Method, device, infrastructure and storage medium for securely obtaining infrastructure data

Abstract

The present invention relates to a method for safely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle, comprising the following steps: receiving a data signal representing infrastructure sensor data generated by at least one infrastructure sensor and / or motor vehicle data generated by at least one source motor vehicle; receiving a safety condition signal representing at least one safety condition for safely ascertaining infrastructure data based on the data; checking whether the at least one safety condition is met; ascertaining infrastructure data based on the data in accordance with a result of the check regarding whether the at least one safety condition is met, based on which a target motor vehicle can be guided at least partially automatically; generating an infrastructure data signal representing the ascertained infrastructure data; and outputting the generated infrastructure data signal. The present invention also relates to a device, an infrastructure, a computer program, and a machine-readable storage medium.

Description

Technical Field

[0001] The present invention relates to a method for securely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle. The invention also relates to a device, an infrastructure, a computer program, and a machine-readable storage medium. Background Art

[0002] The published document DE 10 2017 204 603 A1 discloses a vehicle control system and a method for controlling a vehicle.

[0003] The published document DE 10 2018 124 807 A1 discloses a system and a method for operating a hybrid drive system of a vehicle.

[0004] The published document DE 10 2017 212 227 A1 discloses a method and a system for vehicle data collection and vehicle control in road traffic.

[0005] Motor vehicles that use data from the infrastructure use these data, for example, for warning functions, information functions, and convenience functions.

[0006] If the infrastructure data are used for at least partially automated guidance of a motor vehicle, it should be ensured, for example, that the infrastructure data have not been manipulated. Summary of the Invention

[0007] The object on which the present invention is based can be seen as providing an efficient approach for safely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle.

[0008] This object is achieved by means of the corresponding subject matter of the present invention. Advantageous configurations of the present invention are the subject matter of preferred embodiments.

[0009] According to a first aspect, a method for safely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle is provided, comprising the following steps:

[0010] receiving a data signal representing infrastructure sensor data generated by means of at least one infrastructure sensor and / or vehicle data generated by means of at least one source vehicle;

[0011] receiving a security condition signal representing at least one security condition for securely ascertaining infrastructure data based on the data;

[0012] checking whether the at least one safety condition is satisfied;

[0013] determining infrastructure data, based on which, depending on a result of a check as to whether the at least one safety condition is met, infrastructure data are determined based on which the target motor vehicle can be guided at least partially automatically;

[0014] generating an infrastructure data signal representing the sought infrastructure data;

[0015] Outputs the generated infrastructure data signal.

[0016] According to a second aspect, an apparatus is provided, which is configured to carry out all steps of the method according to the first aspect.

[0017] According to a third aspect, there is provided an infrastructure comprising the apparatus according to the second aspect.

[0018] According to a fourth aspect, there is provided a computer program comprising instructions which, when the computer program is run by a computer, for example by means of an apparatus according to the second aspect, cause the computer to carry out the method according to the first aspect.

[0019] According to a fifth aspect, there is provided a machine-readable storage medium having stored thereon the computer program according to the third aspect.

[0020] If the terms "motor vehicle," "source motor vehicle," or "destination motor vehicle" are used in the singular below, the plural is always included, and vice versa. This means, in particular, that embodiments described with respect to one motor vehicle, one source motor vehicle, or one destination motor vehicle also apply to multiple motor vehicles, multiple source motor vehicles, or multiple destination motor vehicles, and vice versa.

[0021] The source motor vehicle can be, for example, the target motor vehicle. This means that the source motor vehicle provides motor vehicle data to the infrastructure and receives infrastructure data from the infrastructure.

[0022] Infrastructure data are generated in the vehicle-external infrastructure.

[0023] The term “source” in “source vehicle” is intended to mean, in particular, that this vehicle is a source of input data, in particular for the device according to the second aspect.

[0024] This means, in particular, that the following input data sources can be provided: motor vehicles, infrastructure, or motor vehicles and infrastructure.

[0025] The term “target” in “target vehicle” is intended to mean, in particular, that this vehicle is the target of the infrastructure data.

[0026] Infrastructure data refers in particular to data which are suitable for at least partially automated guidance of a motor vehicle or which can be used in a meaningful manner for such guidance.

[0027] The present invention is based on and includes the knowledge that before determining infrastructure data for at least partially automated guidance of a target motor vehicle, a check is performed to determine whether at least one safety condition is met. Based on the result of the check, infrastructure data are determined based on which the target motor vehicle can be guided at least partially automatically.

[0028] Thus, it can be advantageously and efficiently ensured that the target motor vehicle can safely use the infrastructure data for at least partially automated control of the lateral and / or longitudinal guidance of the target motor vehicle in order to at least partially automatically guide the target motor vehicle. Thus, with regard to safety conditions, a situation can be predetermined, determined, or defined within which the infrastructure data can be safely ascertained.

[0029] Therefore, in particular the following technical advantage is achieved: risks to road users in the surroundings of the target motor vehicle can be minimized or prevented. In particular, it can be ensured in an advantageous manner that risks to the target motor vehicle itself can be minimized or prevented.

[0030] In the sense of this specification, "safe" means in particular "safe" and "secure". Although these two English terms are often translated as "safe", they have partially different meanings in English.

[0031] The term "safe" refers in particular to the subject of accidents and accident avoidance. Controlling the lateral and / or longitudinal guidance of the target motor vehicle "safely" based on infrastructure data in particular ensures that the probability of an accident or collision is less than or equal to a predetermined probability threshold. Therefore, the infrastructure data determined in this manner is "safe."

[0032] The term "secure" refers in particular to the subject of computer protection or hacker protection, i.e. how secure is it against unauthorized access or against data manipulation by third parties ("hackers"), in particular in a (computer) infrastructure and / or communication infrastructure, in particular in a communication link between a motor vehicle (in particular a target motor vehicle or a source motor vehicle) and a device according to the second aspect.

[0033] Therefore, "secure" control of the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data is based in particular on suitable and sufficient computer protection or protection against hackers. The infrastructure data thus ascertained are therefore "secure."

[0034] Therefore, in particular the following technical advantage is achieved: an efficient approach is provided for safely ascertaining infrastructure data for the at least partially automated guidance of a motor vehicle (ie, a target motor vehicle).

[0035] The expression “at least partially automated guidance” includes one or more of the following: assisted guidance, partially automated guidance, highly automated guidance, fully automated guidance.

[0036] Assisted guidance means that the driver of a motor vehicle continuously guides either the lateral or longitudinal direction of the vehicle. The corresponding other driving task (i.e., controlling the longitudinal or lateral guidance of the vehicle) is automatically performed. This means that, with assisted guidance of a motor vehicle, either the lateral or longitudinal guidance is automatically controlled.

[0037] Partially automated guidance means that the longitudinal and lateral guidance of a vehicle is automatically controlled in specific situations (e.g., driving on a highway, driving in a parking lot, passing an object, driving in a lane defined by lane markings) and / or for a certain period of time. The driver of the vehicle does not have to manually control the longitudinal and lateral guidance of the vehicle. However, the driver must continuously monitor the automatic control of the longitudinal and lateral guidance so that they can manually intervene if necessary. The driver must be ready to fully take over the guidance of the vehicle at any time.

[0038] Highly automated guidance means that the longitudinal and lateral guidance of a motor vehicle is automatically controlled for a certain period of time in specific situations (e.g., driving on a motorway, driving in a parking lot, overtaking an object, driving in a lane defined by lane markings). The driver of the motor vehicle does not have to manually control the longitudinal and lateral guidance of the motor vehicle. The driver does not have to continuously monitor the automatic control of the longitudinal and lateral guidance in order to be able to intervene manually when necessary. When necessary, a takeover request is automatically output to the driver, requesting the driver to take over control of the longitudinal and lateral guidance, especially when there is sufficient time available. Therefore, the driver must be potentially able to take over control of the longitudinal and lateral guidance. The limits of the automatic control of the lateral and longitudinal guidance are automatically identified. With highly automated guidance, a state that automatically leads to risk minimization in every output situation cannot be achieved.

[0039] Fully automated guidance means that the longitudinal and lateral guidance of the vehicle is automatically controlled in certain situations (e.g., driving on a highway, driving in a parking lot, passing an object, driving in a lane defined by lane markings). The driver of the vehicle does not have to manually control the longitudinal and lateral guidance of the vehicle. The driver does not have to monitor the automatic control of the longitudinal and lateral guidance to be able to intervene manually when necessary. Before the automatic control of the lateral and longitudinal guidance ends, the driver is automatically requested to take over the driving task (control the lateral and longitudinal guidance of the vehicle), especially if there is sufficient time available. If the driver does not take over the driving task, the system automatically returns to a risk-minimized state. The limits of the automatic control of the lateral and longitudinal guidance are automatically detected. The system can automatically return to a risk-minimized state in all situations.

[0040] In one specific embodiment, it is provided that if at least one security condition is not met, the ascertainment of the infrastructure data includes at least one security step for ensuring that the infrastructure data can be ascertained securely based on the data.

[0041] This achieves, for example, the technical advantage that the infrastructure data are secure even if at least one security condition is not met.

[0042] In one embodiment, at least one safety step is selected from the following safety step group: redundant processing of data, in particular calculations; diversified processing of data, in particular calculations; checking the functional validity of redundant components for processing data, in particular calculations.

[0043] This achieves, for example, the technical advantage that particularly suitable safety procedures can be used.

[0044] In one embodiment, it is provided that the infrastructure data include one or more elements selected from the following infrastructure data groups: infrastructure sensor data of infrastructure environment sensors; ambient environment data representing the ambient environment of the target motor vehicle; weather data representing the weather in the ambient environment of the target motor vehicle; traffic data representing the traffic in the ambient environment of the target motor vehicle; hazard data representing the location and / or type of hazardous locations in the ambient environment of the target motor vehicle; traffic participant status data representing the status of traffic participants in the ambient environment of the target motor vehicle; the target motor vehicle is to travel at least partially automatically in accordance with the driving presetting (Fahrvorgabe); remote control commands for remotely controlling the lateral guidance and / or longitudinal guidance of the target motor vehicle; motor vehicle data.

[0045] This achieves, for example, the technical advantage of determining particularly suitable infrastructure data.

[0046] In one embodiment, the motor vehicle data respectively include elements selected from the following motor vehicle data groups: driving planning data; position data; speed data; environmental sensor data of environmental sensors of the source motor vehicle; diagnostic data; an environmental model of the surroundings of the source motor vehicle; path data; weather data representing the weather in the surroundings of the source motor vehicle; traffic data representing the traffic in the surroundings of the source motor vehicle; hazard data representing the location and / or type of hazardous locations in the surroundings of the source motor vehicle; and traffic participant status data representing the status of traffic participants in the surroundings of the source motor vehicle.

[0047] This achieves, for example, the technical advantage that particularly suitable motor vehicle data can be used.

[0048] According to one embodiment, at least one safety condition is an element selected from the following safety condition group: the source motor vehicle confirms that the motor vehicle data is safe; there is at least a predetermined safety integrity level (English: "Safety Integrity Level" SIL or "Automotive Safety Integrity Level" ASIL) of the source motor vehicle and the infrastructure, the infrastructure in particular including communication sections and / or communication components, the predetermined safety integrity level is in particular with respect to the entire system in the source motor vehicle and the infrastructure and in particular with respect to some parts, such as components, algorithms, interfaces, etc.; there is a maximum latency time for communication between the source motor vehicle and the infrastructure; there is a predetermined computer protection level for the device according to the second aspect; there are predetermined components and / or algorithms and / or communication possibilities for implementing the steps of the method according to the first aspect; there is redundancy and / or diversity in the predetermined components and / or algorithms and / or communication possibilities for implementing the steps of the method according to the first aspect; there is a predetermined availability statement, which is for the predetermined The availability of components and / or algorithms and / or communication possibilities is described; there are predetermined quality standards for predetermined components and / or algorithms and / or communication possibilities; there is a plan, which includes measures for reducing failures, and / or measures when predetermined components and / or algorithms and / or communication possibilities fail, and / or measures for fault analysis, and / or measures in the event of misinterpretation; there is one or more fallback scenarios; there are predetermined functions; there are predetermined traffic conditions; there is predetermined weather; the maximum possible time for correspondingly executing or implementing one or more steps of the method according to the first aspect; there is a check result that the elements or functions for implementing the method according to the first aspect are currently operating normally without failure.

[0049] In particular, when the source vehicle confirms that the vehicle data is safe, safe infrastructure data can be efficiently acquired.

[0050] The communication link is, for example, a communication link between the device according to the second aspect and the source motor vehicle. The communication link includes, for example, one or more communication channels.

[0051] In one embodiment, the component for implementing the method according to the first aspect is an element selected from the following component group: environmental sensors; source motor vehicle; infrastructure; device according to the second aspect; source motor vehicle system, in particular drive system, clutch system, brake system, driver assistance system; communication interface of the source motor vehicle or infrastructure; processor, input end, output end of the device according to the second aspect; control device, in particular the main control device of the source motor vehicle.

[0052] The computer protection level defines, in particular, the following: an activated firewall; and / or a valid encryption certificate for encrypting communications between the source motor vehicle and the infrastructure; and / or an activated virus program with a current virus signature; and / or the presence of protection for the computer, in particular for the device according to the second aspect, in particular mechanical protection, in particular anti-theft protection; and / or the presence of a check possibility to ensure that signals (in particular infrastructure data signals) have been transmitted correctly, i.e. without errors.

[0053] The algorithm comprises, for example, a computer program according to the third aspect.

[0054] By, in particular, checking the presence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication options, the following technical advantage is achieved, for example: in the event of failure of a corresponding component (e.g. a computer) or a corresponding algorithm or a corresponding communication option, secure infrastructure data can still be obtained.

[0055] According to one embodiment, to ensure that the result is correct, for example, the result can be calculated multiple times and the corresponding results can be compared. For example, the result is determined to be correct only if the results are consistent. If the number of times is an odd number, for example, it can be configured to determine that the result with the most identical results is correct.

[0056] According to one specific embodiment, it is provided that one or more method steps are recorded, in particular in a blockchain.

[0057] This provides the following technical advantage: even after the method has been executed or carried out, the method can be subsequently analyzed based on the record. Recording in a blockchain has the following technical advantage in particular: the record is tamper-proof and forgery-proof.

[0058] A blockchain is, in particular, a continuously expandable list of data items (called "blocks") that are linked to one another using one or more cryptographic methods. Each block contains, in particular, a cryptographically secure hash of the previous block, in particular a timestamp, and in particular transaction data.

[0059] In one embodiment, it is provided that the security of the entirety of the source motor vehicle and the infrastructure participating in the method according to the first aspect, together with the communication between the infrastructure and the source motor vehicle, is checked, so that the source motor vehicle, and / or the local infrastructure, and / or the global infrastructure, and / or the communication between the source motor vehicle and the infrastructure is checked accordingly.

[0060] This means, in particular, that the components used when carrying out the method according to the first aspect are checked for safety: ie, whether they meet certain safety conditions before the transverse and / or longitudinal guidance of the motor vehicle is controlled using or based on the infrastructure data.

[0061] Important or relevant criteria are, for example, one or more of the above-mentioned safety conditions.

[0062] According to one embodiment, the infrastructure sensor is an element selected from the following sensor group: an environmental sensor, a temperature sensor, a pressure sensor, a gas sensor, a rain sensor.

[0063] According to one embodiment, the environmental sensor is one of the following environmental sensors: a radar sensor, a lidar sensor, an ultrasonic sensor, a magnetic field sensor, an infrared sensor, a video sensor (especially a video sensor of a video camera), an audio sensor (especially a microphone).

[0064] According to one embodiment, the method according to the first aspect is a computer-implemented method.

[0065] According to one specific embodiment, it is provided that the method according to the first aspect is carried out or executed with the aid of the device according to the second aspect.

[0066] Device features are derived analogously from corresponding method features and vice versa. This therefore means, in particular, that the technical functionality of the device according to the second aspect is derived analogously from the corresponding technical functionality of the method according to the first aspect and vice versa.

[0067] The expression "at least one" especially means "one or more".

[0068] The expression "also" means especially "and / or". BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Embodiments of the present invention are shown in the drawings and are explained in more detail in the following description.

[0070] Figure 1 A flow chart showing a method according to the first aspect;

[0071] Figure 2 A device is shown;

[0072] Figure 3 A machine-readable storage medium is shown;

[0073] Figure 4 An infrastructure is shown;

[0074] Figure 5 Showing a block diagram;

[0075] Figure 6 Showing a block diagram;

[0076] Figures 7 to 9 An infrastructure is shown respectively;

[0077] Figure 10 showing a motor vehicle;

[0078] Figures 11 to 15 Shown are block diagrams respectively.

[0079] In the following, the same reference numerals may be used for the same features. DETAILED DESCRIPTION

[0080] Figure 1 A flow chart of a method for safely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle is shown, the method comprising the following steps:

[0081] Receiving 101 a data signal representing infrastructure sensor data generated by means of at least one infrastructure sensor and / or vehicle data generated by means of at least one source vehicle;

[0082] receiving 103 a security condition signal representing at least one security condition for securely ascertaining infrastructure data based on the data;

[0083] Checking 105 whether at least one safety condition is satisfied;

[0084] Based on the aforementioned data, ascertaining 107 infrastructure data in accordance with a check result as to whether at least one safety condition is met, based on which infrastructure data the target motor vehicle can be guided at least partially automatically;

[0085] generating 109 an infrastructure data signal, the infrastructure data signal representing the determined infrastructure data;

[0086] Output 111 generates the infrastructure data signal.

[0087] Figure 2 Device 201 is shown.

[0088] The apparatus 201 is configured to carry out all steps of the method according to the first aspect.

[0089] The device 201 comprises an input 201 arranged to receive a data signal and a security condition signal.

[0090] The device 201 comprises a processor 203 which is configured to carry out or execute the checking step, the ascertaining step and the generating step.

[0091] The device 201 further comprises an output 207 which is configured to output the generated infrastructure data signal.

[0092] The received signal is generally received by means of the input 203. The input 203 is therefore provided in particular for receiving the corresponding signal.

[0093] The output signal is generally output via the output 207. The output 207 is therefore provided in particular for outputting the corresponding signal.

[0094] According to one embodiment, instead of one processor 205 , a plurality of processors are provided.

[0095] Figure 3 A machine-readable storage medium 301 is shown.

[0096] A computer program 303 is stored on a machine-readable storage medium 301 . The computer program includes instructions that, when the computer program 303 is run by a computer, cause the computer to carry out the method according to the first aspect.

[0097] Figure 4 An infrastructure 401 is shown, which includes Figure 2 device 201.

[0098] Figure 5 Block diagram 501 is shown.

[0099] According to an embodiment not shown, block diagram 501 includes Figure 2 The device 201 or generally comprises the device according to the second aspect.

[0100] The block diagram 501 comprises a first infrastructure sensor 503, a second infrastructure sensor 505 and a third infrastructure sensor 507. The infrastructure sensors 503, 505, 507 are, for example, environmental sensors.

[0101] In an embodiment (not shown), more or fewer than three infrastructure sensor data may be provided.

[0102] The infrastructure sensor data of the infrastructure sensors 503 , 505 , 507 are provided to a fusion module 509 . The fusion module 509 is configured to perform a fusion of the infrastructure sensor data based on the infrastructure sensor data. This means that the infrastructure sensor data of the three infrastructure sensors 503 , 505 , 507 are fused in the fusion module 509 .

[0103] Based on the fused infrastructure sensor data, fusion module 509 can, for example, determine an environment model of the surroundings of a motor vehicle that is traveling on a road along which three infrastructure sensors 503 , 505 , 507 are arranged.

[0104] The environment model or typically fused infrastructure sensor data is provided to the planning module 511 .

[0105] Planning module 511 is configured, for example, to execute driving planning for a motor vehicle based on an environment model or based on fused infrastructure sensor data. Planning module 511 , for example, plans one or more driving maneuvers that a motor vehicle is to perform at least partially automatically.

[0106] The planned driving maneuver is provided to the action module 513 .

[0107] Action module 513 is configured to determine control commands for controlling the transverse and / or longitudinal guidance of the motor vehicle based on the planned driving maneuver such that when the transverse and / or longitudinal guidance of the motor vehicle is controlled based on the control commands, the motor vehicle at least partially automatically performs or executes the planned driving maneuver.

[0108] The action module 513 is configured to, for example, generate and output a traffic facility control command for controlling one or more traffic facilities.

[0109] The traffic facility is, for example, one of the following traffic facilities: a light signal facility, a guardrail, or a variable traffic sign.

[0110] The generation of traffic facility control commands is carried out, for example, based on motor vehicle data and / or infrastructure sensor data and / or driving specifications.

[0111] This achieves the technical advantage, for example, that the target motor vehicle can be efficiently assisted when implementing the driving specifications.

[0112] The three modules 509 , 511 , and 513 may be implemented or realized as software and / or hardware, respectively, for example.

[0113] For example, the three modules 509 , 511 , 513 are implemented in or performed by the processor 205 of the device 201 .

[0114] This means, in particular, that the processor 205 of the device 201 may be configured to fuse infrastructure sensor data or generate a corresponding environment model, plan corresponding driving maneuvers, and determine corresponding control commands.

[0115] Infrastructure sensors 503 , 505 , 507 and three modules 509 , 511 , 513 are depicted within a quadrangle 515 with rounded corners, which is intended to indicate that these elements meet certain safety conditions, so that corresponding control commands can safely control the transverse and / or longitudinal guidance of the motor vehicle.

[0116] This means, for example, that these elements have a certain quality standard or a predetermined ASIL level. This means, in particular, that these elements have a predetermined safety integrity level.

[0117] In this way, it can be ensured in an advantageous manner, in particular, that the individual calculations performed by the individual modules 509 , 511 , 513 provide correct results.

[0118] Thus, for example, reliable and correct functioning of infrastructure sensors 503 , 505 , 507 can be ensured in an advantageous manner.

[0119] Figure 6 A block diagram 600 is shown, in which the quadrilateral 515 is not drawn, but a safety monitoring module 601 is provided, which ensures that even if there are no specific quality standards for the individual elements (thus no quadrilateral 515), the determined control commands still safely control the transverse and / or longitudinal guidance of the motor vehicle.

[0120] Safety monitoring module 601 is therefore provided in particular for executing or carrying out at least one safety step in order to ensure that the transverse guidance and / or longitudinal guidance of the motor vehicle can be safely controlled based on the control commands.

[0121] For example, the security monitoring module 601 performs redundant or diverse computational steps.

[0122] For example, it can be provided that the safety monitoring module 601 again fuses the infrastructure sensor data, or again plans the corresponding driving maneuver, or again (ie redundantly) obtains the corresponding control command.

[0123] If these redundant calculations provide the same results as the individual modules 509, 511, 513 or at least results that are within a predetermined tolerance range, the calculation results of modules 509, 511, 513 can be considered correct and the control commands can then be used accordingly to control the lateral guidance and / or longitudinal guidance of the motor vehicle.

[0124] Otherwise, it is provided, for example, that the individual modules 509 , 511 , 513 repeat their corresponding calculations again.

[0125] According to one specific embodiment, it can also be provided that, in the event of a deviating result, the motor vehicle is stopped or generally switched to a safe state, for example an emergency stop can be carried out.

[0126] In one specific embodiment, safety monitoring module 601 checks the driving specification determined or planned by planning module 511 only for a certain distance to determine whether the driving specification is safe. This means, for example, that if the driving specification extends over a first distance, the safety check is only performed up to a second distance that is smaller than the first distance.

[0127] In one specific embodiment, it is provided that the safety monitoring module 601 checks the driving predefined parameters determined or planned by means of the planning module 511, in particular only for a certain distance, only for accident avoidance, to determine whether an accident was avoided. The fact that the safety monitoring module 601 checks the driving predefined parameters only for accident avoidance means, in particular, that only emergency measures (e.g., full braking) are considered within the scope of the check, i.e., in particular, comfort aspects are not taken into account.

[0128] This means, in particular, that safety monitoring module 601 checks the driving specifications determined or planned by planning module 511 up to the first distance only for accident avoidance, with comfort aspects still not being taken into account. This means that the driving specifications of planning module 511 up to the first distance could result in uncomfortable driving of the motor vehicle. However, as long as the driving specifications avoid an accident, such driving specifications are transmitted, in particular to the target motor vehicle.

[0129] Therefore, according to one embodiment, using motor vehicle data and / or infrastructure sensor data and / or at least one algorithm provided by means of the infrastructure, a driving pre-set that has been obtained by means of the planning module 511 and should be given in advance to the target motor vehicle can be checked by means of the safety monitoring module 601 as follows: whether the driving pre-set is safe; wherein, a control command is obtained by means of the action module 513 based on the check result as to whether the driving pre-set is safe.

[0130] In an embodiment not shown, it is provided that not only the individual elements meet certain safety conditions, such as Figure 5As is symbolically shown by a quadrilateral 515 with rounded corners. Figure 6 The security monitoring module 601 is shown in FIG.

[0131] Figure 7 Infrastructure 701 is shown.

[0132] The infrastructure 701 comprises a cloud infrastructure 703 and a local computer infrastructure 705. Local means in particular that the computer structure is located spatially within the infrastructure 701, for example on a road included in the infrastructure 701.

[0133] The computer infrastructure 705 includes a database 707, a computer 709 or a plurality of computers 709. The computer infrastructure 705 also includes a wireless communication interface 711, or additionally or alternatively a wired communication interface.

[0134] Via communication interface 711 , local computer infrastructure 705 can communicate, for example, with motor vehicle 739 and / or with cloud infrastructure 703 .

[0135] The infrastructure 701 further comprises a first video camera 713 , which comprises a video sensor (not shown), wherein the first video camera 713 is arranged on a first streetlight 715 .

[0136] A second video camera 717 including a video sensor (not shown) is arranged on a second streetlight 719 .

[0137] A third video camera 721 comprising a video sensor (not shown) is arranged on a third streetlight 723. The third streetlight 723 emits light, for example, which is symbolically indicated by a light cone with the reference numeral 725.

[0138] Three streetlights 715 , 719 , 723 are arranged spatially dispersed within infrastructure 701 , in particular along a road on which motor vehicle 739 travels.

[0139] Instead of or in addition to the three video cameras 713 , 717 , 721 , environmental sensors such as radar sensors, ultrasound sensors, lidar sensors and / or magnetic field sensors and / or audio sensors, in particular microphones, may also be provided.

[0140] Video cameras 713 , 717 , 721 communicate, for example, with the local computer infrastructure 705 and with the cloud infrastructure 703 .

[0141] The corresponding communication between the three video cameras 713 , 717 , 721 and the cloud infrastructure 703 is symbolically marked by a first double arrow with the reference numeral 727 .

[0142] The communication between the video cameras 713 , 717 , 721 and the local computer infrastructure 705 is symbolically marked by a second double arrow with the reference numeral 729 .

[0143] The communication between the local computer infrastructure 705 and the cloud infrastructure 703 is symbolically marked by a third double arrow with reference numeral 731 .

[0144] Infrastructure 701 may, for example, generate infrastructure data 733 and send this infrastructure data to motor vehicle 739 as a destination motor vehicle, for example via a wireless communication network (eg, a WLAN communication network and / or a mobile radio network).

[0145] This therefore means, in particular, that infrastructure 701 can communicate with motor vehicle 739 , which is symbolically indicated by a fourth double arrow having reference numeral 735 .

[0146] Infrastructure data 733 may include, for example, environmental sensor data from the video sensors of the three video cameras 713 , 717 , and 721 . For example, the environmental sensor raw data from video cameras 713 , 717 , and 721 may be transmitted to motor vehicle 739 .

[0147] For example, environmental sensor raw data may be processed, in particular evaluated, wherein the processed or evaluated environmental sensor raw data is transmitted to motor vehicle 739 as infrastructure data 733 , for example.

[0148] For example, infrastructure 701 (eg, computer 709 ) can determine an environment model of the surroundings of motor vehicle 739 based on the raw environmental sensor data and send this environment model to motor vehicle 739 as infrastructure data 733 .

[0149] For example, computer 709 of local computer infrastructure 705 can determine driving specifications based on raw environmental sensor data, according to which motor vehicle 739 is to drive at least partially automatically. Using communication interface 711, this driving specification can be sent to motor vehicle 739 as infrastructure data 733.

[0150] This generally means that infrastructure 701 is able to generate or determine infrastructure data and to transmit these infrastructure data to motor vehicle 739 , so that motor vehicle 739 can use these infrastructure data 733 for at least partially automated guidance.

[0151] exist Figure 7 The paper also draws a picture based on Figure 5Block diagram 737 of block diagram 501 of FIG. Quad 515 may be configured similarly to block diagram 501. Security monitoring module 601 may be configured similarly to block diagram 600.

[0152] Block diagram 737 is intended to simplify infrastructure 701 or to symbolize an exemplary interaction of individual elements of infrastructure 701. The video sensors of video cameras 713, 717, 721 can thus provide their video data to fusion module 509 as infrastructure sensors 503, 505, 507.

[0153] Figure 8 Show the basis Figure 7 Infrastructure 701 , wherein here, block diagram 737 does not have action module 513 , which is to indicate that no control commands are requested for motor vehicle 739 . Instead, the driving maneuvers planned by planning module 511 are directly transmitted to motor vehicle 739 .

[0154] according to Figure 9 A first source vehicle 901 , a second source vehicle 903 , and a third source vehicle 905 are provided, each of which provides vehicle data 907 to the infrastructure 701 .

[0155] Figure 10 Motor vehicle 1001 is shown as an example of a source motor vehicle or a target motor vehicle.

[0156] Block diagram 1003 depicts motor vehicle 1001 in a simplified manner, which is symbolically indicated by brackets 1005 .

[0157] Basically similar to Figure 5 Block diagram 501 forms block diagram 1003. However, instead of infrastructure sensors, vehicle sensors 1007, 1009, and 1011 are provided. The individual modules 509, 511, and 513 of block diagram 1003 operate in a similar manner to the corresponding modules 509, 511, and 513 of block diagram 501, wherein instead of infrastructure sensors or infrastructure sensor data, vehicle sensors or vehicle sensor data are provided.

[0158] Motor vehicle sensors 1007 , 1009 , 1011 are, for example, environmental sensors.

[0159] The quadrilateral 515 may be configured similarly to the block diagram 501 and / or the security monitoring module 601 may be configured similarly to the block diagram 600 .

[0160] Motor vehicle 1001 can, for example, send motor vehicle sensor data as motor vehicle data to the infrastructure.

[0161] Motor vehicle 1001 can, for example, send a driving maneuver planned with the aid of planning module 511 as motor vehicle data to the infrastructure.

[0162] Figure 11 It is shown symbolically how a plurality of motor vehicles 1001 as source vehicles provide corresponding motor vehicle data 907 to infrastructure 701 .

[0163] If vehicle data 907 include environmental sensor data from vehicle environmental sensors, these environmental sensor data may be provided to fusion module 509 , which is symbolically indicated by an arrow with reference numeral 1101 .

[0164] If the vehicle data 907 includes environmental sensor data of the vehicle's environmental sensors, then Figure 12 As shown, these environmental sensor data can be provided to the planning module 511, which Figure 12 This is symbolically marked by an arrow with reference numeral 1201 .

[0165] Infrastructure 701 can process vehicle data 907 in the same way as its own infrastructure sensor data. This means, in particular, that infrastructure 701 can process, for example, vehicle sensors as its own infrastructure sensors.

[0166] In order to make this situation permissible, it is in particular provided that a check is carried out beforehand to determine whether at least one safety condition is met.

[0167] If at least one safety condition is met, motor vehicle data 907 can be used directly to determine the infrastructure data.

[0168] In this case, “directly” means, in particular, that in this case, the execution or implementation of at least one security step for ensuring data-safe ascertainment of the infrastructure data can be dispensed with.

[0169] This means that in this case the vehicle sensors are treated like infrastructure sensors, wherein the individual sensors (here both vehicle sensors and infrastructure sensors) can be considered to meet certain safety conditions, similar to Figure 5 , which is marked by a quadrilateral 515 with rounded corners. Figure 13 This is shown symbolically.

[0170] However, if the individual elements do not meet certain safety conditions, then similar Figure 6 Set up security monitoring module 601, which is Figure 14 It is shown symbolically in FIG.

[0171] Figure 15An overall diagram is shown which is intended to further explain the concept described here by way of example.

[0172] First quadrilateral 1501 with rounded corners outlines source vehicle 1001 as a source of vehicle data.

[0173] Second quadrilateral 1503 with rounded corners outlines infrastructure 701 , in which vehicle data and / or infrastructure sensor data are used to determine infrastructure data for target vehicle 739 , based on which target vehicle 739 can be guided at least partially automatically.

[0174] A third quadrilateral 1505 with rounded corners outlines the target motor vehicle 739 and the transmitted infrastructure data 733 .

[0175] In order to be able to guide target motor vehicle 739 safely and at least partially automatically based on infrastructure data 733 , in particular a plurality of, in particular all, elements involved in the method according to the first aspect must meet certain safety conditions.

[0176] In particular, the infrastructure data must be secure, which can be ensured in particular by checking whether at least one security condition is met, with the provision of security steps if necessary.

[0177] Therefore, the approach is also based on the fact that in particular the individual systems (1501, 1503, 1505), i.e. the individual components, such as (source / destination) motor vehicles, infrastructure traffic facilities, infrastructure sensors, infrastructure computer systems (local, cloud) and communications, are analyzed in terms of how "SAFE" and "SECURE", i.e. how secure, they are.

[0178] Thus, in particular, the entire system or the entire system is analyzed with respect to the ascertainment of infrastructure data or with respect to the control of the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data.

[0179] Therefore, in order to be able to control the lateral and / or longitudinal guidance of a motor vehicle based on infrastructure data, the requirements for individual systems 1501, 1503, 1505 and the entire system 1505 must meet this purpose. For example, individual systems 1501, 1503, 1505 or their components, as well as the entire system 1505, must have at least one specific ASIL level according to the ASIL classification, i.e., ASIL-B, for example.

[0180] The core of the present invention is also based in particular on the fact that if the infrastructure data are to include a driving pre-set, the driving pre-set is checked by means of the safety monitoring module 601 using the motor vehicle data and / or infrastructure sensor data and / or at least one algorithm provided by the infrastructure as follows: whether the driving pre-set is safe, according to which the motor vehicle is to drive at least partially automatically, the driving pre-set having been determined by means of the planning module 511 and to be provided in advance to the target motor vehicle, wherein a control command is determined by means of the action module 513 based on the result of the check as to whether the driving pre-set is safe.

[0181] According to one embodiment, it is provided that one or more checking steps are subsequently checked (ie at a later time), for example regularly. For example, one or more checking steps are subsequently checked at a predetermined frequency (eg every 100 ms).

[0182] For example, according to one embodiment, such a check is performed before and / or after and / or during one or more predetermined method steps, ie, a check is performed to determine whether at least one safety condition is met.

[0183] According to one embodiment, the check is performed or carried out in the event of a problem.

Claims

1. A method for safely ascertaining infrastructure data for at least partially automated guidance of a motor vehicle, comprising the following steps: receiving a data signal representing infrastructure sensor data generated by means of at least one infrastructure sensor and / or vehicle data generated by means of at least one source vehicle; receiving a safety condition signal, the safety condition signal representing at least one safety condition for safely ascertaining infrastructure data based on the infrastructure sensor data and / or the motor vehicle data; checking whether the at least one safety condition is satisfied; determining infrastructure data based on the infrastructure sensor data and / or the motor vehicle data in accordance with a result of a check as to whether the at least one safety condition is met, based on which the target motor vehicle can be guided at least partially automatically; generating an infrastructure data signal, wherein the infrastructure data signal represents the determined infrastructure data; Outputs the generated infrastructure data signal, wherein, if the at least one safety condition is not met, the determining of the infrastructure data comprises at least one safety step, the at least one safety step being used to ensure that the infrastructure data can be safely determined based on the infrastructure sensor data and / or the vehicle data, wherein the at least one safety step is respectively selected from the following group of safety steps: redundant processing of the infrastructure sensor data and / or the vehicle data; diversity processing of the infrastructure sensor data and / or the vehicle data; checking the functional effectiveness of redundant components for processing the infrastructure sensor data and / or the vehicle data; In which, the at least one safety condition is selected from the following group of safety conditions: there is a predetermined safety integrity level for at least the source motor vehicle and the infrastructure, and the predetermined safety integrity level involves the entire system in the source motor vehicle and the infrastructure; there is a maximum waiting time for communication between the source motor vehicle and the infrastructure; there are predetermined quality standards for the predetermined components and / or algorithms and / or communication possibilities; there is a plan, which includes measures for reducing faults and / or measures when predetermined components and / or algorithms and / or communication possibilities fail and / or measures for fault analysis and / or measures in the event of misinterpretation; there are one or more fallback plans.

2. According to the method according to claim 1, the infrastructure data includes one or more elements selected from the following infrastructure data groups: infrastructure sensor data of infrastructure environment sensors; environmental data representing the surrounding environment of the target motor vehicle; weather data representing the weather in the surrounding environment of the target motor vehicle; traffic data representing the traffic in the surrounding environment of the target motor vehicle; hazard data representing the location and / or type of hazardous locations in the surrounding environment of the target motor vehicle; traffic participant status data representing the status of traffic participants in the surrounding environment of the target motor vehicle; driving presettings, according to which the target motor vehicle should travel at least partially automatically; remote control commands for remotely controlling the lateral guidance and / or longitudinal guidance of the target motor vehicle; motor vehicle data.

3. The method according to claim 1 or 2, wherein: The motor vehicle data respectively include elements selected from the following motor vehicle data groups: driving plan data; position data; speed data; environmental sensor data of environmental sensors of the source motor vehicle; diagnostic data; environmental model of the surrounding environment of the source motor vehicle; path data; weather data representing the weather in the surrounding environment of the source motor vehicle; traffic data representing the traffic in the surrounding environment of the source motor vehicle; hazard data representing the location and / or type of hazardous locations in the surrounding environment of the source motor vehicle; traffic participant status data representing the status of traffic participants in the surrounding environment of the source motor vehicle.

4. The method according to claim 1 or 2, wherein: The at least one security condition is respectively an element additionally selected from the following group of security conditions: the source motor vehicle confirms that the motor vehicle data are secure; there is a predetermined computer protection level of a device, which is used to carry out the steps of the method according to any of the preceding claims; there are predetermined components and / or algorithms and / or communication possibilities, which are used to carry out the steps of the method according to any of the preceding claims; there is redundancy and / or diversity in the predetermined components and / or algorithms and / or communication possibilities, which are used to carry out the steps of the method according to any of the preceding claims; there is a predetermined availability statement, which states the availability of predetermined components and / or algorithms and / or communication possibilities; there is a predetermined function; there is a predetermined traffic situation; there is a predetermined weather; the maximum possible time for respectively executing or carrying out one or more steps of the method according to any of the preceding claims; The check result is that the elements or functions for carrying out the method according to any of the preceding claims are currently functioning normally without errors.

5. The method according to claim 1, wherein The processing is performing calculations.

6. The method according to claim 1, wherein The predetermined safety integrity level is a predetermined safety integrity level of at least the source motor vehicle and the infrastructure, including communication segments and / or communication components.

7. The method according to claim 1, wherein The predetermined safety integrity level is a predetermined safety integrity level of at least the source vehicle and the infrastructure, involving components, algorithms, and interfaces in the source vehicle and the infrastructure.

8. A device configured to carry out all steps of the method according to any one of the preceding claims.

9. An infrastructure comprising the device according to claim 8. 10 . A computer program product comprising instructions which, when executed by a computer, cause the computer to carry out the method according to claim 1 . 11 . A machine-readable storage medium having instructions stored thereon, wherein when the instructions are executed by a computer, the instructions cause the computer to execute the method according to claim 1 .

Images