WO2020164814A1 - Procédé et unité de commande pour faire fonctionner un véhicule autonome - Google Patents

Procédé et unité de commande pour faire fonctionner un véhicule autonome Download PDF

Info

Publication number
WO2020164814A1
WO2020164814A1 PCT/EP2020/050342 EP2020050342W WO2020164814A1 WO 2020164814 A1 WO2020164814 A1 WO 2020164814A1 EP 2020050342 W EP2020050342 W EP 2020050342W WO 2020164814 A1 WO2020164814 A1 WO 2020164814A1
Authority
WO
WIPO (PCT)
Prior art keywords
vehicle
status data
control unit
autonomous
control
Prior art date
Application number
PCT/EP2020/050342
Other languages
German (de)
English (en)
Inventor
Steffen BIEL
Markus Birk
Carolin HELLER
Original Assignee
Zf Friedrichshafen Ag
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Zf Friedrichshafen Ag filed Critical Zf Friedrichshafen Ag
Publication of WO2020164814A1 publication Critical patent/WO2020164814A1/fr

Links

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05D—SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES
    • G05D1/00—Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots
    • G05D1/0055—Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots with safety arrangements
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05D—SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES
    • G05D1/00—Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots
    • G05D1/02—Control of position or course in two dimensions
    • G05D1/021—Control of position or course in two dimensions specially adapted to land vehicles
    • G05D1/0276—Control of position or course in two dimensions specially adapted to land vehicles using signals provided by a source external to the vehicle
    • G05D1/028—Control of position or course in two dimensions specially adapted to land vehicles using signals provided by a source external to the vehicle using a RF signal
    • G05D1/0282—Control of position or course in two dimensions specially adapted to land vehicles using signals provided by a source external to the vehicle using a RF signal generated in a local control room

Definitions

  • the present disclosure relates to the field of autonomous vehicles, in particular a control unit and a method for controlling an autonomous or partially autonomous vehicle in order to achieve or maintain a safe state of the vehicle.
  • Autonomous or semi-autonomous vehicles have sensors which at least detect the area in front of the vehicle in the direction of travel and whose data are evaluated in a control unit by means of suitable software. On the basis of the information obtained through this data processing, a control unit can automatically trigger and carry out braking, speed, distance, compensation and / or evasive controls via appropriate actuators.
  • An autonomously moving vehicle for example a driverless transport system (AGV), an autonomous car, a rail vehicle or a boat should be able to be monitored and remotely controlled at any time with the help of telemetry built into the vehicle or a similar physical radio link, taking functional safety into account.
  • the aim is to protect the vehicle from property damage and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.
  • AEBS Advanced Emergency Braking System
  • the present invention was developed with regard to the problematic described above, and it is the object of the present invention to realize a secured remote control for vehicles.
  • control unit according to claim 1 the control system according to claim 8, the control system according to claim 10, and the method for controlling an autonomous or partially autonomous vehicle according to claims 1 2 and 13. Further advantageous embodiments of the invention emerge from the subclaims Un and the following description of preferred exemplary embodiments of the present invention.
  • the exemplary embodiments show a control unit for an autonomous or partially autonomous vehicle, comprising a processor which is designed to receive actual status data relating to the vehicle via an interface to a vehicle communication network, via an interface to a radio link from a control system target status data or to receive control commands; to determine a deviation between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data to control one or more vehicle components in order to achieve or maintain a safe status of the vehicle.
  • a control unit for an autonomous or partially autonomous vehicle comprising a processor which is designed to receive actual status data relating to the vehicle via an interface to a vehicle communication network, via an interface to a radio link from a control system target status data or to receive control commands; to determine a deviation between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data to control one or more vehicle components in order to achieve or maintain a safe status of the vehicle.
  • the vehicle can in particular be a driverless autonomous vehicle or a partially autonomous vehicle.
  • it can be a land, air or water vehicle, for example a driverless transport system (AGV), an autonomous car, a rail vehicle, a drone or a boat.
  • a state of the vehicle can in particular be understood to mean its position, location, direction of movement and speed.
  • the condition of the vehicle can, for example, relate to the distance above ground.
  • CPU central processing unit
  • the acquisition, checking and processing of the actual status data is preferably carried out in real time.
  • vehicle data e.g. CAN or camera data
  • connection between the control system and the vehicle can be secured separately / redundantly and the vehicle can be backed up to one immediately after an emergency has occurred, for example in the event of the radio connection being broken, a faulty vehicle status or faulty control data, or if a hazard is detected State to be transferred.
  • the processor of the control unit is also designed to send the actual status data to the control system via the radio link.
  • the control unit enables secure transmission of vehicle status data (e.g. CAN data) and monitoring data via the radio link.
  • vehicle status data e.g. CAN data
  • monitoring data via the radio link.
  • the actual status data sent to the control system can include image data that were captured with an image sensor integrated in the vehicle.
  • the actual status data can include, for example, a position, a speed, a steering angle, a yaw angle speed, a yaw rate, a position angle, a position angle acceleration, an acceleration and / or a transverse acceleration, or data from environment sensors.
  • the processor of the control unit can be designed to receive image data relating to a vehicle environment from an optical sensor integrated in the vehicle.
  • the data supplied by the optical sensor can be processed and prepared by means of image processing and compared with predetermined image data in order to infer a critical driving situation.
  • the optical cal sensor can be a camera or an infrared camera.
  • the processor of the control unit can be designed to detect a direction of movement of the vehicle. In this way, for example, an estimate can be made as to whether a predefined position range will be left if the current direction of movement is maintained. This information can be used to determine the current position of the vehicle when approaching the limits of the predetermined position range with a higher position determination frequency and to compare it with a predetermined target position. Thereby, a defective vehicle condition (defective position) can be detected with a minimum delay.
  • control unit can be designed to recognize a critical driving situation on the basis of a yaw rate and / or a lateral acceleration of the vehicle detected by means of a sensor.
  • the actual state data can also include an actual trajectory and the control unit can be designed to recognize an error state on the basis of a comparison with a desired trajectory.
  • control unit can be designed to receive information about a drive energy store and about the drive unit (e.g. functional information). Based on this information, the control unit can determine whether the achievement of the specified goal can be ensured. If this is not the case, a control command can be generated in order to bring the vehicle into a safe state.
  • the target status data can include a target position, a target orientation or control commands.
  • the target state of the vehicle can be defined by a target position in a Cartesian coordinate system (x, y, z) and by a target orientation of the vehicle described by a position angle (roll, pitch, yaw).
  • the target status data can include a model-based image and the processor can be designed to recognize the discrepancy between the specified target status data and the actual status data on the basis of a model-based plausibility check.
  • the processor of the control unit can also be designed to evaluate time stamps that are received with the target status data. Using the time stamps, the control unit can recognize the point in time for which a control command was provided and, if necessary, discard or correct commands in order to compensate for a brief failure of the radio link.
  • the target status data that are received from the control system by the control unit according to the present invention can include information that defines a safe driving area. If the radio connection to the control system breaks down, the vehicle can continue to move in the safe driving area.
  • the exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising the control unit as described above, and an emergency stop control unit which is designed to send an activation signal for a safe condition of the vehicle via a second radio link received, and to control one or more vehicle components in response to the activation signal so that a safe state of the vehicle is achieved.
  • a safe state of an autonomous vehicle is achieved without the involvement of a human driver using redundant and thus highly available systems.
  • the exemplary embodiments also show a vehicle, comprising a control unit or a control system as described above.
  • the exemplary embodiments also show a control system for an autonomous or partially autonomous vehicle, comprising a processor which is designed to: send target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; To receive actual status data over the radio link from the control unit of the autonomous or semi-autonomous vehicle; to determine a discrepancy between the target status data and the actual status data; and based on the deviation between the target status data and the actual status data, to control the control unit of the autonomous or semi-autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.
  • the processor of the control system can also be designed to control an emergency stop control unit in the autonomous or partially autonomous vehicle via a second radio link based on the deviation between the target status data and the actual status data or on the basis of a manual command in order to control the vehicle to transfer to a safe state.
  • the exemplary embodiments also show a method for controlling an autonomous or semi-autonomous vehicle, comprising the steps of: receiving, via an interface to a vehicle communication network, actual status data relating to the vehicle, receiving, via an interface to a radio link, from a control system from Target status data or control commands; Determining a discrepancy between the target status data and the actual status data; and control based on the deviation between the target status data and the Actual status data from one or more vehicle components in order to achieve or maintain a safe status of the vehicle.
  • the exemplary embodiments also show a method for managing an autonomous or partially autonomous vehicle, comprising the steps of: sending target status data via a radio link to a control unit of an autonomous or partially autonomous vehicle; Receiving actual status data via the radio link from the control unit of the autonomous or semi-autonomous vehicle; Be agree a deviation between the target status data and the actual status data; and control, based on the deviation between the target status data and the actual status data, from the control unit of the autonomous or partially autonomous vehicle via the radio link in order to achieve or maintain a safe status of the vehicle.
  • the method can further include the step of activating, based on the discrepancy between the target status data and the actual status data or on the basis of a manual command, an emergency stop control unit in the autonomous or partially autonomous vehicle via a second radio link to the vehicle to transfer to a safe state.
  • FIG. 1 is a block diagram schematically showing the configuration of an autonomous vehicle according to an embodiment of the present invention
  • FIG. Figure 2 shows an autonomous vehicle according to the invention in communication via a radio link with an external server called a control room;
  • FIG. 3 is a block diagram showing an exemplary configuration of the safety control unit 20;
  • FIGs. 4a, b and c illustrate an embodiment of a method according to the present invention, FIG. 4a shows the steps performed in the control room server, FIG. 4b shows the steps that are carried out in the safety control unit of the vehicle and FIG. Figure 4c shows the steps performed in the emergency stop control unit;
  • FIG. 5a shows a further embodiment of a method according to the present invention, showing the steps carried out in the control room server
  • FIG. Fig. 5b shows a further embodiment of a method according to the present invention, showing the steps carried out in the control room server;
  • FIG. 6a shows an embodiment of the transmission of control commands from the control station to the safety control unit
  • FIG. 6b shows a further embodiment of the transmission of control commands from the control stand to the safety control unit.
  • FIG. 1 is a block diagram schematically showing the configuration of an autonomous vehicle 10 according to an embodiment of the present invention.
  • the autonomous vehicle 10 comprises several electronic components which are connected to one another via a vehicle communication network 28.
  • the vehicle communication network 28 can, for example, be a standard vehicle communication network built into the vehicle, such as a CAN bus (controller area network), a LIN bus (local interconnect network), a LAN bus (local area network), a MOST bus and / or a FlexRay bus (registered trade mark) or the like.
  • the autonomous vehicle 10 comprises a control unit 12 (ECU 1) for a braking system.
  • the braking system refers to the components that enable the vehicle to brake.
  • the autonomous one Vehicle 10 further includes a control unit 14 (ECU 2) that controls a drive train.
  • the drive train refers to the drive components of the vehicle.
  • the drive train can include an engine, a transmission, a drive / propeller shaft, a differential, and a final drive.
  • the autonomous vehicle 10 further includes a control unit 16 (ECU 3) that controls a steering system.
  • the steering system refers to the components that enable directional control of the vehicle.
  • the control units 12, 14 and 16 can also receive vehicle operating parameters from the above-mentioned vehicle subsystems, which these record by means of one or more vehicle sensors.
  • Vehicle sensors are preferably those sensors that detect a state of the vehicle or a state of vehicle parts, in particular their state of movement.
  • the sensors may include a vehicle speed sensor, a yaw rate sensor, an acceleration sensor, a steering wheel angle sensor, a vehicle load sensor, temperature sensors, pressure sensors, and the like.
  • sensors can also be arranged along the brake line in order to output signals that indicate the brake fluid pressure at various points along the hydraulic brake line. Other sensors in the vicinity of the wheel can be provided, which detect the wheel speed and the brake pressure that is on the
  • the vehicle sensor system of the autonomous vehicle 10 also includes a satellite navigation unit 24 (GNSS unit).
  • GNSS stands for all global navigation satellite systems (GNSS), such as GPS, A-GPS, Galileo, GLONASS ( Russia), Compass (China), IRNSS (India) and the like.
  • the autonomous vehicle 10 further comprises one or more sensors which are designed to detect the surroundings of the vehicle, the sensors being mounted on the vehicle and recording images of the surroundings of the vehicle or to detect objects or conditions in the surroundings of the vehicle.
  • the environment sensors 26 include in particular cameras, radar sensors, lidar sensors, ultrasonic Sensors or the like.
  • the environment sensors 26 can be arranged inside the vehicle or outside the vehicle (z. B. on the outside of the vehicle).
  • a camera can be provided in a front area of the vehicle 10 for recording images of an area in front of the vehicle.
  • the autonomous vehicle 10 further comprises an autonomous driving control unit 18 (ECU 4).
  • the control unit for autonomous driving 18 is designed to control the autonomous vehicle 10 in such a way that it can act entirely or partially without the influence of a human driver.
  • the control unit for autonomous driving 18 controls one or more vehicle subsystems while the vehicle is operated in the autonomous mode, namely the braking system 12, the drive system 14 and the steering system 16.
  • the control unit for autonomous driving 18 can, for example, via the vehicle communication network 28 with the correspond to the control units 12, 14 and 16 communicate.
  • the control unit for autonomous driving 18 comprises in particular an image processing system for carrying out image processing processes.
  • the image processing processes are, for example, the processing of image data from the surroundings sensors 26, for example image data of an image of the area in front of the vehicle recorded by a camera in the direction of travel.
  • the control unit for autonomous driving 18 determines, on the basis of inputs such as data about a predetermined route, of data from the satellite navigation unit, of environmental data recorded by environmental sensors, and of by means of the vehicle sensors detected vehicle operating parameters that are fed to the control unit 18 by the control units 12, 14 and 16, parameters for the autonomous operation of the vehicle (for example, target speed, target torque, steering process and the like).
  • the parameters can be used to control aspects of the vehicle subsystems, including the drive train, braking system and steering system, as well as auxiliary behavior (e.g. switching on the lights).
  • the autonomous vehicle 10 also includes a safety control unit (safety ECU) 20, which is used to keep the vehicle in a safe state or to bring it into a safe state.
  • the safety control unit 20 is a system-independent control unit in which vehicle data (for example CAN or camera data) are recorded, checked and processed in real time.
  • vehicle data for example CAN or camera data
  • the safety control unit 20 is also designed to pass on recorded data to a control station via a radio link (see FIG. 2) and to receive setpoint values or control commands from the control station.
  • the safety control unit 20 is configured in such a way that when an error state is detected it generates control commands based on the recorded vehicle data in order to bring the vehicle into a safe state.
  • the structure and functionality of the safety control unit 20 are shown in the exemplary embodiments in FIG. 2, FIG. 3, FIG. 4b and FIG. 5 described in more detail.
  • the autonomous vehicle 10 may further include an emergency stop control unit 30.
  • the emergency stop control unit 30 is designed in such a way that it can be connected to an external central computer called a control station (hereinafter "server") via a radio link.
  • server a control station
  • v 0 km / h and last successfully transmitted steering angle, see above
  • the input interface can, for example, include keyboards, switches, touch-sensitive screens (touchscreen), eye trackers and the like.
  • FIG. 2 shows an autonomous vehicle 10 according to the invention, which is connected via a radio link to an external central computer (hereinafter “server”) 100 referred to as a control station.
  • server an external central computer
  • the autonomous vehicle 10 comprises in particular an autonomous control unit (ECU 4) 18, a safety control unit (Safety-ECU) 20 and an emergency-off control unit (Notaus-ECU) 30.
  • ECU 4 autonomous control unit
  • Safety-ECU safety control unit
  • Notaus-ECU emergency-off control unit
  • a control station 100 e.g initiated by a control center employee or a software control system
  • a first radio connection 37 to the vehicle 10 is established.
  • the radio module 34 integrated in the vehicle 10 establishes a connection to a system-independent safety ECU 20, in which vehicle data (e.g. CAN or camera data) are recorded, checked and processed in real time.
  • vehicle data e.g. CAN or camera data
  • the safety ECU 20 is designed to communicate with the control center 100 via the radio module 34.
  • the safety ECU 20 is designed in such a way that it receives data such as target status data or control commands from the control center and transmits data such as actual status data (camera images, position, speed and the
  • the control center 100 comprises a central computer (server) 110 and a communication interface, in the example shown, a radio module 130.
  • the control center is designed to compare the actual current status data (actual status data) of the vehicle with specified target status data and to control the safety control unit 20 of the vehicle 10 based on a discrepancy between the target status data and the actual status data in order to achieve or maintain a safe status of the vehicle 10.
  • the control center is also designed to transmit an activation signal for a safe state of the vehicle via a second radio link 38 to an emergency stop control unit 30 in the vehicle if the actual status data of the vehicle deviate from the specified target status data, such as this in Fig. 4a and 5 is described by way of example.
  • the actual status data are hereby transmitted from the safety ECU 20 of the vehicle 10 via the first communication interface 34 to the control center server 110.
  • the control station is also designed to transmit an activation signal for a safe condition of the vehicle to the emergency stop control unit 30 in the vehicle via the second radio connection 38 when the radio connection with the safety control is broken. If communication with the safety controller via the first radio link 37 fails, it is still possible to activate a safe state in the vehicle via the second radio link 38.
  • a radio connection to the vehicle 10 is thus also established via a second system that is independent of the safety ECU 20.
  • the vehicle 10 can be brought into a safe state by actuating an emergency stop switch.
  • An employee in the control center can e.g. operate a hand transmitter.
  • the control system can automatically recognize that the target specifications are incorrectly interpreted or implemented by the vehicle and then activate the emergency stop switch (see FIG. 4a and the corresponding description).
  • a hybrid communication system can advantageously be used for communication between the vehicle 10 and the control center 100.
  • the communication between the vehicle 10 and the control center can, for example, through the joint integration of ad-hoc-based telecommunications standards according to IEEE 802.11, ETSI ITS-G5 in the 5.9 GHz range and the available standards for fully digital mobile networks, such as 3GPP Long Term Evolution (LTE) in the 800 MHz, 1800 MHz and 2600 MHz ranges.
  • LTE Long Term Evolution
  • the two radio links 37, 38 preferably use different che technologies, for example different frequency bands, different transmission rates, or the like.
  • the safety ECU 20 is designed to record vehicle state parameters (e.g. CAN or camera data) in real time, process them and initiate a corresponding vehicle reaction when an error state is detected, so that the vehicle automatically switches to a safe state brings.
  • vehicle state parameters e.g. CAN or camera data
  • the safety ECU 20 is designed in particular to recognize, for example by comparing the actual status data with specified target status data, that an error status is present and in this case to report an instruction or an instructive action back to the autonomous control unit 18 in order to Put the vehicle in a safe condition.
  • the safety ECU 20 is configured in particular in such a way that it detects deviations in the control system by comparing target and actual status data, for example between target and actual position.
  • Bringing the vehicle to a safe state can include, for example, one or more of the following measures: reducing the current speed, braking the vehicle with a maximum possible braking force, increasing safety distances, changes in the planning and execution of driving maneuvers (e.g. increased curve radii ) and stopping the vehicle in a safe place (e.g. hard shoulder of the motorway, side of the road, parking lot).
  • a safe place e.g. hard shoulder of the motorway, side of the road, parking lot.
  • the safety control unit 20 can request the last control command from the control center again.
  • other measures are conceivable, all of which aim to protect the vehicle from damage to property and its surroundings (e.g. people, obstacles, objects or other vehicles) from damage.
  • the safety ECU 20 can also be designed to provide an avoidance or attenuation reaction of the vehicle to one or more predefined error states.
  • the predefined error states can correspond to critical driving situations or driving events that represent an impending safety risk. If the autonomous vehicle is controlled as expected, it may be that such conditions or events do not occur or only occur very rarely, so that the final control of the vehicle lies solely with the autonomous control unit 18, which enables the autonomous operation. However, if the safety ECU 20 detects that the target specifications are incorrectly interpreted or implemented by the vehicle, the safety ECU can determine the vehicle behavior independently of the control unit 18 for autonomous driving, for example by directly addressing vehicle actuators , or the control unit 18 makes specifications for autonomous driving, which these must be implemented.
  • the safety ECU can be designed, for example, by comparing the actual status data with specified target status data, a discrepancy between the data (for example, a safety distance that is too small) and thus a critical driving situation, for example an impending collision with a vehicle ahead or a stationary obstacle, and in this case autonomously initiate an emergency braking process with a maximum possible braking force or a maximum possible deceleration of the own vehicle in order to put the vehicle in a safe state or at least to reduce the consequences of a possible collision.
  • a critical driving situation for example an impending collision with a vehicle ahead or a stationary obstacle
  • the safety ECU 20 is also designed to receive status data from the autonomous control unit via the vehicle communication bus (28 in FIG. 1) and / or from other vehicle components via the vehicle communication network 28.
  • the safety ECU 20 can in particular be designed to receive inputs from the autonomous control unit 18.
  • the inputs provided by the autonomous control unit 18 can correspond, for example, to a current position of the vehicle detected by the sensor unit 26, a speed, an acceleration, a steering angle and the like.
  • the safety ECU 20 can also receive this information directly from the respective vehicle components.
  • the safety ECU 20 can determine or retrieve the current status data regularly at a predetermined frequency.
  • the status data acquisition frequency can vary depending on the vehicle speed, e.g. B. the status data determination frequency can increase with increasing speed.
  • safety ECUs can also be provided in the vehicle in order to implement a failover or a bypass of the autonomous control system (ECU4).
  • ECU4 autonomous control system
  • the functionality of the safety ECU described here and the functionality of the control unit 18 for autonomous driving can also be implemented together in a common control unit.
  • FIG. 3 is a block diagram showing an exemplary configuration of the safety ECU (safety ECU) 20.
  • the safety ECU can, for example, be a control device (electronic control unit ECU or electronic control module ECM).
  • the safety ECU includes a processor 40.
  • the processor 40 can be, for example, a computing unit such as a central processing unit (CPU) that executes program instructions.
  • the safety ECU 20 further includes a memory and an input / output interface.
  • the memory can consist of one or more non-transitory computer-readable media and comprises at least a program storage area and a data storage area.
  • the program memory area and the data memory area can comprise combinations of different types of memory, for example read-only memory 43 (ROM) and random access memory 42 (RAM) (z. B.
  • the safety ECU can include an external storage drive 44, such as an external hard disk drive (HDD), a flash memory drive or a non-volatile solid-state drive (SSD).
  • the safety ECU 20 further comprises a communication interface 45 via which the control unit can communicate with the vehicle communication network (28 in FIG. 1).
  • Step S400 sends the control center via a first radio link (37 in FIG. 2) a target position to the safety ECU (20 in FIG. 2) of the vehicle (see FIG. 4b for the use of this information by the safety ECU) .
  • Step S402 the control center calls up an actual position from the safety ECU of the vehicle via the first radio link.
  • step S404 the control center checks whether the actual position has been received from the safety ECU or not.
  • step S406 it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. It is determined that the difference between the target position and the actual position is the specified
  • step S408 an activation signal for a safe state is transmitted to the emergency stop control unit (30 in FIG. 2) of the vehicle via a second radio link (38 in FIG. 2). The steps performed in the emergency stop control unit are described below with reference to FIG. 4c.
  • step S404 If no actual position was received by the safety ECU in step S404, for example in the event of a break in the radio connection between the vehicle and the control center, the process goes directly to step S408 and an activation signal for a safe state is sent directly to the Transfer the emergency stop control unit of the vehicle.
  • the comparison of the target and actual state of the vehicle can be done with the help of a classic "WatchDog" functionality, for example.
  • a processor (40 in FIG. 3) of the safety ECU executes, for example, by a processor (40 in FIG. 3) of the safety ECU.
  • the safety ECU sends the actual position of the vehicle to the control room server via the first radio link (cf. step S402 in FIG. 4a).
  • the safety ECU receives the predefined setpoint position from the control room server via the first radio link (cf. step S400 in FIG. 4a).
  • a step S454 it is determined whether the difference between the target position and the actual position exceeds a predetermined threshold value S or not. It is determined that the difference between the target position and the actual position is the specified
  • step S456 the safety ECU controls the autonomous control unit of the vehicle in such a way that the vehicle is brought into a safe state.
  • the emergency stop control unit determines whether or not an activation signal for a safe state of the vehicle has been received from the control room server (cf. step S408 in FIG. 4a). If it is determined that no activation signal for a safe condition of the vehicle has been received, the process is restarted. If, on the other hand, it is determined that an activation signal for a safe state of the vehicle is received the emergency stop control unit controls the autonomous control unit of the vehicle in such a way that the vehicle is brought into a safe state.
  • FIG. 5a shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server.
  • the control room server determines a target trajectory for the vehicle.
  • the control center calls up an actual trajectory from the safety ECU of the vehicle via the first radio link.
  • the control center also receives camera images from the safety ECU of the vehicle via the first radio link.
  • the camera images are visualized together with the target and actual trajectories and, for example, are displayed on a screen. In this way, a control center employee can conveniently compare the actual vehicle status with the target status.
  • the exemplary embodiment illustrated in FIG. 5a is thus used to check the plausibility of the vehicle state from camera images in which the target and actual trajectories of the vehicle are visualized.
  • FIG. 5b shows a further embodiment of a method according to the present invention, showing the steps that are carried out in the control room server.
  • the control center server determines a target position and a target orientation (heading) for the vehicle.
  • a model-based determination of an image of the surroundings takes place on the basis of the target position and the target orientation.
  • the image is transmitted to the safety ECU of the vehicle. In this case, a model-based image of the vehicle environment is generated that corresponds to the target specifications of the control center. This image is transmitted from the control center to the safety ECU.
  • This image transmission enables the plausibility of the vehicle-internal localization to be checked, for example by comparing the model-based image received from the control center with one or more images from the surroundings sensors (26 in FIG. 1), for example a camera.
  • the vehicle status can also be compared with the aid of a model-based plausibility check.
  • street, building and landscape models can be used as they are known to those skilled in the art from navigation systems.
  • FIG. 6a shows an embodiment of the transmission of control commands from the control stand to the safety ECU.
  • the control command contains a time stamp 7:52:20, which specifies the time for which the control command is intended.
  • the Safety-ECU can recognize the point in time for which a control command was intended and, if necessary, discard or correct commands in order to compensate for the brief failure of the radio link. Alternatively or additionally, positioning data can also be transmitted in this way.
  • FIG. 6b shows a further embodiment of the transmission of control commands from the control station to the safety ECU.
  • a "current” parameter indicates that this is a currently valid control command.
  • a "previous” parameter indicates that this control command is a control command immediately preceding the current control command, ie the control command last sent by the control center.
  • the Safety-ECU can recognize whether a consistent reception of control commands is taking place or whether control commands have possibly been lost due to transmission errors.
  • control commands could also be provided with sequential numbers and the safety ECU could draw such conclusions based on the numbers of the commands received.
  • positioning data can also be transmitted in this way.
  • the safety control unit 20 can furthermore be designed in such a way that it outputs an error on the basis of a predefined threshold value. If the deviation from an actual value to a previously received control command is above a defined threshold, then there is most likely a transmission error (e.g. steering angle previously 90 ° left, new steering angle 90 ° right). This situation can then be resolved by requesting the last control command again.
  • a transmission error e.g. steering angle previously 90 ° left, new steering angle 90 ° right
  • control commands or setpoints from the control station to the safety control unit or of sensor data and vehicle information from the safety ECU to the control station could be transmitted and validated with the help of BlockChain technology.
  • the control system defines a safe driving area (“Safety Area”) and transmits it to the vehicle.
  • This transmission of a safety area by the control system enables certain paths to be blocked or restricted by the control system, for example.
  • the definition of a virtual boundary can either be defined by the control system as a function of the position via GNSS technology (or other radio technologies such as WLAN or UWB) or it is dependent on environmental sensors that are built into the infrastructure of the environment. If the radio connection to the control room breaks down, the vehicle may continue to move in the given safety area. If the radio link fails over a longer period of time, further control can be implemented in a cascade-like manner by comparing it with vehicle data that has already been transmitted, including an emergency stop.
  • the target position (or target positions) specified by the safety area from the control center is then compared with the vehicle-internal calculation (predicted position). If, on the basis of a deviation between the target and the prediction, it is recognized that the vehicle is leaving the safety area, the vehicle switches off automatically. With this alternative, the wireless emergency stop switch can be saved if necessary.
  • a safety area can be dynamically defined around the vehicle itself.
  • virtual boundaries can be set up around the vehicle, for example with the aid of GNSS technology or data from environment sensors.
  • a safety area located directly in front of the vehicle can, in particular, be blocked completely or broken down into partial areas for other vehicles. In this way, for example, a collision with other vehicles can be avoided.
  • Such a dynamic safety area (virtual boundary) around the vehicle itself can also be monitored by the environment sensors on the vehicle. In the safety area, for example, obstacles, objects or other vehicles can be listed.
  • the safety area or its sub-areas can also be used to trigger user-defined warning messages, e.g. information about speed limits or other safety instructions.
  • Safety-ECU Safety-ECU
  • Radio module of the emergency stop control unit first radio connection

Landscapes

  • Engineering & Computer Science (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Remote Sensing (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Traffic Control Systems (AREA)
  • Control Of Driving Devices And Active Controlling Of Vehicle (AREA)

Abstract

L'invention concerne une unité de commande (20) pour un véhicule (10) autonome ou partiellement autonome, comprenant un processeur (40) qui est conçu pour obtenir des données d'état réelles relatives au véhicule (1) par le biais d'une interface (45) avec un réseau de communication de véhicule (28), pour recevoir des données d'état de consigne ou des instructions de commande de la part d'un système de commande (100) par le biais d'une interface (47) avec une liaison radio (37), pour déterminer un écart entre les données d'état de consigne et les données d'état réelles et, en fonction de l'écart entre les données d'état de consigne et les données d'état réelles, pour commander un ou plusieurs composants du véhicule (12, 14, 16, 18) en vue d'atteindre ou de maintenir un état sécurisé du véhicule (10).
PCT/EP2020/050342 2019-02-11 2020-01-09 Procédé et unité de commande pour faire fonctionner un véhicule autonome WO2020164814A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102019201689.8 2019-02-11
DE102019201689.8A DE102019201689A1 (de) 2019-02-11 2019-02-11 Verfahren und Steuereinheit zum Betreiben eines autonomen Fahrzeugs

Publications (1)

Publication Number Publication Date
WO2020164814A1 true WO2020164814A1 (fr) 2020-08-20

Family

ID=69157847

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2020/050342 WO2020164814A1 (fr) 2019-02-11 2020-01-09 Procédé et unité de commande pour faire fonctionner un véhicule autonome

Country Status (2)

Country Link
DE (1) DE102019201689A1 (fr)
WO (1) WO2020164814A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220185328A1 (en) * 2020-12-11 2022-06-16 Toyota Jidosha Kabushiki Kaisha Control device and control method for vehicle

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102022001241A1 (de) * 2022-04-12 2023-10-12 Mercedes-Benz Group AG Verfahren zum Betrieb eines Fahrzeugs
DE102022205944A1 (de) 2022-06-13 2023-12-14 Robert Bosch Gesellschaft mit beschränkter Haftung Verfahren zum Betreiben einer Robotervorrichtung

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10000919A1 (de) * 2000-01-12 2001-07-19 Volkswagen Ag Verfahren und Vorrichtung zur Überwachung eines autonom fahrenden Kraftfahrzeugs mit Hilfe einer Leitzentrale
DE102012222562A1 (de) * 2012-12-07 2014-06-12 Robert Bosch Gmbh System für bewirtschaftete Parkflächen zur Überführung eines Fahrzeugs von einer Startposition in eine Zielposition
US20180339703A1 (en) * 2017-05-26 2018-11-29 Sucxess LLC Vehicle with remote-controlled operating mode

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9494935B2 (en) * 2014-11-13 2016-11-15 Toyota Motor Engineering & Manufacturing North America, Inc. Remote operation of autonomous vehicle in unexpected environment
DE102015208053A1 (de) * 2015-04-30 2016-11-03 Robert Bosch Gmbh Verfahren und Vorrichtung zum Verringern einer Gefährdung für ein und/oder durch ein sich auf einem Parkplatz befindendes Fahrzeug
US20160363647A1 (en) * 2015-06-15 2016-12-15 GM Global Technology Operations LLC Vehicle positioning in intersection using visual cues, stationary objects, and gps
DE102017210859A1 (de) * 2017-06-28 2019-01-03 Robert Bosch Gmbh Verfahren zur Selbstüberprüfung von Fahrfunktionen eines autonomen oder teilautonomen Fahrzeuges

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE10000919A1 (de) * 2000-01-12 2001-07-19 Volkswagen Ag Verfahren und Vorrichtung zur Überwachung eines autonom fahrenden Kraftfahrzeugs mit Hilfe einer Leitzentrale
DE102012222562A1 (de) * 2012-12-07 2014-06-12 Robert Bosch Gmbh System für bewirtschaftete Parkflächen zur Überführung eines Fahrzeugs von einer Startposition in eine Zielposition
US20180339703A1 (en) * 2017-05-26 2018-11-29 Sucxess LLC Vehicle with remote-controlled operating mode

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220185328A1 (en) * 2020-12-11 2022-06-16 Toyota Jidosha Kabushiki Kaisha Control device and control method for vehicle

Also Published As

Publication number Publication date
DE102019201689A1 (de) 2020-08-13

Similar Documents

Publication Publication Date Title
EP3148857B1 (fr) Système de commande de véhicule pour guider un véhicule de façon autonome
EP3512744A1 (fr) Procédé et dispositif permettant de commander un déplacement d'un véhicule et système de commande de déplacement de véhicule
WO2020164814A1 (fr) Procédé et unité de commande pour faire fonctionner un véhicule autonome
EP3948466B1 (fr) Procédé et dispositif pour conduire un véhicule par téléopération
WO2020015923A1 (fr) Procédé pour faire fonctionner un véhicule autonome et véhicule autonome
DE102016122686A1 (de) Verfahren zum Informieren eines Verkehrsteilnehmers über eine Verkehrssituation
DE102008003205A1 (de) Vorrichtung, Verfahren und Computerprogramm zur Kollisionsvermeidung oder zur Verminderung der Kollisionsschwere infolge einer Kollision für Fahrzeuge, insbesondere Nutzfahrzeuge
DE102018118568A1 (de) Redundante aktive steuerungssystemkoordination
EP3625784A1 (fr) Dispositif de commande pour régler une distance entre deux véhicules et procédé de réglage d'une distance entre deux véhicules au moyen d'un tel dispositif de commande
WO2021156089A1 (fr) Procédé de surveillance d'un dispositif de direction à assistance électrique et dispositif de direction à assistance électrique
DE102018219665A1 (de) Verfahren und Steuereinheit zum Betreiben eines autonomen Fahrzeugs
WO2022002901A1 (fr) Procédé de détection d'environnement au moyen d'au moins deux capteurs de détection d'environnement indépendants à formation d'image, dispositif pour la mise en œuvre de ce procédé, véhicule et programme informatique conçu de manière correspondante
DE102017208462A1 (de) Verfahren und Vorrichtung zum Ermitteln von Betriebsdaten für ein automatisiertes Fahrzeug
WO2020038686A1 (fr) Télémanipulation évolutive pour robots autonomes
DE102020133412A1 (de) System und Verfahren zum Festlegen eines Fahrspurwechselmanövers
DE102019127050A1 (de) Verfahren und Vorrichtung zur Selbstdiagnose eines Umfeldsensors
DE112022003223T5 (de) Komplementäres steuersystem für ein autonomes fahrzeug
DE102017201196A1 (de) Verfahren zum Betreiben eines Fahrzeugkonvois
DE102014225103B4 (de) Ein Assistenzverfahren für ein Kraftfahrzeug zur Adaption eines Assistenzsystems des Kraftfahrzeuges
DE102018200804A1 (de) Verfahren zur Ansteuerung eines hoch- oder vollautomatisierten Fahrzeugs
DE102006026653A1 (de) Vorrichtung und Verfahren zum Steuern eines Fahrzeugs
DE112022001245T5 (de) Spurhalteassistent auf basis der abweichungsrate
DE102018211236A1 (de) Verfahren zum Betreiben einer automatisierten Fahrzeugkolonne
EP4097996B1 (fr) Procédé d'échange de données entre une remorque et un usager de la route, module de communication de remorque et remorque
DE102020104118A1 (de) Verfahren und Fahrsystem zum Unterstützen eines Fahrers eines Fahrzeugs beim Bilden einer Rettungsgasse

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20700455

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 20700455

Country of ref document: EP

Kind code of ref document: A1