WO2020164814A1

WO2020164814A1 - Method and control unit for operating an autonomous vehicle

Info

Publication number: WO2020164814A1
Application number: PCT/EP2020/050342
Authority: WO
Inventors: Steffen BIEL; Markus Birk; Carolin HELLER
Original assignee: Zf Friedrichshafen Ag
Priority date: 2019-02-11
Filing date: 2020-01-09
Publication date: 2020-08-20
Also published as: DE102019201689A1

Abstract

A control unit (20) for an autonomous or partly autonomous vehicle (10), comprising a processor (40) that is designed to obtain actual state data regarding the vehicle (1) via an interface (45) to a vehicle communication network (28) and to receive setpoint state data or control commands from a management system (100) via an interface (47) to a radio connection (37); to determine a deviation between the setpoint state data and the actual state data; and to actuate one or more vehicle components (12, 14, 16, 18) based on the deviation between the setpoint state data and the actual state data in order to achieve or to maintain a safe state of the vehicle (10).

Description

Method and control unit for operating an autonomous vehicle

TECHNICAL AREA

The present disclosure relates to the field of autonomous vehicles, in particular a control unit and a method for controlling an autonomous or partially autonomous vehicle in order to achieve or maintain a safe state of the vehicle.

TECHNICAL BACKGROUND

Autonomous or semi-autonomous vehicles have sensors which at least detect the area in front of the vehicle in the direction of travel and whose data are evaluated in a control unit by means of suitable software. On the basis of the information obtained through this data processing, a control unit can automatically trigger and carry out braking, speed, distance, compensation and / or evasive controls via appropriate actuators.

An autonomously moving vehicle, for example a driverless transport system (AGV), an autonomous car, a rail vehicle or a boat should be able to be monitored and remotely controlled at any time with the help of telemetry built into the vehicle or a similar physical radio link, taking functional safety into account. The aim is to protect the vehicle from property damage and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.

As a result of the EC Regulation No. 661/2009, emergency braking systems known as AEBS (Advanced Emergency Braking System) are increasingly being used in commercial vehicles, which when certain sensor data are available issue a warning signal and, if necessary, autonomously initiate emergency braking with the greatest possible deceleration of the vehicle, to avoid a collision with another vehicle, a person or a stationary obstacle, or at least to reduce the consequences of an impending collision. The operation of an autonomous vehicle should be as safe as possible even in unforeseen situations and when technical errors occur, incorrect behavior of other road users and bad weather conditions. Maintaining a safe condition at all times during a journey is necessary so that the vehicle does not pose any danger to passengers or other road users.

The present invention was developed with regard to the problematic described above, and it is the object of the present invention to realize a secured remote control for vehicles.

This object is achieved by the control unit according to claim 1, the control system according to claim 8, the control system according to claim 10, and the method for controlling an autonomous or partially autonomous vehicle according to claims 1 2 and 13. Further advantageous embodiments of the invention emerge from the subclaims Un and the following description of preferred exemplary embodiments of the present invention.

The exemplary embodiments show a control unit for an autonomous or partially autonomous vehicle, comprising a processor which is designed to receive actual status data relating to the vehicle via an interface to a vehicle communication network, via an interface to a radio link from a control system target status data or to receive control commands; to determine a deviation between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data to control one or more vehicle components in order to achieve or maintain a safe status of the vehicle.

The vehicle can in particular be a driverless autonomous vehicle or a partially autonomous vehicle. For example, it can be a land, air or water vehicle, for example a driverless transport system (AGV), an autonomous car, a rail vehicle, a drone or a boat. The status data relate to the status of the vehicle or the vehicle components. A state of the vehicle can in particular be understood to mean its position, location, direction of movement and speed. In the case of a watercraft, the condition of the vehicle can, for example, relate to the distance above ground.

The processor can be, for example, a computing unit such as a central processing unit (CPU = central processing unit) that executes program instructions.

The acquisition, checking and processing of the actual status data, for example the vehicle data (e.g. CAN or camera data) is preferably carried out in real time.

The connection between the control system and the vehicle can be secured separately / redundantly and the vehicle can be backed up to one immediately after an emergency has occurred, for example in the event of the radio connection being broken, a faulty vehicle status or faulty control data, or if a hazard is detected State to be transferred.

The processor of the control unit is also designed to send the actual status data to the control system via the radio link. In particular, the control unit enables secure transmission of vehicle status data (e.g. CAN data) and monitoring data via the radio link. For example, the actual status data sent to the control system can include image data that were captured with an image sensor integrated in the vehicle.

The actual status data can include, for example, a position, a speed, a steering angle, a yaw angle speed, a yaw rate, a position angle, a position angle acceleration, an acceleration and / or a transverse acceleration, or data from environment sensors. For example, the processor of the control unit can be designed to receive image data relating to a vehicle environment from an optical sensor integrated in the vehicle. The data supplied by the optical sensor can be processed and prepared by means of image processing and compared with predetermined image data in order to infer a critical driving situation. The optical cal sensor can be a camera or an infrared camera.

Furthermore, the processor of the control unit can be designed to detect a direction of movement of the vehicle. In this way, for example, an estimate can be made as to whether a predefined position range will be left if the current direction of movement is maintained. This information can be used to determine the current position of the vehicle when approaching the limits of the predetermined position range with a higher position determination frequency and to compare it with a predetermined target position. Thereby, a defective vehicle condition (defective position) can be detected with a minimum delay.

Furthermore, the control unit can be designed to recognize a critical driving situation on the basis of a yaw rate and / or a lateral acceleration of the vehicle detected by means of a sensor.

The actual state data can also include an actual trajectory and the control unit can be designed to recognize an error state on the basis of a comparison with a desired trajectory.

In addition, the control unit can be designed to receive information about a drive energy store and about the drive unit (e.g. functional information). Based on this information, the control unit can determine whether the achievement of the specified goal can be ensured. If this is not the case, a control command can be generated in order to bring the vehicle into a safe state. According to an exemplary embodiment of the present invention, the target status data can include a target position, a target orientation or control commands.

For example, the target state of the vehicle can be defined by a target position in a Cartesian coordinate system (x, y, z) and by a target orientation of the vehicle described by a position angle (roll, pitch, yaw).

Furthermore, the target status data can include a model-based image and the processor can be designed to recognize the discrepancy between the specified target status data and the actual status data on the basis of a model-based plausibility check.

The processor of the control unit can also be designed to evaluate time stamps that are received with the target status data. Using the time stamps, the control unit can recognize the point in time for which a control command was provided and, if necessary, discard or correct commands in order to compensate for a brief failure of the radio link.

Furthermore, the target status data that are received from the control system by the control unit according to the present invention can include information that defines a safe driving area. If the radio connection to the control system breaks down, the vehicle can continue to move in the safe driving area.

The exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising the control unit as described above, and an emergency stop control unit which is designed to send an activation signal for a safe condition of the vehicle via a second radio link received, and to control one or more vehicle components in response to the activation signal so that a safe state of the vehicle is achieved. In this way, a safe state of an autonomous vehicle is achieved without the involvement of a human driver using redundant and thus highly available systems.

The exemplary embodiments also show a vehicle, comprising a control unit or a control system as described above.

The exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising a processor which is designed to: send target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; To receive actual status data over the radio link from the control unit of the autonomous or semi-autonomous vehicle; to determine a discrepancy between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data, to control the control unit of the autonomous or semi-autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.

The processor of the control system can also be designed to control an emergency stop control unit in the autonomous or partially autonomous vehicle via a second radio link based on the deviation between the target status data and the actual status data or on the basis of a manual command in order to control the vehicle to transfer to a safe state.

The exemplary embodiments also show a method for controlling an autonomous or semi-autonomous vehicle, comprising the steps of: receiving, via an interface to a vehicle communication network, actual status data relating to the vehicle, receiving, via an interface to a radio link, from a control system from Target status data or control commands; Determining a discrepancy between the target status data and the actual status data; and control based on the deviation between the target status data and the Actual status data from one or more vehicle components in order to achieve or maintain a safe status of the vehicle.

The exemplary embodiments also show a method for managing an autonomous or partially autonomous vehicle, comprising the steps of: sending target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; Receiving actual status data via the radio link from the control unit of the autonomous or semi-autonomous vehicle; Be agree a deviation between the target status data and the actual status data; and control, based on the deviation between the target status data and the actual status data, from the control unit of the autonomous or partially autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.

The method can further include the step of activating, based on the discrepancy between the target status data and the actual status data or on the basis of a manual command, an emergency stop control unit in the autonomous or partially autonomous vehicle via a second radio link to the vehicle to transfer to a safe state.

Embodiments will now be described by way of example and with reference to the accompanying drawings, in which:

FIG. 1 is a block diagram schematically showing the configuration of an autonomous vehicle according to an embodiment of the present invention;

FIG. Figure 2 shows an autonomous vehicle according to the invention in communication via a radio link with an external server called a control room;

FIG. 3 is a block diagram showing an exemplary configuration of the safety control unit 20; FIGs. 4a, b and c illustrate an embodiment of a method according to the present invention, FIG. 4a shows the steps performed in the control room server, FIG. 4b shows the steps that are carried out in the safety control unit of the vehicle and FIG. Figure 4c shows the steps performed in the emergency stop control unit;

FIG. 5a shows a further embodiment of a method according to the present invention, showing the steps carried out in the control room server;

FIG. Fig. 5b shows a further embodiment of a method according to the present invention, showing the steps carried out in the control room server;

FIG. 6a shows an embodiment of the transmission of control commands from the control station to the safety control unit; and

FIG. 6b shows a further embodiment of the transmission of control commands from the control stand to the safety control unit.

FIG. 1 is a block diagram schematically showing the configuration of an autonomous vehicle 10 according to an embodiment of the present invention. The autonomous vehicle 10 comprises several electronic components which are connected to one another via a vehicle communication network 28. The vehicle communication network 28 can, for example, be a standard vehicle communication network built into the vehicle, such as a CAN bus (controller area network), a LIN bus (local interconnect network), a LAN bus (local area network), a MOST bus and / or a FlexRay bus (registered trade mark) or the like.

In the one shown in FIG. 1, the autonomous vehicle 10 comprises a control unit 12 (ECU 1) for a braking system. The braking system refers to the components that enable the vehicle to brake. The autonomous one Vehicle 10 further includes a control unit 14 (ECU 2) that controls a drive train. The drive train refers to the drive components of the vehicle. The drive train can include an engine, a transmission, a drive / propeller shaft, a differential, and a final drive. The autonomous vehicle 10 further includes a control unit 16 (ECU 3) that controls a steering system. The steering system refers to the components that enable directional control of the vehicle.

The control units 12, 14 and 16 can also receive vehicle operating parameters from the above-mentioned vehicle subsystems, which these record by means of one or more vehicle sensors. Vehicle sensors are preferably those sensors that detect a state of the vehicle or a state of vehicle parts, in particular their state of movement. The sensors may include a vehicle speed sensor, a yaw rate sensor, an acceleration sensor, a steering wheel angle sensor, a vehicle load sensor, temperature sensors, pressure sensors, and the like. For example, sensors can also be arranged along the brake line in order to output signals that indicate the brake fluid pressure at various points along the hydraulic brake line. Other sensors in the vicinity of the wheel can be provided, which detect the wheel speed and the brake pressure that is on the

Wheel is applied.

The vehicle sensor system of the autonomous vehicle 10 also includes a satellite navigation unit 24 (GNSS unit). It should be noted that, in the context of the present invention, GNSS stands for all global navigation satellite systems (GNSS), such as GPS, A-GPS, Galileo, GLONASS (Russia), Compass (China), IRNSS (India) and the like.

The autonomous vehicle 10 further comprises one or more sensors which are designed to detect the surroundings of the vehicle, the sensors being mounted on the vehicle and recording images of the surroundings of the vehicle or to detect objects or conditions in the surroundings of the vehicle. The environment sensors 26 include in particular cameras, radar sensors, lidar sensors, ultrasonic Sensors or the like. The environment sensors 26 can be arranged inside the vehicle or outside the vehicle (z. B. on the outside of the vehicle). For example, a camera can be provided in a front area of the vehicle 10 for recording images of an area in front of the vehicle.

The autonomous vehicle 10 further comprises an autonomous driving control unit 18 (ECU 4). The control unit for autonomous driving 18 is designed to control the autonomous vehicle 10 in such a way that it can act entirely or partially without the influence of a human driver. The control unit for autonomous driving 18 controls one or more vehicle subsystems while the vehicle is operated in the autonomous mode, namely the braking system 12, the drive system 14 and the steering system 16. For this purpose, the control unit for autonomous driving 18 can, for example, via the vehicle communication network 28 with the correspond to the control units 12, 14 and 16 communicate. The control unit for autonomous driving 18 comprises in particular an image processing system for carrying out image processing processes. The image processing processes are, for example, the processing of image data from the surroundings sensors 26, for example image data of an image of the area in front of the vehicle recorded by a camera in the direction of travel.

If an operating state for autonomous driving is activated on the control side or on the driver side, the control unit for autonomous driving 18 determines, on the basis of inputs such as data about a predetermined route, of data from the satellite navigation unit, of environmental data recorded by environmental sensors, and of by means of the vehicle sensors detected vehicle operating parameters that are fed to the control unit 18 by the control units 12, 14 and 16, parameters for the autonomous operation of the vehicle (for example, target speed, target torque, steering process and the like). The parameters can be used to control aspects of the vehicle subsystems, including the drive train, braking system and steering system, as well as auxiliary behavior (e.g. switching on the lights). The autonomous vehicle 10 also includes a safety control unit (safety ECU) 20, which is used to keep the vehicle in a safe state or to bring it into a safe state. The safety control unit 20 is a system-independent control unit in which vehicle data (for example CAN or camera data) are recorded, checked and processed in real time. The safety control unit 20 is also designed to pass on recorded data to a control station via a radio link (see FIG. 2) and to receive setpoint values or control commands from the control station. The safety control unit 20 is configured in such a way that when an error state is detected it generates control commands based on the recorded vehicle data in order to bring the vehicle into a safe state. If a deviation occurs, the safety control unit 20 controls the control units 12, 14, 16, 18 in such a way that the vehicle can automatically bring itself to a safe state (eg v = 0 km / h and the last successfully transferred steering angle) . The structure and functionality of the safety control unit 20 are shown in the exemplary embodiments in FIG. 2, FIG. 3, FIG. 4b and FIG. 5 described in more detail.

The autonomous vehicle 10 may further include an emergency stop control unit 30. The emergency stop control unit 30 is designed in such a way that it can be connected to an external central computer called a control station (hereinafter "server") via a radio link.

100 communicates and, when it receives an activation signal for a safe state of the vehicle from the control center, controls the autonomous control unit 18 or the control units 12, 14 and 16 of the vehicle so that the vehicle is in a safe state (e.g. v = 0 km / h and last successfully transmitted steering angle, see above) is transferred.

The autonomous vehicle 10 also includes a user interface 32 (HMI = human-machine interface) that enables a vehicle occupant to interact with one or more vehicle systems. This user interface 32 (for example a GUI = graphical user interface) can be an electronic display for outputting graphics, symbols and / or content in text form, and an input interface for receiving input (for example manual input, voice input and input using gestures, head - or eye movements) grasp. The input interface can, for example, include keyboards, switches, touch-sensitive screens (touchscreen), eye trackers and the like.

FIG. 2 shows an autonomous vehicle 10 according to the invention, which is connected via a radio link to an external central computer (hereinafter “server”) 100 referred to as a control station.

The autonomous vehicle 10 according to the invention comprises in particular an autonomous control unit (ECU 4) 18, a safety control unit (Safety-ECU) 20 and an emergency-off control unit (Notaus-ECU) 30. From a control station 100 (eg initiated by a control center employee or a software control system), a first radio connection 37 to the vehicle 10 is established. The radio module 34 integrated in the vehicle 10 establishes a connection to a system-independent safety ECU 20, in which vehicle data (e.g. CAN or camera data) are recorded, checked and processed in real time. The safety ECU 20 is designed to communicate with the control center 100 via the radio module 34. The safety ECU 20 is designed in such a way that it receives data such as target status data or control commands from the control center and transmits data such as actual status data (camera images, position, speed and the like) to the control center.

The control center 100 comprises a central computer (server) 110 and a communication interface, in the example shown, a radio module 130. The control center is designed to compare the actual current status data (actual status data) of the vehicle with specified target status data and to control the safety control unit 20 of the vehicle 10 based on a discrepancy between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle 10.

The control center is also designed to transmit an activation signal for a safe state of the vehicle via a second radio link 38 to an emergency stop control unit 30 in the vehicle if the actual status data of the vehicle deviate from the specified target status data, such as this in Fig. 4a and 5 is described by way of example. The actual status data are hereby transmitted from the safety ECU 20 of the vehicle 10 via the first communication interface 34 to the control center server 110.

The control station is also designed to transmit an activation signal for a safe condition of the vehicle to the emergency stop control unit 30 in the vehicle via the second radio connection 38 when the radio connection with the safety control is broken. If communication with the safety controller via the first radio link 37 fails, it is still possible to activate a safe state in the vehicle via the second radio link 38. The emergency stop control unit 30 is connected to the control station 100 via a second radio module 36 and is designed such that, when it receives an activation signal for a safe condition of the vehicle from the control station 100, it controls the control units 12, 14, 16, 18 controls the vehicle in such a way that the vehicle is brought into a safe state (e.g. v = 0 km / h and the last successfully transferred steering angle, see above). A radio connection to the vehicle 10 is thus also established via a second system that is independent of the safety ECU 20. In this way, when an error occurs, the vehicle 10 can be brought into a safe state by actuating an emergency stop switch. An employee in the control center can e.g. operate a hand transmitter. Furthermore, the control system can automatically recognize that the target specifications are incorrectly interpreted or implemented by the vehicle and then activate the emergency stop switch (see FIG. 4a and the corresponding description).

A hybrid communication system can advantageously be used for communication between the vehicle 10 and the control center 100. The communication between the vehicle 10 and the control center can, for example, through the joint integration of ad-hoc-based telecommunications standards according to IEEE 802.11, ETSI ITS-G5 in the 5.9 GHz range and the available standards for fully digital mobile networks, such as 3GPP Long Term Evolution (LTE) in the 800 MHz, 1800 MHz and 2600 MHz ranges. In order to increase the reliability, the two radio links 37, 38 preferably use different che technologies, for example different frequency bands, different transmission rates, or the like.

The safety ECU 20 according to the invention is designed to record vehicle state parameters (e.g. CAN or camera data) in real time, process them and initiate a corresponding vehicle reaction when an error state is detected, so that the vehicle automatically switches to a safe state brings. The safety ECU 20 is designed in particular to recognize, for example by comparing the actual status data with specified target status data, that an error status is present and in this case to report an instruction or an instructive action back to the autonomous control unit 18 in order to Put the vehicle in a safe condition. The safety ECU 20 is configured in particular in such a way that it detects deviations in the control system by comparing target and actual status data, for example between target and actual position.

Bringing the vehicle to a safe state can include, for example, one or more of the following measures: reducing the current speed, braking the vehicle with a maximum possible braking force, increasing safety distances, changes in the planning and execution of driving maneuvers (e.g. increased curve radii ) and stopping the vehicle in a safe place (e.g. hard shoulder of the motorway, side of the road, parking lot). Furthermore, for example, after a brief failure of the radio link, the safety control unit 20 can request the last control command from the control center again. In addition, other measures are conceivable, all of which aim to protect the vehicle from damage to property and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.

The safety ECU 20 can also be designed to provide an avoidance or attenuation reaction of the vehicle to one or more predefined error states. The predefined error states can correspond to critical driving situations or driving events that represent an impending safety risk. If the autonomous vehicle is controlled as expected, it may be that such conditions or events do not occur or only occur very rarely, so that the final control of the vehicle lies solely with the autonomous control unit 18, which enables the autonomous operation. However, if the safety ECU 20 detects that the target specifications are incorrectly interpreted or implemented by the vehicle, the safety ECU can determine the vehicle behavior independently of the control unit 18 for autonomous driving, for example by directly addressing vehicle actuators , or the control unit 18 makes specifications for autonomous driving, which these must be implemented.

The safety ECU can be designed, for example, by comparing the actual status data with specified target status data, a discrepancy between the data (for example, a safety distance that is too small) and thus a critical driving situation, for example an impending collision with a vehicle ahead or a stationary obstacle, and in this case autonomously initiate an emergency braking process with a maximum possible braking force or a maximum possible deceleration of the own vehicle in order to put the vehicle in a safe state or at least to reduce the consequences of a possible collision.

The safety ECU 20 is also designed to receive status data from the autonomous control unit via the vehicle communication bus (28 in FIG. 1) and / or from other vehicle components via the vehicle communication network 28. The safety ECU 20 can in particular be designed to receive inputs from the autonomous control unit 18. The inputs provided by the autonomous control unit 18 can correspond, for example, to a current position of the vehicle detected by the sensor unit 26, a speed, an acceleration, a steering angle and the like. Alternatively, the safety ECU 20 can also receive this information directly from the respective vehicle components.

The safety ECU 20 can determine or retrieve the current status data regularly at a predetermined frequency. The status data acquisition frequency can vary depending on the vehicle speed, e.g. B. the status data determination frequency can increase with increasing speed.

As an alternative to the one shown in FIG. 2, several safety ECUs can also be provided in the vehicle in order to implement a failover or a bypass of the autonomous control system (ECU4). The functionality of the safety ECU described here and the functionality of the control unit 18 for autonomous driving can also be implemented together in a common control unit.

FIG. 3 is a block diagram showing an exemplary configuration of the safety ECU (safety ECU) 20. The safety ECU can, for example, be a control device (electronic control unit ECU or electronic control module ECM). The safety ECU includes a processor 40. The processor 40 can be, for example, a computing unit such as a central processing unit (CPU) that executes program instructions. The safety ECU 20 further includes a memory and an input / output interface. The memory can consist of one or more non-transitory computer-readable media and comprises at least a program storage area and a data storage area. The program memory area and the data memory area can comprise combinations of different types of memory, for example read-only memory 43 (ROM) and random access memory 42 (RAM) (z. B. dyna mixed RAM ("DRAM"), synchronous DRAM ("SDRAM", etc.). Furthermore, the safety ECU can include an external storage drive 44, such as an external hard disk drive (HDD), a flash memory drive or a non-volatile solid-state drive (SSD). The safety ECU 20 further comprises a communication interface 45 via which the control unit can communicate with the vehicle communication network (28 in FIG. 1).

With reference to FIG. 4a, an exemplary method from the point of view of the control stand (100 in FIG. 2) is first described. The method can for example be carried out by a processor of the server (110 in FIG. 2) in the control room. In one Step S400 sends the control center via a first radio link (37 in FIG. 2) a target position to the safety ECU (20 in FIG. 2) of the vehicle (see FIG. 4b for the use of this information by the safety ECU) . In a step S402, the control center calls up an actual position from the safety ECU of the vehicle via the first radio link. In a step S404, the control center checks whether the actual position has been received from the safety ECU or not. If the actual position sent by the safety ECU has been correctly received in the control center (ie there is no failure of the radio link, for example), the process continues with step S406. In step S406, it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. It is determined that the difference between the target position and the actual position is the specified

If the threshold value S is not exceeded, the control center concludes from this that the target specifications have been correctly interpreted or implemented by the vehicle, and the process is restarted. If, on the other hand, it is determined that the difference exceeds the specified threshold value S, the control center concludes from this that the target specifications have been incorrectly interpreted or implemented by the vehicle, and the process continues with step S408. In a step S408, an activation signal for a safe state is transmitted to the emergency stop control unit (30 in FIG. 2) of the vehicle via a second radio link (38 in FIG. 2). The steps performed in the emergency stop control unit are described below with reference to FIG. 4c. If no actual position was received by the safety ECU in step S404, for example in the event of a break in the radio connection between the vehicle and the control center, the process goes directly to step S408 and an activation signal for a safe state is sent directly to the Transfer the emergency stop control unit of the vehicle.

The comparison of the target and actual state of the vehicle can be done with the help of a classic "WatchDog" functionality, for example. The threshold value S is either fixed in the control room (eg S = 2m), or can also be set dynamically in the control room as a function of other variables such as the speed of the vehicle or the like. An automated process for initiating an emergency stop process was described above. Alternatively, the target position and the actual position of the vehicle (and possibly also other information received from the vehicle) could also be displayed to a control center employee on a screen so that he or she can manually initiate an emergency stop if he considers this necessary.

With reference to FIG. 4b, an exemplary method from the perspective of the safety ECU (20 in FIG. 2) is described below. The method can be executed, for example, by a processor (40 in FIG. 3) of the safety ECU. In a step S450, the safety ECU sends the actual position of the vehicle to the control room server via the first radio link (cf. step S402 in FIG. 4a). In a step S452, the safety ECU receives the predefined setpoint position from the control room server via the first radio link (cf. step S400 in FIG. 4a). In a step S454 it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. It is determined that the difference between the target position and the actual position is the specified

Does not exceed the threshold value S, the safety-ECU concludes from this that the target specifications have been correctly interpreted or implemented by the vehicle, and the process is restarted. If, on the other hand, it is determined that the difference exceeds the specified threshold value S, the safety ECU concludes from this that the target specifications have been incorrectly interpreted or implemented by the vehicle and the process continues with step S456. In step S456, the safety ECU controls the autonomous control unit of the vehicle in such a way that the vehicle is brought into a safe state.

With reference to FIG. 4c, the method is described below from the point of view of the emergency stop control unit (30 in FIG. 2). In a step S480, the emergency stop control unit determines whether or not an activation signal for a safe state of the vehicle has been received from the control room server (cf. step S408 in FIG. 4a). If it is determined that no activation signal for a safe condition of the vehicle has been received, the process is restarted. If, on the other hand, it is determined that an activation signal for a safe state of the vehicle is received the emergency stop control unit controls the autonomous control unit of the vehicle in such a way that the vehicle is brought into a safe state.

With the embodiments of FIGS. 4a, b, and c, there is thus a redundant safety functionality, because should there be a problem with the radio connection to the safety ECU (radio connection 37 in FIG. 2), so that the safety ECU does not is even able to recognize or initiate a necessary emergency stop, the control center can still recognize this and an emergency stop can be initiated via the redundant radio connection (radio connection 38 in FIG. 2) to the emergency stop ECU of the vehicle .

FIG. 5a shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server. In a step S500, the control room server determines a target trajectory for the vehicle. In a step S502, the control center calls up an actual trajectory from the safety ECU of the vehicle via the first radio link. In a step S504, the control center also receives camera images from the safety ECU of the vehicle via the first radio link. In a step S506, the camera images are visualized together with the target and actual trajectories and, for example, are displayed on a screen. In this way, a control center employee can conveniently compare the actual vehicle status with the target status. According to the in FIG. The exemplary embodiment illustrated in FIG. 5a is thus used to check the plausibility of the vehicle state from camera images in which the target and actual trajectories of the vehicle are visualized.

FIG. 5b shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server. In a step S550, the control center server determines a target position and a target orientation (heading) for the vehicle. In a step S552, a model-based determination of an image of the surroundings takes place on the basis of the target position and the target orientation. In a step S554, the image is transmitted to the safety ECU of the vehicle. In this case, a model-based image of the vehicle environment is generated that corresponds to the target specifications of the control center. This image is transmitted from the control center to the safety ECU. This image transmission enables the plausibility of the vehicle-internal localization to be checked, for example by comparing the model-based image received from the control center with one or more images from the surroundings sensors (26 in FIG. 1), for example a camera. In other words, the vehicle status can also be compared with the aid of a model-based plausibility check. For example, street, building and landscape models can be used as they are known to those skilled in the art from navigation systems.

FIG. 6a shows an embodiment of the transmission of control commands from the control stand to the safety ECU. A first control command “target steering angle = - 90 °” (sharp left) is sent to the safety ECU. As additional information, the control command contains a time stamp 7:52:20, which specifies the time for which the control command is intended. Two seconds later, a second control command "Target steering angle = 0 °" (straight ahead) with a time stamp of 7:52:22 is sent to the Safety ECU. Then a third control command “target steering angle = + 90 °” (sharp right) with time stamp 7:52:23 is sent to the safety ECU. If the radio connection between the control center and the safety ECU is interrupted, commands from the control center or the communication device are temporarily stored for the duration of the failure and transmitted after the radio connection is re-established. Using the time stamp, the Safety-ECU can recognize the point in time for which a control command was intended and, if necessary, discard or correct commands in order to compensate for the brief failure of the radio link. Alternatively or additionally, positioning data can also be transmitted in this way.

FIG. 6b shows a further embodiment of the transmission of control commands from the control station to the safety ECU. A control command "target steering angle = - 10 °" is sent to the safety ECU. A "current" parameter indicates that this is a currently valid control command. At the same time as this control command is sent, a second control command “Target steering angle = - 8 °” is sent to the Safety ECU. A "previous" parameter indicates that this control command is a control command immediately preceding the current control command, ie the control command last sent by the control center. By comparison This previous control command with the control command present in the Safety-ECU, the Safety-ECU can recognize whether a consistent reception of control commands is taking place or whether control commands have possibly been lost due to transmission errors. Alternatively, control commands could also be provided with sequential numbers and the safety ECU could draw such conclusions based on the numbers of the commands received. Alternatively or additionally, positioning data can also be transmitted in this way.

The safety control unit 20 can furthermore be designed in such a way that it outputs an error on the basis of a predefined threshold value. If the deviation from an actual value to a previously received control command is above a defined threshold, then there is most likely a transmission error (e.g. steering angle previously 90 ° left, new steering angle 90 ° right). This situation can then be resolved by requesting the last control command again.

To ensure the consistency of the data, i.e. the control commands or setpoints from the control station to the safety control unit or of sensor data and vehicle information from the safety ECU to the control station, these could be transmitted and validated with the help of BlockChain technology.

As a further alternative, the control system defines a safe driving area (“Safety Area”) and transmits it to the vehicle. This transmission of a safety area by the control system enables certain paths to be blocked or restricted by the control system, for example. The definition of a virtual boundary can either be defined by the control system as a function of the position via GNSS technology (or other radio technologies such as WLAN or UWB) or it is dependent on environmental sensors that are built into the infrastructure of the environment. If the radio connection to the control room breaks down, the vehicle may continue to move in the given safety area. If the radio link fails over a longer period of time, further control can be implemented in a cascade-like manner by comparing it with vehicle data that has already been transmitted, including an emergency stop. For example, if the vehicle detects itself using a localization process that it is leaving a given safety area, it switches itself off (v = 0 km / h). For example a predicted (next expected) actual position is calculated based on the current vehicle speed and orientation (safety area position and head- ing) in order to predict where the vehicle will move. The target position (or target positions) specified by the safety area from the control center is then compared with the vehicle-internal calculation (predicted position). If, on the basis of a deviation between the target and the prediction, it is recognized that the vehicle is leaving the safety area, the vehicle switches off automatically. With this alternative, the wireless emergency stop switch can be saved if necessary.

Additionally or alternatively, a safety area can be dynamically defined around the vehicle itself. To define the safety area, virtual boundaries can be set up around the vehicle, for example with the aid of GNSS technology or data from environment sensors. Such a safety area located directly in front of the vehicle can, in particular, be blocked completely or broken down into partial areas for other vehicles. In this way, for example, a collision with other vehicles can be avoided. Such a dynamic safety area (virtual boundary) around the vehicle itself can also be monitored by the environment sensors on the vehicle. In the safety area, for example, obstacles, objects or other vehicles can be listed. The safety area or its sub-areas can also be used to trigger user-defined warning messages, e.g. information about speed limits or other safety instructions.

Related to autonomous vehicle

Control unit for steering system

Control unit for braking system

Control unit for drive train

Control unit for autonomous driving Safety control unit (Safety-ECU)

Satellite navigation unit

Sensor device

Vehicle communication network

Emergency Stop Control Unit (Emergency Stop ECU) user interface

Radio module of the safety ECU

Radio module of the emergency stop control unit first radio connection

second radio link

processor

RAM

ROM memory

Storage drive

Communication interface

Control room

Control room server

Control room radio module

Claims

1. Control unit (20) for an autonomous or partially autonomous vehicle (10), comprising a processor (40) which is designed to

to receive actual status data relating to the vehicle (10) via an interface (45) to a vehicle communication network (28),

via an interface (47) to a radio link (37) from a control system (100) to receive target status data or control commands;

to determine a discrepancy between the target status data and the actual status data; and

to control one or more vehicle components (12, 14, 16, 18) based on the deviation between the target state data and the actual state data in order to achieve or maintain a safe state of the vehicle (10).

2. Control unit (20) according to claim 1, wherein the processor (40) is designed to send the actual status data via the radio link (37) to the control system (100).

3. Control unit (20) according to claim 1 or 2, wherein the actual status data is a position, a speed, a steering angle, a yaw rate, a yaw rate, a position angle, a position angle acceleration, an acceleration and / or a lateral acceleration, or data from Surrounding sensors include.

4. Control unit (20) according to one of the preceding claims, wherein the target status data comprise a target position, a target orientation or control commands.

5. Control unit (20) according to one of the preceding claims, wherein the target status data comprise a model-based image and the processor (40) is designed to determine the deviation between the specified target status data and the actual status data on the basis of a model-based plausibility check to recognize.

6. Control unit (20) according to any one of the preceding claims, wherein the processor (40) is designed to evaluate time stamps that are received with the target status data.

7. Control unit (20) according to one of the preceding claims, wherein the target status data comprise information that defines a safe driving area.

8. Control system for an autonomous or partially autonomous vehicle (10) to summarize the control unit (20) according to one of the preceding claims, and an emergency control unit (30) which is designed to send an activation signal via a second radio link (38) to receive for a safe state of the vehicle, and in response to the activation signal to control one or more vehicle components (12, 14, 16, 18) so that a safe state of the vehicle is achieved.

9. A vehicle (10) comprising a control unit (20) according to any one of claims 1 to 7 or a control system according to claim 8.

10. Control system (100) for an autonomous or partially autonomous vehicle (10), comprising a processor (110) which is designed to:

To send target status data via a radio link (37) to a control unit (20) of an autonomous or partially autonomous vehicle (10);

Receiving actual status data via the radio link (37) from the control unit (20) of the autonomous or semi-autonomous vehicle (10);

to control the control unit (20) of the autonomous or semi-autonomous vehicle (10) via the radio link (37) based on the deviation between the target state data and the actual state data in order to achieve or maintain a safe state of the vehicle (10).

11. Control system (100) according to claim 10, wherein the processor (110) is further designed based on the deviation between the target status data and the actual status data or, on the basis of a manual command, to control an emergency stop control unit (30) in the autonomous or semi-autonomous vehicle (10) via a second radio link (38) in order to transfer the vehicle (10) to a safe state.

12. A method for controlling an autonomous or partially autonomous vehicle (10), comprising the steps:

Obtaining, via an interface (45) to a vehicle communication network (28), actual status data relating to the vehicle (1),

Receiving, via an interface (47) to a radio link (37), from a control system (100) of target status data or control commands;

Determining a discrepancy between the target status data and the actual status data; and

Activation of one or more vehicle components (12, 14, 16, 18) based on the deviation between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle (10).

13. A method for managing an autonomous or partially autonomous vehicle (10), comprising the steps:

Sending target status data via a radio link (37) to a control unit (20) of an autonomous or semi-autonomous vehicle (10);

Activation based on the deviation between the target status data and the actual status data from the control unit (20) of the autonomous or partially autonomous vehicle (10) via the radio link (37) in order to achieve a safe state of the vehicle (10) or to receive.

14. The method of claim 13, the method further comprising the step of:

Control, based on the deviation between the target status data and the actual status data or on the basis of a manual command, an emergency stop control unit (30) in the autonomous or partially autonomous vehicle (10) via a second radio link (38) to the vehicle (10 ) in a safe state.