Method for the safe and reliable at least partially automated guidance of a motor vehicle

Abstract

The present invention relates to a method for safely and reliably guiding a motor vehicle, at least partially automatically, comprising the following steps: receiving an infrastructure data signal representing infrastructure data generated by means of an infrastructure external to the motor vehicle; receiving a safety condition signal representing at least one safety condition for at least partially automatically guiding the motor vehicle based on the infrastructure data; checking whether the at least one safety condition is met; determining control instructions for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data and depending on the result of the check regarding whether the at least one safety condition is met, so as to guide the motor vehicle at least partially automatically; generating a control signal representing the determined control instruction; and outputting the generated control signal. The present invention also relates to a device, a motor vehicle, a computer program, and a machine-readable storage medium.

Description

Technical Field

[0001] The invention relates to a method for the safe and reliable at least partially automated guidance of a motor vehicle. The invention also relates to a device, a motor vehicle, a computer program, and a machine-readable storage medium. Background Art

[0002] The published document DE 10 2017 204 603 A1 discloses a vehicle control system and a method for controlling a vehicle.

[0003] The published document DE 10 2018 124 807 A1 discloses a system and a method for operating a hybrid drive train of a vehicle.

[0004] The published document DE 10 2017 212 227 A1 discloses a method and a system for vehicle data collection and vehicle control in road traffic.

[0005] Motor vehicles using infrastructure data use these data, for example, for warning functions, information functions and convenience functions.

[0006] If the infrastructure data are to be used for at least partially automated control of a motor vehicle, it should be ensured, for example, that the infrastructure data are not manipulated. Summary of the Invention

[0007] The object of the present invention is to provide an efficient concept for the safe and reliable at least partially automated guidance of a motor vehicle.

[0008] This object is achieved by means of the method, device, motor vehicle, computer program and machine-readable storage medium according to the present invention. Advantageous embodiments of the present invention are the various preferred embodiments.

[0009] According to a first aspect, a method for safely and reliably at least partially automatically guiding a motor vehicle is provided, comprising the following steps:

[0010] receiving an infrastructure data signal representing infrastructure data generated by means of an infrastructure external to the motor vehicle;

[0011] receiving a safety condition signal representing at least one safety condition for at least partially automatically guiding the motor vehicle based on infrastructure data;

[0012] Check whether at least one safety condition is met;

[0013] determining control commands for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data in order to at least partially automatically guide the motor vehicle, depending on a result of a check as to whether at least one safety condition is met;

[0014] generating a control signal, wherein the control signal represents the requested control instruction;

[0015] Outputs the generated control signal.

[0016] According to a second aspect, an apparatus is provided, which is configured to carry out all the steps of the method according to the first aspect.

[0017] According to a third aspect, a motor vehicle is provided, comprising the apparatus according to the second aspect.

[0018] According to a fourth aspect, there is provided a computer program comprising instructions which, when said computer program is executed by a computer, for example by an apparatus according to the second aspect, arranges the computer to carry out the method according to the first aspect.

[0019] According to a fifth aspect, a machine-readable storage medium is provided, on which the computer program according to the third aspect is stored.

[0020] The present invention is based on and includes the knowledge that before infrastructure data is used for at least partially automated guidance of a motor vehicle, a check is performed to determine whether at least one safety condition is met. Based on this result, control commands are determined for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle in order to guide the motor vehicle at least partially automatically.

[0021] This advantageously ensures that the control of the transverse and / or longitudinal guidance based on the infrastructure data can be performed safely and reliably. This means that the motor vehicle can be guided safely and reliably, at least partially automatically. The safety conditions can thus predefine, determine, or define situations within which the control of the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data is safe and reliably performed.

[0022] This results in the technical advantage that risks to traffic participants in the surroundings of the motor vehicle can be minimized or prevented. This advantageously ensures that risks to the motor vehicle itself can be minimized or prevented.

[0023] In the context of this specification, “safely” means in particular “safe” and “secure”. Although these two English concepts are usually translated into the German word “sicher”, they have partially different meanings in English.

[0024] The term "safe" relates in particular to the subject of accidents and accident avoidance. Control of the lateral and / or longitudinal guidance of a motor vehicle based on infrastructure data (which is "safe") ensures in particular that the probability of an accident or collision is less than or equal to a predetermined probability threshold.

[0025] The concept "reliable" relates in particular to the subject of computer protection or hacker protection, that is, in particular how to reliably protect a (computer) infrastructure and / or communication infrastructure, in particular the communication route between a motor vehicle and the device according to the second aspect, from unauthorized access or from data manipulation by third parties ("hackers").

[0026] The control of the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data (which control is “reliable”) is in particular based on suitable and sufficient computer protection or protection against hackers.

[0027] This results in, inter alia, the technical advantage that an efficient concept for the safe and reliable at least partially automated guidance of a motor vehicle is provided.

[0028] The expression “at least partially automatically guided” includes one or more of the following situations: assisted guidance, partially automatically guided, highly automatically guided, fully automatically guided.

[0029] Assisted steering means that the driver of a motor vehicle continuously guides the vehicle in the lateral or longitudinal direction. The corresponding other driving task (i.e., controlling the longitudinal or lateral steering of the vehicle) is automatically performed. In other words, during assisted steering of the vehicle, the lateral or longitudinal steering is automatically controlled.

[0030] "Partially automated guidance" means that the longitudinal and lateral guidance of the vehicle is automatically controlled in certain situations (e.g., driving on a highway, driving in a parking lot, overtaking an object, driving in a lane defined by lane markings) and / or for a certain period of time. The driver of the vehicle does not have to manually control the longitudinal and lateral guidance of the vehicle. However, the driver must continuously monitor the automatic control of the longitudinal and lateral guidance so that he or she can manually intervene if necessary. The driver must be ready to fully take over the guidance of the vehicle at any time.

[0031] "Highly automated guidance" means that the longitudinal and lateral guidance of the vehicle is automatically controlled for a certain period of time under specific circumstances (e.g., driving on a highway, driving in a parking lot, overtaking an object, driving in a lane defined by lane markings). The driver of the vehicle does not have to manually control the longitudinal and lateral guidance of the vehicle. The driver does not have to continuously monitor the automatic control of the longitudinal and lateral guidance in order to be able to manually intervene when necessary. When necessary, a takeover request to the driver to take over control of the longitudinal and lateral guidance is automatically output, especially with sufficient time margin. Therefore, the driver must be potentially able to take over control of the longitudinal and lateral guidance. The boundaries of the automatic control of the lateral and longitudinal guidance are automatically identified. With highly automated guidance, it is not possible to automatically establish the minimum risk state in every initial situation.

[0032] "Fully automated guidance" means that the longitudinal and lateral guidance of the vehicle are automatically controlled in certain situations (e.g., driving on a highway, driving in a parking lot, overtaking an object, driving in a lane defined by lane markings). The driver of the vehicle does not have to manually control the longitudinal and lateral guidance of the vehicle. The driver does not have to monitor the automated control of the longitudinal and lateral guidance to be able to manually intervene when necessary. Before the automated control of the lateral and longitudinal guidance is terminated, the driver is automatically asked to take over the driving task (control the lateral and longitudinal guidance of the vehicle), especially with sufficient time. If the driver does not take over the driving task, the system automatically returns to the state with the lowest risk. The limits of the automated control of the lateral and longitudinal guidance are automatically detected. In all situations, the system can automatically return to the state with the lowest risk.

[0033] In one specific embodiment, it is provided that if the at least one safety condition is not met, the determination of the control command includes at least one safeguard step for ensuring that the transverse and / or longitudinal guidance of the motor vehicle can be safely and reliably controlled based on the control command.

[0034] This results in, for example, the technical advantage that the control command is safe and reliable even if at least one safety condition is not met.

[0035] In one embodiment, it is provided that the at least one assurance step is respectively selected from the following group of assurance steps: redundantly processing data, in particular calculating data; diversely processing data, in particular calculating data; checking the functional capabilities of redundant components for controlling the transverse and / or longitudinal guidance of the motor vehicle.

[0036] This results in, for example, the technical advantage that particularly suitable safeguarding steps can be used.

[0037] In one embodiment, it is provided that if the infrastructure data include a driving precondition that a motor vehicle is to drive through in an at least partially automatically guided manner, the driving precondition is checked using data generated within the motor vehicle and / or by at least one algorithm provided within the motor vehicle to determine whether the driving precondition is safe and reliable, wherein a control command is determined based on the result of the check as to whether the driving precondition is safe and reliable.

[0038] This results in, for example, the technical advantage that a motor vehicle can be guided particularly safely and reliably, at least partially automatically.

[0039] In one specific embodiment, it is provided that if the infrastructure data also include further data in addition to the driving specification, in particular environmental sensor data of at least one infrastructure environmental sensor, a check is additionally performed based on the further data as to whether the driving specification is safe and reliable.

[0040] This results in, for example, the technical advantage that the test can be carried out efficiently.

[0041] Data generated within a motor vehicle may also be referred to as motor vehicle data, for example.

[0042] In one specific embodiment, vehicle data are provided or made available.

[0043] In one embodiment, the motor vehicle data respectively include elements selected from the following groups of motor vehicle data: driving planning data; position data; speed data; environmental sensor data of motor vehicle environmental sensors; diagnostic data; environmental model of the motor vehicle's surroundings; route data; weather data representing the weather in the motor vehicle's surroundings; traffic data representing the traffic in the motor vehicle's surroundings; hazard data representing the location and / or type of hazardous locations in the motor vehicle's surroundings; and traffic participant status data representing the status of traffic participants in the motor vehicle's surroundings.

[0044] This results in, for example, the technical advantage that particularly suitable motor vehicle data can be used.

[0045] In one specific embodiment, it is provided that control commands are ascertained for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle based on the motor vehicle data (ie, in particular in addition to the infrastructure data).

[0046] According to one embodiment, the at least one safety condition is an element selected from the following group of safety conditions: there is a confirmation of the infrastructure: the infrastructure data is safe and reliable; there is a predetermined safety integrity level (English: "Safety Integrity Level SIL" or "Automotive Safety Integrity Level" ASIL) of at least the motor vehicle and the infrastructure, in particular including communication routes and / or communication components, in particular with respect to the predetermined safety integrity level of the entire system in the motor vehicle and the infrastructure and in particular individual parts such as components, algorithms, interfaces, etc.; there is a maximum waiting time for communication between the motor vehicle and the infrastructure; there is a predetermined computer protection level for the device according to the second aspect; there are predetermined components and / or algorithms and / or communication possibilities for implementing the steps of the method according to the first aspect; there is redundancy and / or diversity in the predetermined components and / or algorithms and / or communication possibilities for implementing the steps of the method according to the first aspect; there is a predetermined availability description, which describes the predetermined components and / or algorithms and / or the availability of communication possibilities; the existence of predetermined quality standards for the predetermined components and / or algorithms and / or communication possibilities; the existence of a plan comprising measures for reducing errors and / or measures in the event of failure of predetermined components and / or algorithms and / or communication possibilities and / or measures for error analysis and / or measures in the event of misinterpretation; the existence of one or more backup scenarios; the existence of predetermined functions; the existence of predetermined traffic conditions; the existence of predetermined weather; the maximum possible time for correspondingly executing or implementing one or more steps of the method according to the first aspect; the existence of the following check result: the elements or functions for implementing the method according to the first aspect currently function without errors.

[0047] In particular, if there is confirmation from the infrastructure that the infrastructure data are safe and reliable, safe and reliable control commands can be efficiently determined.

[0048] The communication path is, for example, a communication path between the device according to the second aspect and a motor vehicle. The communication path includes, for example, one or more channels.

[0049] In one embodiment, the component for implementing the method according to the first aspect is an element selected from the following group of components: environmental sensors; motor vehicles; infrastructure; devices according to the second aspect; motor vehicle systems, in particular drive systems, clutch systems, braking systems, driver assistance systems; communication interfaces of motor vehicles or infrastructure; processors, inputs and outputs of devices according to the second aspect; controllers, in particular main controllers of motor vehicles.

[0050] The computer protection level is defined in particular as follows: an activated firewall and / or a valid encryption certificate for encrypting communications between the motor vehicle and the infrastructure, and / or an activated virus program (Virenprogramm) with the latest virus signatures, and / or the presence of computer protection, in particular protection of the device according to the second aspect, in particular mechanical protection, in particular intrusion protection, and / or the presence of a check that signals, in particular infrastructure data signals, are transmitted correctly, i.e. without errors.

[0051] The algorithm comprises, for example, a computer program according to the third aspect.

[0052] By, in particular, checking for the presence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication options, the technical advantage arises, for example, that even if a corresponding component, such as a computer or a corresponding algorithm or a corresponding communication option fails, the lateral and / or longitudinal guidance of the motor vehicle can still be controlled safely and reliably.

[0053] To ensure that the results are correct, according to one embodiment, for example, the results can be calculated multiple times and the corresponding results can be compared with each other. For example, the results are only considered correct if the results are consistent. If the number of times is an odd number, for example, it can be provided that the result corresponding to the greatest number of identical results is considered correct.

[0054] According to one embodiment, it is provided that the control of the lateral guidance and / or longitudinal guidance of the motor vehicle is monitored based on the output control signal by re-performing the following check step to determine whether the at least one safety condition is met, wherein the control of the lateral guidance and / or longitudinal guidance of the motor vehicle based on the output control signal is continued as a function of the re-derived result as to whether the at least one safety condition is met.

[0055] This results in, for example, the technical advantage that the control of the transverse and / or longitudinal guidance of the motor vehicle can be effectively monitored based on infrastructure data.

[0056] If, for example, the renewed check reveals that the at least one safety condition is no longer met, the control of the transverse and / or longitudinal guidance of the motor vehicle is interrupted, for example based on infrastructure data.

[0057] If, for example, the renewed check reveals that the at least one safety condition continues to be met, the control of the transverse and / or longitudinal guidance of the motor vehicle is continued, for example based on the infrastructure data.

[0058] In one specific embodiment, it is provided that one or more method steps are carried out within the motor vehicle and / or one or more method steps are carried out outside the motor vehicle, in particular in an infrastructure and / or in particular in a cloud infrastructure.

[0059] This results in, for example, the technical advantage that corresponding method steps can be effectively performed redundantly, which can further increase safety in an advantageous manner.

[0060] According to one embodiment, it is provided that one or more method steps are recorded, in particular in a blockchain.

[0061] This results in the technical advantage that, for example, even after the method has been executed or carried out, it can be subsequently analyzed based on the record. Recording in a blockchain has the particular technical advantage that the record is tamper-proof and falsification-proof.

[0062] A blockchain (English: Blockchain) is a list of continuously extensible data sets (called "blocks") that are linked to one another using one or more cryptographic methods. Each block contains, in particular, a cryptographically secure hash value (distribution value) of the previous block, in particular a timestamp, and in particular transaction data.

[0063] In one embodiment, it is provided that a check is performed to determine whether the entirety of the motor vehicle and the infrastructure participating in the method according to the first aspect, including the communication between the infrastructure and the motor vehicle, is safe and reliable, so that the motor vehicle and / or the local infrastructure and / or the global infrastructure and / or the communication between the motor vehicle and the infrastructure is checked accordingly.

[0064] In particular, this means that before the control of the transverse and / or longitudinal guidance of the motor vehicle is permitted using or based on the infrastructure data, the components used when carrying out the method according to the first aspect are checked for safety, i.e., whether they meet certain safety conditions.

[0065] Important or relevant criteria are, for example, one or more of the above-mentioned safety conditions.

[0066] According to one embodiment, the infrastructure data includes one or more elements selected from the following data groups: environmental sensor data of infrastructure environmental sensors; environmental data representing the environment surrounding the motor vehicle; weather data representing the weather in the environment surrounding the motor vehicle; traffic data representing the traffic in the environment surrounding the motor vehicle; hazard data representing the location and / or type of hazardous locations in the environment surrounding the motor vehicle; traffic participant status data representing the status of traffic participants in the environment surrounding the motor vehicle; and driving predestined data that the motor vehicle should pass.

[0067] This results in, for example, the technical advantage that particularly suitable infrastructure data can be used.

[0068] Generally, an environmental sensor in the sense of this description is one of the following environmental sensors: a radar sensor, a lidar sensor, an ultrasonic sensor, a magnetic field sensor, an infrared sensor, and a video sensor, in particular a video sensor of a video camera.

[0069] In one embodiment, the device checks a driving specification of the infrastructure only for a certain distance to determine whether the specified driving specification is safe. This means that, for example, if a driving specification is to be made over a first distance, the safety check is only performed up to a second distance, the second distance being smaller than the first distance.

[0070] In one embodiment, the device checks the infrastructure travel specifications, in particular only for accident avoidance, for a determined distance as follows: whether the accident was avoided. "The device checks the infrastructure travel specifications only for accident avoidance" means, in particular, that only emergency measures (e.g., full braking) are taken into account within the scope of the check, i.e., comfort aspects are not taken into account.

[0071] In particular, the device checks the driving specifications of the infrastructure up to a first distance only with respect to accident avoidance, without taking comfort aspects into account. This means that the driving specifications of the infrastructure up to a first distance could result in uncomfortable driving of the motor vehicle. However, the driving specifications are implemented, in particular, if they avoid accidents.

[0072] According to one embodiment, the method according to the first aspect is a computer-implemented method.

[0073] According to one embodiment, it is provided that the method according to the first aspect is carried out or executed by means of the device according to the second aspect.

[0074] Device features are derived analogously from corresponding method features, and vice versa. In particular, this means that the technical functions of the device according to the second aspect are derived analogously from the corresponding technical functions of the method according to the first aspect, and vice versa.

[0075] The expression "at least one" especially means "one or more".

[0076] The abbreviation "or" especially stands for "either."

[0077] The expression "also" means in particular "and / or". BRIEF DESCRIPTION OF THE DRAWINGS

[0078] An exemplary embodiment of the present invention is illustrated in the drawings and explained in detail in the following description. The drawings show:

[0079] Figure 1 Flowchart of a method for safely and securely at least partially automatically guiding a motor vehicle,

[0080] Figure 2 equipment,

[0081] Figure 3 a machine-readable storage medium,

[0082] Figure 4 motor vehicles,

[0083] Figures 5 to 13 One motor vehicle each.

[0084] In the following, the same reference numerals may be used for the same features. DETAILED DESCRIPTION

[0085] Figure 1 A flow chart shows a method for safely and securely at least partially automatically guiding a motor vehicle, the method comprising the following steps:

[0086] Receiving 101 an infrastructure data signal, the infrastructure data signal representing infrastructure data generated by means of an infrastructure external to the motor vehicle;

[0087] receiving 103 a safety condition signal representing at least one safety condition for at least partially automated guidance of the motor vehicle based on infrastructure data;

[0088] checking 105 whether the at least one safety condition is satisfied;

[0089] determining 107 a control command for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle based on the infrastructure data in order to at least partially automatically guide the motor vehicle, depending on the result of the check as to whether the at least one safety condition is met;

[0090] generating 109 a control signal representing the sought control command;

[0091] The control signal generated by output 111 is output.

[0092] According to one specific embodiment, the method according to the first aspect includes controlling a transverse guidance and / or a longitudinal guidance of the motor vehicle based on the output control signal in order to guide the motor vehicle at least partially automatically.

[0093] Figure 2 Device 201 is shown.

[0094] The device 201 is configured to implement all steps of the method according to the first aspect.

[0095] The device 201 comprises an input 201 arranged to receive an infrastructure data signal and a safety condition signal.

[0096] The device 201 further comprises a processor 203 which is configured to carry out or execute the checking step, the ascertaining step and the generating step.

[0097] The device 201 further comprises an output terminal 207 , which is configured to output the generated control signal.

[0098] Device 201 is comprised by a motor vehicle, for example.

[0099] Typically, the received signal is received by means of the input 203. The input 203 is therefore provided in particular for receiving the corresponding signal.

[0100] Typically, the output signal is output via the output 207. The output 207 is therefore provided in particular for outputting the corresponding signal.

[0101] According to one embodiment, a plurality of processors are provided instead of one processor 205 .

[0102] Figure 3 A machine-readable storage medium 301 is shown.

[0103] A computer program 303 is stored on a machine-readable storage medium 301 , which includes instructions which, when the computer program 303 is executed by a computer, cause the computer to carry out the method according to the first aspect.

[0104] Figure 4 A motor vehicle 401 is shown.

[0105] Motor vehicle 401 includes Figure 2 device 201.

[0106] Motor vehicle 401 includes a first front environment sensor 403 , a second rear environment sensor 405 , and a third roof environment sensor 407 .

[0107] Motor vehicle 401 also includes a wireless communication interface 409 .

[0108] The infrastructure data may be received via the wireless communication interface 409. The infrastructure data is provided to the input 203 of the device 201.

[0109] In addition, the environmental sensors 403 , 405 , and 407 of the corresponding environmental sensing systems provide corresponding environmental sensor data to the input terminal 203 .

[0110] Output 207 then outputs the correspondingly generated control signals, for example, to drive system 411 and / or brake system 413 and / or steering system 415 of motor vehicle 401 in order to guide the motor vehicle at least partially automatically.

[0111] Figure 5 Another motor vehicle 501 is shown.

[0112] According to an embodiment not shown, the motor vehicle 501 comprises a Figure 2 The device 201 may generally include the device according to the second aspect.

[0113] Motor vehicle 501 includes a first environment sensor 503 , a second environment sensor 505 , and a third environment sensor 507 .

[0114] In an embodiment not shown, more or fewer than three environmental sensors may be provided.

[0115] The environmental sensor data of the environmental sensors 503, 505, 507 are provided to the fusion module 509. The fusion module 509 is configured to perform fusion of the environmental sensor data based on the environmental sensor data. That is, in the fusion module 509, the environmental sensor data of the three environmental sensors 503, 505, 507 are fused.

[0116] Based on the fused environmental sensor data, fusion module 509 may, for example, determine an environmental model of the surroundings of motor vehicle 501 .

[0117] The surroundings model or, in general, the fused surroundings sensor data is provided to planning module 511 .

[0118] Planning module 511 is configured, for example, to execute driving planning for motor vehicle 501 based on an environment model or based on fused environmental sensor data. For example, planning module 511 plans one or more driving maneuvers that are to be performed at least partially automatically by motor vehicle 501 .

[0119] The planned driving maneuver is provided to the action module 513 .

[0120] Action module 513 is configured to determine control instructions for controlling the lateral guidance and / or longitudinal guidance of the motor vehicle based on the planned driving maneuver such that, when the lateral guidance and / or longitudinal guidance of the motor vehicle is controlled based on the control instructions, the motor vehicle at least partially automatically performs the planned driving maneuver or drives at least partially automatically.

[0121] For example, the three modules 509 , 511 , and 513 may each be implemented or realized as software and / or hardware.

[0122] For example, these three modules 509 , 511 , 513 are implemented in or by the processor 205 of the device 201 .

[0123] In particular, this means that processor 205 of device 201 may be configured to fuse environmental sensor data or generate a corresponding surroundings model, plan corresponding driving maneuvers, and determine corresponding control commands.

[0124] Environmental sensors 503 , 505 , 507 and three modules 509 , 511 , 513 are depicted within a rectangle 515 with rounded corners, which symbolically indicates that these elements meet certain safety conditions so that corresponding control commands can safely and reliably control the transverse and / or longitudinal guidance of the motor vehicle.

[0125] This means, for example, that the components have a certain quality standard or a predetermined ASIL level. In particular, this means that the components have a predetermined safety integrity level.

[0126] In this way, it can be ensured in an advantageous manner, in particular, that the individual calculations performed by the individual modules 509 , 511 , 513 provide correct results.

[0127] Thus, for example, reliable operation of surroundings sensors 503 , 505 , 507 can be ensured in an advantageous manner.

[0128] Figure 6 A motor vehicle 501 is shown, in which the rectangle 515 is not drawn, but a safety monitoring module 601 is provided, which ensures that the obtained control instructions still safely and reliably control the longitudinal guidance and / or transverse guidance of the motor vehicle 501 even if there are no specific quality standards with respect to the individual components (and therefore no rectangle 515).

[0129] Therefore, the safety monitoring module 601 is particularly configured to execute or carry out at least one assurance step for ensuring that the transverse guidance and / or longitudinal guidance of the motor vehicle can be safely and reliably controlled based on the control commands.

[0130] For example, the security monitoring module 601 performs redundant or diverse computational steps.

[0131] For example, it can be provided that the safety monitoring module 601 fuses the environmental sensor data again or plans the corresponding driving maneuver again or determines the corresponding control instructions again, ie redundantly.

[0132] If these redundant calculations provide the same results as the individual modules 509 , 511 , 513 or at least provide results that are within a predetermined tolerance range, it can be assumed that the calculation results of modules 509 , 511 , 513 are correct and control instructions for controlling the transverse and / or longitudinal guidance of the motor vehicle can then be used accordingly.

[0133] Otherwise, for example, the individual modules 509 , 511 , 513 repeat their respective calculations again.

[0134] According to one embodiment, it may also be provided that, in the event of a discrepancy in the results, motor vehicle 501 is stopped or generally brought into a safe and reliable state; for example, an emergency stop may be performed.

[0135] In one embodiment not shown, it is provided that not only the individual components meet certain safety conditions, such as Figure 5 This is symbolically shown by a quadrilateral 515 with rounded corners.

[0136] At the same time, you can also set Figure 6 The security monitoring module 601 is shown.

[0137] Figure 7 Motor vehicle 501 is shown traveling at least partially automatically guided within infrastructure 701 .

[0138] Infrastructure 701 includes a cloud infrastructure 703 and a local computer infrastructure 705. Local means, in particular, that the computer structure is located spatially within infrastructure 701, for example, on a road included by infrastructure 701.

[0139] The computer infrastructure 705 includes a database 707 and a computer 709 or a plurality of computers 709. The computer infrastructure 705 also includes a wireless communication interface 711 or additionally or alternatively a wired communication interface.

[0140] Local computer infrastructure 705 can communicate with motor vehicle 501 and / or cloud infrastructure 703 , for example, via communication interface 711 .

[0141] Furthermore, the infrastructure 701 includes a first video camera 713 including a video sensor (not shown), wherein the first video camera 713 is arranged on a first streetlight 715 .

[0142] A second video camera 717 including a video sensor (not shown) is arranged on a second streetlight 719 .

[0143] A third video camera 721 comprising a video sensor (not shown) is arranged on a third streetlight 723. The third streetlight 723 emits light, which is symbolically indicated by the light cone with reference numeral 725, for example.

[0144] Three streetlights 715 , 719 , 723 are spatially distributed within infrastructure 701 , in particular along a road on which motor vehicle 501 is traveling.

[0145] Instead of or in addition to the three video cameras 713 , 717 , 721 , radar sensors, ultrasonic sensors, lidar sensors and / or magnetic field sensors may also be provided.

[0146] Video cameras 713 , 717 , 721 communicate with, for example, local computer infrastructure 705 and cloud infrastructure 703 .

[0147] The corresponding communication between the three video cameras 713 , 717 , 721 and the cloud infrastructure 703 is symbolically indicated by a first double arrow with the reference numeral 727 .

[0148] The communication between video cameras 713 , 717 , 721 and local computer infrastructure 705 is symbolically indicated by a second double arrow with reference numeral 729 .

[0149] The communication between the local computer infrastructure 705 and the cloud infrastructure 703 is symbolically represented by means of a third double arrow with reference numeral 731 .

[0150] Infrastructure 701 may, for example, generate infrastructure data 733 and transmit them to motor vehicle 501 , for example via a wireless communication network, such as a WLAN communication network and / or a mobile radio network.

[0151] This means, in particular, that infrastructure 701 can communicate with motor vehicle 501 , which is symbolically indicated by a fourth double arrow having reference numeral 735 .

[0152] Infrastructure data 733 may include, for example, environmental sensor data from the video sensors of three video cameras 713 , 717 , and 721 . For example, the environmental sensor raw data from video cameras 713 , 717 , and 721 may be transmitted to motor vehicle 501 .

[0153] For example, environmental sensor raw data may be processed, in particular evaluated, wherein, for example, the processed or evaluated environmental sensor raw data is sent to motor vehicle 501 as infrastructure data 733 .

[0154] For example, infrastructure 701 , such as computer 709 , may determine an environment model of the surroundings of motor vehicle 501 based on the environmental sensor raw data and send this environment model to motor vehicle 501 as infrastructure data 733 .

[0155] For example, computer 709 of local computer infrastructure 705 can determine a driving specification based on environmental sensor raw data, which motor vehicle 501 should at least partially automatically drive through. This driving specification can be sent to motor vehicle 501 as infrastructure data 733 using communication interface 711 .

[0156] In general, this means that infrastructure 701 can generate infrastructure data and transmit them to motor vehicle 501 , so that motor vehicle 501 can use these infrastructure data 733 .

[0157] For example, if infrastructure data 733 include environmental sensor data, such as environmental sensor raw data, motor vehicle 501 can use this environmental sensor data just as it would use environmental sensor data from the motor vehicle's own environmental sensors.

[0158] That is, motor vehicle 501 processes these infrastructure data in the same manner as the environmental sensor data of the motor vehicle's own environmental sensors.

[0159] In order to allow this situation, it is in particular provided that a check is carried out beforehand to determine whether at least one safety condition is met.

[0160] If this is the case, the infrastructure data can be used directly to determine corresponding control commands for safely and reliably controlling the transverse and / or longitudinal guidance of the motor vehicle.

[0161] Directly means in this case, in particular, that in this case the execution or execution of at least one guarantee step for ensuring that the transverse and / or longitudinal guidance of the motor vehicle can be safely and reliably controlled based on the control commands can be disregarded.

[0162] This means that in this case, infrastructure environmental sensors, like the vehicle's own environmental sensors, are processed in the same way, wherein it is assumed that the respective environmental sensors meet certain safety conditions, similar to Figure 5 This is indicated by a quadrilateral 515 with rounded corners. Figure 8 This situation is represented symbolically by a quadrilateral that is intended to symbolize infrastructure data 733 being partially drawn in the motor vehicle.

[0163] Figure 9This symbolically illustrates the situation in which the individual components meet certain safety conditions. Therefore, a quadrilateral 515 is drawn again for this purpose, which includes the infrastructure data 733.

[0164] However, if the individual components do not meet certain safety conditions, then similar Figure 6 A security monitoring module 601 may be provided, which symbolically Figure 10 Shown in.

[0165] Infrastructure data 733 may include, for example, travel specifications that motor vehicle 501 is to implement or to travel through.

[0166] In this case, the fusion module 509 and the planning module 511 no longer need to perform the corresponding steps. That is, in this case, the driving pre-set of the infrastructure 701 can be directly provided to the action module 513, which generates the corresponding control instructions based on this. Figure 11 According to one embodiment, a driving specification determined by means of infrastructure 701 and predefined for motor vehicle 501 can be checked by means of safety monitoring module 601 using data generated within the motor vehicle and / or at least one algorithm provided within the motor vehicle to determine whether the driving specification is safe and reliable, wherein control commands are determined as a function of the result of the check as to whether the driving specification is safe and reliable.

[0167] Figure 12 The diagram symbolically illustrates how infrastructure 701 and the communication routes between infrastructure 701 and motor vehicle 501 are checked for safety, i.e., for the satisfaction of at least one safety condition. Specifically, the individual elements of infrastructure 701 within rounded rectangle 1201 are checked for the satisfaction of certain safety conditions. Specifically, the communication routes symbolically illustrated by rounded rectangle 1203 are checked for the satisfaction of certain safety conditions, such as a predetermined minimum latency. According to one specific embodiment, a driving specification determined by infrastructure 701 and specified for motor vehicle 501 can be checked by safety monitoring module 601 for safety using data generated within the vehicle and / or at least one algorithm provided within the vehicle. A control command is determined based on the result of the verification of the safety of the driving specification.

[0168] In this case, ie, when the safety conditions are met, it can be assumed that infrastructure data 733 can be used safely and securely by motor vehicle 501 .

[0169] Figure 13right Figure 12 In an expanded illustration, components within motor vehicle 501 are also checked to see whether they are safe and reliable, ie, whether they meet certain safety conditions.

[0170] This symbolically Figure 12 1 is represented by a quadrilateral 1301 expanded from quadrilateral 1201 , which therefore also includes the processing path of infrastructure data 733 within motor vehicle 501 .

[0171] In one embodiment, the device checks a driving specification of the infrastructure only for a certain distance to determine whether the specified driving specification is safe. This means that if the driving specification is made over a first distance, the safety check is only performed up to a second distance, wherein the second distance is smaller than the first distance.

[0172] For example, it is provided that the driving specification is checked in such a way as to determine whether it can be safely and reliably traveled through.

[0173] In summary, the core of the present invention is based, in particular, on providing a solution that can ensure that the at least partially automated guidance of a motor vehicle is safe and reliable, i.e., in the sense of the terms "safe" and "secure" in this description.

[0174] Furthermore, the core of the present invention is based in particular on the fact that, when the infrastructure data include a driving pre-set that is to be guided at least partially automatically by a motor vehicle, the driving pre-set is checked using data generated within the motor vehicle and / or by at least one algorithm provided within the motor vehicle to determine whether the driving pre-set is safe and reliable, wherein a control command is determined based on the result of the check as to whether the driving pre-set is safe and reliable.

[0175] The approach is primarily based on, inter alia, an analysis of how "safe" and "secure" (i.e., safe and reliable) the individual systems, i.e., the individual components, such as motor vehicles, infrastructure traffic devices, infrastructure sensors, infrastructure computer systems (local, cloud), and communications are.

[0176] Therefore, in particular, it is analyzed how safe and reliable the entire system or the entirety is with regard to the control of the lateral and / or longitudinal guidance of the motor vehicle based on the infrastructure data.

[0177] Therefore, in order to control the lateral and / or longitudinal guidance of a motor vehicle based on infrastructure data, the requirements of the individual systems and the overall system must be sufficient. For example, the individual systems or components and the overall system must have at least one ASIL level determined according to the ASIL classification, such as ASIL-B.

[0178] According to one embodiment, a check step or a plurality of check steps are checked in the subsequent process, ie at a later time point, for example regularly. For example, a check step or a plurality of check steps are checked in the subsequent process at a predetermined frequency, for example every 100 ms.

[0179] For example, according to one embodiment, the check, ie, whether at least one safety condition is met, is performed before and / or after and / or during one or more predetermined method steps.

[0180] According to one embodiment, the test is performed or carried out in the event of a problem.

Claims

1. A method for safely and reliably, at least partially automatically, guiding a motor vehicle (401, 501), comprising the following steps: receiving an infrastructure data signal representing infrastructure data (733) generated by means of an infrastructure (701) external to the motor vehicle; receiving a safety condition signal representing at least one safety condition for at least partially automatically guiding the motor vehicle (401, 501) based on the infrastructure data (733); Checking whether the at least one safety condition is met; determining control instructions for safely and reliably controlling the transverse guidance and / or longitudinal guidance of the motor vehicle (401, 501) based on the infrastructure data (733) in order to guide the motor vehicle (401, 501) at least partially automatically based on the result of the check on whether the at least one safety condition is met; generating a control signal, the control signal representing the determined control instructions; The generated control signal is output, wherein the control of the lateral guidance and / or longitudinal guidance of the motor vehicle (401, 501) is monitored based on the sent control signal by re-performing the checking step as to whether the at least one safety condition is met, wherein the control of the lateral guidance and / or longitudinal guidance of the motor vehicle (401, 501) based on the output control signal is further implemented according to the re-derived result as to whether the at least one safety condition is met.

2. The method according to claim 1, wherein If the at least one safety condition is not met, the determination of the control command includes at least one safeguard step for ensuring that the transverse guidance and / or longitudinal guidance of the motor vehicle (401, 501) can be safely and reliably controlled based on the control command.

3. The method according to claim 2, wherein: The at least one assurance step is selected from the following group of assurance steps: redundantly processing data; diversely processing data; checking the functional capabilities of redundant components for controlling the transverse and / or longitudinal guidance of the motor vehicle (401, 501).

4. The method according to any one of claims 1 to 3, wherein: If the infrastructure data (733) include a driving presetting that the motor vehicle (401, 501) is to travel through in an at least partially automatically guided manner, the driving presetting is checked as follows using data generated within the motor vehicle and / or at least one algorithm provided within the motor vehicle: whether the driving presetting is safe and reliable, wherein a control command is determined based on the result of the check as to whether the driving presetting is safe and reliable.

5. The method according to claim 4, wherein If the infrastructure data (733) also include further data in addition to the driving specification, it is additionally checked based on the further data whether the driving specification is safe and reliable.

6. The method according to any one of claims 1 to 3 and 5, wherein: The at least one safety condition is in each case an element selected from the following group of safety conditions: there is a confirmation of the infrastructure (701) that the infrastructure data (733) are safe and reliable; there is a predetermined safety integrity level of at least the motor vehicle (401, 501) and the infrastructure (701); There is a maximum latency for communication between the motor vehicle (401, 501) and the infrastructure (701); The existence of a predetermined computer protection level for a device for carrying out the steps of the method according to one of claims 1 to 5; the existence of predetermined components and / or algorithms and / or communication options for carrying out the steps of the method according to one of claims 1 to 5; the existence of redundancy and / or diversity in the predetermined components and / or algorithms and / or communication options for carrying out the steps of the method according to one of claims 1 to 5; the existence of a predetermined availability specification, which specifies the availability of predetermined components and / or algorithms and / or communication options; the existence of predetermined quality standards for predetermined components and / or algorithms and / or communication options; the existence of a plan, which includes measures for reducing errors and / or measures in the event of failure of predetermined components and / or algorithms and / or communication options and / or measures for error analysis and / or measures in the event of misinterpretation; the existence of one or more backup scenarios; the existence of predetermined functions; the existence of predetermined traffic conditions; the existence of predetermined weather conditions; There is a maximum possible time for respectively executing or carrying out one or more steps of the method according to one of claims 1 to 5; The check result is that the elements or functions for carrying out the method according to one of claims 1 to 5 are currently functioning without errors.

7. The method according to any one of claims 1 to 3 and 5, wherein: One or more of the above-described method steps are carried out inside the motor vehicle and / or one or more of the above-described method steps are carried out outside the motor vehicle.

8. The method according to any one of claims 1 to 3 and 5, wherein: The infrastructure data (733) include one or more elements selected from the following data groups: environmental sensor data of infrastructure environmental sensors, the environmental sensor data representing the surroundings of the motor vehicle (401, 501); weather data, the weather data representing the weather in the surroundings of the motor vehicle (401, 501); traffic data, the traffic data representing the traffic in the surroundings of the motor vehicle (401, 501); hazard data, the hazard data representing the location and / or type of hazardous locations in the surroundings of the motor vehicle (401, 501); traffic participant status data, the traffic participant status data representing the status of traffic participants in the surroundings of the motor vehicle (401, 501); and driving predetermined paths that the motor vehicle (401, 501) should at least partially automatically travel.

9. The method according to claim 3, wherein: The processed data is calculation data.

10. The method according to claim 5, wherein The further data are environmental sensor data of at least one infrastructure environmental sensor.

11. The method according to claim 6, wherein: The at least one security condition comprises the existence of a predetermined security integrity level of the communication route and / or the communication component.

12. The method according to claim 6, wherein: The at least one safety condition includes the existence of a predetermined safety integrity level for the entire system and individual parts in the motor vehicle (401, 501) and the infrastructure (701).

13. The method according to claim 12, wherein: The various parts include components, algorithms, and interfaces.

14. The method according to claim 7, wherein: One or more method steps are performed in the infrastructure ( 701 ) and / or in a cloud infrastructure ( 703 ).

15. A device (201) for carrying out all the steps of the method according to one of claims 1 to 14.

16. A motor vehicle (401, 501) comprising a device according to claim 15.

17. A computer program product comprising a computer program (303), the computer program comprising instructions which, when the computer program (303) is executed by a computer, cause the computer to carry out the method according to one of claims 1 to 14.

18. A machine-readable storage medium (301) having a computer program (303) stored thereon, the computer program comprising instructions which, when the computer program (303) is executed by a computer, cause the computer to carry out the method according to one of claims 1 to 14.

Images