to the invention is preferably used not only in autonomous driving but also in autonomous assistance functions (such as, for example, construction site assistant, convoy on motorways, etc.). _η

The invention thus has a way, in the event of failure of one of the two vehicle electrical systems, to rule out autonomous vehicle guidance, at least until safe acceptance of the vehicle guidance by the driver, endangering the surrounding traffic.

Further preferred embodiments will become apparent from the following explanations as well as the further attached figures.

Show it

3 shows an exemplary first construction of a functional architecture of a system,

4 shows an exemplary first construction of a hardware architecture of a system,

5 shows an exemplary second construction of a hardware architecture of a system,

6 shows an exemplary third construction of a hardware architecture of a system, and

7 shows an exemplary fourth structure of a hardware architecture of a system.

To the figures his following explanations given:

IDC = integrated drive control

SDC = safety domain control

BDC = backup drive control

In particular, the BDC can take over the function of the IDC if it should fail. According to another ^exemplary embodiment, which is not necessarily illustrated, the "seeing path" is connected to the primary vehicle electrical system and comprises sensors for

Generate static landmarks and dynamic objects (from which the trafficable space is calculated), identify traffic rules,

provide the backup system with landmarks and speed to optimize localization (e.g., offset drift from dead reckoning, true-to-lane positioning into the map using landmarks).

In the IDC while the Bahntraj for example according ektorien be ^¬ counted by fusion of

a look-ahead map, which captured track-accurate positions and using the C2X system

Contains events and min. for 5sec. Includes ride Kar ^¬ tendaten,

sensors detected by the sensors, dynamic objects that limit the trafficable space,

- the traffic regulation merger.

In the IDC, the simple localization with the exact tracking localization from the backup system is continuously calibrated.

According to a further, not necessarily illustrated embodiment of the "listening path" is connected to the backup electrical system and includes an antenna module, by means of which

Card data are received and map corrections sent to the backend,

events detected by the C2X system are received and so-called Ego C2X information is sent. In the SDC, the track-accurate position in the map is calculated, for example, by fusion

exact map,

GNSS localization with dead reckoning, incl. Velocity information from the sensors, Landmarks from the sensors and

events recorded in the relevant environment using the C2X system.

According to another embodiment, which is not necessarily illustrated, the "seeing path" assumes the following functions if the "listening path" fails:

The web guide over the sensors and with the card data already handed over to the IDC until the driver has taken over after 5 seconds

Monitoring of the position change by means of differential localization with precise start value (from backup system).

Below is a systematic list of some aspects. It is not doing the patent ^¬ claims of this application, but it should be understood that the following list can be used as claims.

1. system for autonomous vehicle guidance,

comprising environment sensors and vehicle-to-X communication means,

wherein the environment sensor system and the vehicle-to-X communication means are each adapted to detect information about a vehicle environment, wherein the system is configured to autonomously guide a vehicle based on the acquired information,

characterized,

that components of the system are connected to two independent Bordnetze such that the vehicle is in case of failure of a vehicle electrical system in a safe state can be transferred. System according to FIG. 1,

characterized,

that a Traj ektorienplanung, a simple localization, a motion control and actuators (steering, engine control and brake) are connected to a first electrical system.

System after at least 1 or 2,

characterized,

That is preferably the antenna interface, a track-accurate positioning and localization unit, vehicle-to-X communication means, a backup motion control, a backup Aktorik (backup steering, brake) and a motor control connected to a second electrical system are.

System according to at least one of 1 to 3,

characterized,

that the environment sensor system is also connected to the first electrical system.

System according to at least one of 1 to 4,

characterized,

the system is designed to exchange respectively acquired data between the on-board networks.

System according to at least one of 1 to 5,

characterized,

that the system is designed to autonomously continue the vehicle in case of failure of a vehicle electrical system for a short period, in particular 5 to 10 s, by means of the previously exchanged information between the on-board networks.

System according to at least one of 1 to 6,

characterized, that the system is integrated in a motor vehicle.

System after at least one of 1 to 7,

characterized,

that the environmental sensors camera sensors and / or

Radar sensors and / or Lidarsenorik and / or

Ultrasonic sensors and / or temperature sensors and / or rain sensors and / or road condition sensors include.

System according to at least one of 1 to 8,

characterized,

that the safe state is a transfer of the vehicle guidance to a driver or a parking of the vehicle in a space provided for this purpose.

The claims belonging to the application do not constitute a waiver of the achievement of further protection.

If, in the course of the procedure, it turns out that a feature or a group of features is not absolutely necessary, the applicant is now already seeking to formulate at least one independent claim which no longer has the feature or the group of features. This may, for example, be a subcombination of a claim present at the filing date or a subcombination of a claim limited by further features of a claim present at the filing date. Such newly formulated claims or feature combinations are to be understood as covered by the disclosure of this application.

It should also be noted that embodiments, features and variants of the invention, which are described in the various embodiments or exemplary embodiments and / or shown in the figures, can be combined with each other as desired. Single or multiple features are arbitrarily interchangeable. Resulting combinations of features are to be understood as covered by the disclosure of this application.

Recoveries in dependent claims are not to be understood as a waiver of obtaining independent, objective protection for the features of the dependent claims. These features can also be combined as desired with other features.

Features that are disclosed only in the specification or features that are disclosed in the specification or in a claim only in conjunction with other features may, in principle, be of independent significance to the invention. They can therefore also be included individually in claims to distinguish them from the prior art.

With regard to the following claims, it should be noted that, for the purpose of better readability, the enumeration of reference symbols was at least partially dispensed with, in particular in the term "components".

Claims

A system (10) for autonomous vehicle guidance, comprising a plurality of electrical and / or electronic components,

wherein the components are designed to ^{interactively} perform an autonomous vehicle guidance, characterized in that

each of the components is associated with a first set (100) of components or a second set (200) of components,

wherein the components of the first set (100) are formed from ^{¬ to perform} an at least limited and / or temporary autonomous vehicle management even in case of failure of the components of the second set (200), and

wherein the components of the second set (200) are formed from ^{¬ lead} an at least limited and / or time-limited autonomous vehicle management durchzu ^¬ even in case of failure of the components of the first set (100).

System (10) according to claim 1,

characterized in that

the system (10) has a first vehicle electrical system (102) and a second vehicle electrical system (202),

wherein the first set (100) of components is connected to the first on-board network (102) and the second set (200) of components is connected to the second on-board network (202). System (10) according to claim 1 or 2,

characterized in that

the first set (100) of components comprises one or more of the following elements:

Device (110) for trajectory planning, device (120) for coarse localization, in particular by means of satellite navigation and / or dead reckoning,

Device (130) for determining input parameters for actuators (motion control),

Actuators (140), in particular steering, engine control, and / or brake,

Environment sensors (150, 160), in particular cameras, radars, Lidargeräte, ultrasonic sensors, temperature sensors, rain sensors and / or road condition sensors.

System (10) according to one of the preceding claims, characterized in that

the first set (100) of components comprises a camera (150) for determining input data for a location function.

System (10) according to claim 4,

characterized in that

it is in the input data for the localization ^¬ function to one or more of the following information:

Visual odometry (motion estimation), localization through simultaneous localization and imaging,

Estimation of pitch, roll and / or roll rate.

6. System (10) according to claim 4 or 5, characterized in that

a component (120) is designed to determine an absolute position based on visual landmarks by means of images or data supplied by the camera and preferably also by means of map data.

System (10) according to one of the preceding claims, characterized in that

the second set (200) of components comprises one or more of the following elements:

Antenna interface (210), in particular for

Vehicle-to-X communication (C2X communication), device (220) for on-track positioning and / or localization, in particular by means Sa ^¬ tellitennavigation, odometry, and / or landmarken- based positioning,

Vehicle-to-X communication (250)

(C2X communication means),

further device (230) for determining input parameters for actuators (backup motion control), further actuators (240) (backup actuators), in particular further steering (backup steering), further engine control (backup engine control) and / or others Brake (backup brake).

System (10) according to one of the preceding claims, characterized in that

the second set (200) having a plurality of environment sensors (260), in particular cameras, radar devices, lidar, Ultra ^¬ sound sensors, temperature sensors, rain sensors and / or road condition sensors.

System (10) according to one of the preceding claims, characterized in that the second set (200) having a plurality of driving dynamics sensors (270), in particular speed sensors, speed sensors ^¬, steering angle sensors, steering wheel angle sensors, acceleration sensors and / or rotational speed sensors.

System (10) according to one of the preceding claims, characterized in that

the system (10) is configured to transfer a vehicle (5) to a safe state in the event of failure of an electrical system (102, 202) or in the event of failure of at least one component.

System (10) according to claim 10,

characterized in that

the safe state is a transfer of the vehicle guidance to a driver, a reduction of the speed and / or a parking of the vehicle (5) on a space provided for this purpose, for example a side strip.

System (10) according to one of the preceding claims, characterized in that

at least one component of the second set (200) is designed to transmit data to at least one component of the first set (100) when both vehicle electrical systems (102, 202) are in operation and / or all components are operated.

System (10) according to claim 12,

characterized in that

the data transmitted by components of the second set (200) to components of the first set (100) is one or more of the following: Vehicle position in a global reference system, in particular WGS 84,

-track positioning, for example, to United ^¬ application in a digital map,

Information from a vehicle-to-X communication, for example

Traffic sign information,

Vehicle dynamics data of other vehicles, in particular of vorrausfahrenden, approaching or driving alongside vehicles with which stable convoy travel can be enabled, information about lane change intentions of other vehicles, in particular of vorrausfahrenden, approaching or driving alongside vehicles that affect their own lane, driving dynamics data, for example

Yaw rate and / or 3D yaw rate,

Acceleration and / or 3D acceleration, steering angle,

wheel speed,

Speed over ground,

Slip angle.

System (10) according to claim 12 or 13,

characterized in that

some or all of the information transmitted by components of the second set (200) to components of the first set (100) has a respective time stamp indicating the time of information capture.

15. System (10) according to claim 14,

characterized in that

the time stamp is generated using global time information, in particular time information obtained from satellite navigation.

16. System (10) according to one of claims 12 to 15,

characterized in that

the data transmitted by components of the second set (200) to components of the first set (100) include global time information, in particular time information obtained from satellite navigation.

17. System (10) according to claim 16,

characterized in that

the time information is transmitted to environment sensors (150, 160, 260) and the environment sensors (150, 160, 260) provide respective measured values with a time stamp based on the time information.

18. System (10) according to any one of claims 12 to 17,

characterized in that

at least one component of the first set (100) is adapted, in the event of a failure of the second on-board network (202) or at least one component of the second set (200), to have a trap planning using components of the second set (200) of components of the first set (100) provided information for a given

Period, preferably between 5 s and 10 s, perform.

19. System (10) according to one of the preceding claims,

characterized in that

at least one component (110) of the first set (100) is designed to operate when both vehicle electrical systems (102, 202) are in operation continuously transferring a trajectory planning to at least one component of the second set (200),

wherein at least one component (280) of the second set (200) is adapted to, in the event of failure of the first

On-board network (102) or components of the first set (100) using this Traj ektorienplanung autonomous driving for a certain period of time to operate.

System (10) according to claim 19,

characterized in that

in case of failure of the first electrical system (102) from a component (110) of the first set (100) received

Traj ektorienplanung is updated using data from a vehicle-to-X communication.

System (10) according to one of the preceding claims, characterized in that

at least one component (250) or a device not connected to the first on-board network (102) or the second on-board network (202) is designed to switch off in case of failure of the first on-board network (102) and / or the second on-board network (202) and / or individual Components via vehicle-to-X communication means (210, 250) to transmit one or more messages to other vehicles and / or infrastructure, the messages including the information that the vehicle (5) is in emergency mode.

System (10) according to one of the preceding claims, characterized in that

some or all of the data and / or information exchanged between the components has an integrity measure indicating the quality of the data and / or information. System (10) according to one of the preceding claims, characterized in that

supplying redundant location information to one or more components,

and / or that

the system (10) comprises a central component which executes a centrally monitoring algorithm and to which redundant localization information is supplied, the algorithm being adapted to execute an autonomous vehicle control or individual functions of an autonomous vehicle control even if one of the on-board systems (102, 202) or at least one Kom ^¬ component fails.

System (10) according to one of the preceding claims, characterized in that

the system (10) comprises one or more components (120, 220) for calculating a vehicle position in two ways, one based at least on vehicle dynamics data and satellite navigation data, and on the other based at least on camera data and preferably also on map data.

System (10) according to one of the preceding claims, characterized in that

the system (10) comprises one or more components (280) for merging vehicle dynamics data, satellite navigation data and camera data, as well as preferably also map data, and making available as fused information to other components.

System (10) according to one of the preceding claims, characterized in that the first vehicle electrical system (102) has a first power supply unit (104) and the second vehicle electrical system (202) has a second power supply unit (204),

wherein the first power supply unit (104) is connected to the supply Ver ^¬ to the first vehicle electrical system (102) components, and the second power supply unit (204) for supplying the second board to the network (202) connected components used,

further wherein the first vehicle electrical system (102) comprises a first battery (106), which takes over the power supply of the first vehicle electrical system (102) upon failure of the first Stromver ^¬ sorgungseinheit (104), and / or wherein the second vehicle electrical system (202) comprises a second battery (206), which in case of failure of the second power supply unit (204) takes over the power supply of the second electrical system (202).

System (10) according to claim 26,

characterized in that

this further comprises at least one battery management system (90), which is designed such that in the event of failure of the first power supply unit (104) and the first battery (106), the second battery (206) takes over the Stromver ^¬ supply of the first electrical system (102), and / or that in case of failure of the second power supply unit (204) and the second battery (206), the first battery (106) takes over the power supply of the second electrical system (202).

28 motor vehicle (5) having a system (10) for autonomous vehicle guidance according to one of the preceding claims.