Method for remote control of a motor vehicle

Abstract

The invention relates to a method for remote controlling a motor vehicle, the method comprising the steps of receiving a safety condition signal representing at least one safety condition which has to be fulfilled in order to allow remote controlling the motor vehicle, checking whether the at least one safety condition is fulfilled, generating a remote control signal for remote controlling the motor vehicle based on a result of the checking whether the at least one safety condition is fulfilled, outputting the generated remote control signal. The invention also relates to a device, a computer program and a machine readable storage medium.

Description

TECHNICAL FIELD

[0001] The invention relates to a method for remotely controlling a motor vehicle. The invention further relates to a device, a computer program and a machine readable storage medium. BACKGROUND

[0002] The publication DE 10 2016 213 961 A1 discloses a concept for remotely controlling a motor vehicle within a parking lot.

[0003] The publication DE 10 2017 213 204 A1 discloses a method and system for remotely controlling a vehicle.

[0004] The publication DE 10 2018 107 756 A1 discloses a system for outputting a warning signal by a vehicle to warn a nearby entity.

[0005] The publication WO 2019 / 028464 A1 discloses an autonomously driving vehicle. SUMMARY

[0006] The underlying task of the invention shall be considered to provide an efficient concept for efficiently remotely controlling a motor vehicle.

[0007] The task is solved by means of the invention. Advantageous configurations of the invention are the content of the preferred embodiments.

[0008] According to a first aspect, a method for remotely controlling a motor vehicle is provided, the method comprising the steps of:

[0009] receiving a safety condition signal, the safety condition signal representing at least one safety condition, which has to be fulfilled in order to allow remotely controlling the motor vehicle,

[0010] checking, whether the at least one safety condition is fulfilled,

[0011] generating a remote control signal for remotely controlling the motor vehicle based on a result of the checking whether the at least one safety condition is fulfilled,

[0012] outputting the generated remote control signal.

[0013] According to a second aspect, a device is provided, which is arranged for carrying out all steps of the method according to the first aspect.

[0014] According to a third aspect, a computer program is provided, which comprises instructions, which, when the computer program is executed by a computer, e.g. by the device according to the second aspect, arrange the computer to carry out the method according to the first aspect.

[0015] According to a fourth aspect, a machine-readable storage medium is provided, having stored thereon a computer program according to the third aspect.

[0016] The present application is based on and includes the insight that the above-mentioned task can be solved by checking, prior to remotely controlling the motor vehicle, whether at least one safety condition is fulfilled. If this is not the case, in particular the generation of a remote control signal for remotely controlling the motor vehicle is abandoned. Preferably, the remote control signal is generated and output only if at least one safety condition is fulfilled.

[0017] Thereby, for example, the following technical advantage arises: The remote control of the motor vehicle can be carried out safely and reliably.

[0018] Thereby, in particular, the following technical advantage arises: A solution for efficiently remotely controlling a motor vehicle is provided.

[0019] In an embodiment, the remote control signal comprises a control signal for controlling the lateral guidance and / or the longitudinal guidance of the motor vehicle.

[0020] Thereby, for example, the following technical advantage arises: The motor vehicle can be efficiently remotely controlled.

[0021] In an embodiment, the following determination step is provided: The motor vehicle shall be remotely controlled.

[0022] Thereby, for example, the following technical advantage arises: It can be efficiently ensured that the motor vehicle shall be remotely controlled.

[0023] In the case where the control signal is a control signal for controlling the lateral guidance or the longitudinal guidance of the motor vehicle, according to an embodiment, the respective other guidance, i.e. the longitudinal guidance or the lateral guidance, is either manually controlled by the driver (this can be referred to as assisted guidance in particular) or at least partially automated controlled in order to at least partially automatically guide the motor vehicle.

[0024] The assisted guidance means in particular that the driver of the motor vehicle permanently either carries out the lateral guidance of the motor vehicle or carries out the longitudinal guidance of the motor vehicle. The respective other driving task, i.e. the control of the longitudinal guidance or the lateral guidance of the motor vehicle, is performed remotely automatically. That is, in the case of assisted guidance of the motor vehicle, either the lateral guidance or the longitudinal guidance is controlled remotely automatically.

[0025] The expression "at least partially automated guidance" comprises one or more of the following cases: partially automated guidance, highly automated guidance, fully automated guidance.

[0026] Partly automated guidance means that the longitudinal guidance and the lateral guidance of the motor vehicle are automatically remotely controlled in certain situations (for example: driving on a motorway, driving in a parking lot, overtaking an object, driving in a lane determined by lane markings) and / or for a certain period of time. The driver of the motor vehicle does not have to manually control the longitudinal guidance and the lateral guidance of the motor vehicle himself. However, the driver has to monitor the automatic remote control of the longitudinal guidance and the lateral guidance persistently in order to be able to intervene manually if necessary. The driver has to be ready at all times to take over the complete guidance of the motor vehicle.

[0027] Highly automated guidance means that the longitudinal guidance and the lateral guidance of the motor vehicle are automatically remotely controlled in certain situations (for example: driving on a motorway, driving in a parking lot, overtaking an object, driving in a lane determined by lane markings) for a certain period of time. The driver of the motor vehicle does not have to manually control the longitudinal guidance and the lateral guidance of the motor vehicle himself. The driver does not have to monitor the remote automated control of the longitudinal guidance and the lateral guidance persistently in order to be able to intervene manually if necessary. A takeover request is automatically output to the driver (in particular with sufficient time allowance) to take over the control of the longitudinal guidance and the lateral guidance if necessary. The driver therefore has to be potentially able to take over the control of the longitudinal guidance and the lateral guidance. The boundaries of the automatic remote control of the lateral and longitudinal guidance are automatically identified. In highly automated guidance, it is not possible to automatically achieve a state of minimum risk in every initial situation.

[0028] Fully automated guidance means that the longitudinal guidance and the lateral guidance of the motor vehicle are automatically remotely controlled in certain situations (for example: driving on a motorway, driving in a parking lot, overtaking an object, driving in a lane determined by lane markings). The driver of the motor vehicle does not have to manually control the longitudinal guidance and the lateral guidance of the motor vehicle himself. The driver does not have to monitor the remote automated control of the longitudinal guidance and the lateral guidance in order to be able to intervene manually if necessary. The driver is automatically requested (in particular with sufficient time allowance) to take over the driving task (control of the lateral and longitudinal guidance of the motor vehicle) before the remote automated control of the lateral and longitudinal guidance ends. If the driver does not take over the driving task, a return to a state of minimum risk is automatically made. The boundaries of the automatic control of the lateral and longitudinal guidance are automatically identified. A return to a state of minimum risk of the system is automatically made in all situations.

[0029] According to an implementation provision, the at least one safety condition is respectively an element selected from the following group of safety conditions: there is a predetermined safety integrity level (English: "Safety Integrity Level" SIL or "Automotive Safety Integrity Level" ASIL) of at least the motor vehicle and of the infrastructure for remote control of the motor vehicle, in particular comprising a communication route and / or a communication component, in particular a predetermined safety integrity level with respect to the entire system and in particular individual parts such as components, algorithms, interfaces, etc. of the motor vehicle and of the infrastructure; there is a maximum latency time of the communication between the motor vehicle and a remote control device for remote control of the motor vehicle on the basis of remote control signals; there is a predetermined computer protection level of a device for implementing the method steps; there is a predetermined component and / or algorithm and / or communication possibility for implementing the method steps; there is a redundancy and / or diversity in the predetermined component and / or algorithm and / or communication possibility for implementing the method steps; there is a predetermined availability specification which specifies the availability of the predetermined component and / or algorithm and / or communication possibility; there is a predetermined quality criterion of the predetermined component and / or algorithm and / or communication possibility; there is a plan which comprises measures for reducing errors and / or measures in the event of failure of the predetermined component and / or algorithm and / or communication possibility and / or measures for error analysis and / or measures in the event of misinterpretation; there is one or more fallback scenarios; there is a predetermined function; there is a predetermined traffic situation; there is a predetermined weather; there is a maximum possible time for correspondingly performing or implementing one or more method steps; there is a check result that the elements or functions for implementing the method are currently functioning without errors.

[0030] For example, the communication route is a communication route between the device according to the second aspect and the motor vehicle. The communication route comprises for example one or more communication channels.

[0031] In an implementation, the component for implementing the method according to the first aspect is an element selected from the following group of components: an environmental sensor, a motor vehicle, an infrastructure, a remote control device, a device according to the second aspect, a motor vehicle system, in particular a drive system, a clutch system, a brake system, a driver assistance system, a communication interface of the motor vehicle or of the infrastructure, a processor of the device according to the second aspect, an input and an output.

[0032] In one embodiment, the functions for carrying out the method according to the first aspect are elements selected from the following group of functions: remote control function, communication function between motor vehicle and infrastructure or remote control device, analysis processing function of environmental sensor data of environmental sensors, planning function, in particular driving planning function, traffic analysis function, emission analysis function.

[0033] The computer protection level in particular defines the following: activated firewall and / or valid encryption certificate for encrypting the communication between motor vehicle and infrastructure or remote control device and / or activated virus program with the latest virus signature and / or presence of a protection for the computer, in particular for the device according to the second aspect or remote control device, in particular mechanical protection, intrusion protection and / or presence of a checking possibility that the signal, in particular remote control signal or environmental signal, has been transmitted correctly, in particular without errors.

[0034] The algorithm for example comprises a computer program according to the third aspect.

[0035] By checking in particular the presence of redundancies and / or diversities in predetermined components and / or algorithms and / or communication possibilities, for example the following technical advantage is achieved: In the event of a failure of a respective component, for example a computer, or a respective algorithm or a respective communication possibility, a secure and reliable function can still be carried out.

[0036] According to one embodiment, in order to ensure that the result is correct, the result can be calculated several times, for example, and the respective results can be compared with one another. For example, the result is determined to be correct only if the results agree. If the number of times is odd, for example, it can be provided that the result corresponding to the highest number of identical results is determined to be correct.

[0037] The data signal is generated, for example, only if it can be determined that the result is correct.

[0038] In one embodiment it is provided that the data signal is generated only if at least one safety condition is fulfilled.

[0039] In one embodiment it is provided that, before and / or after and / or during carrying out one or more predetermined method steps, it is checked whether at least one safety condition is fulfilled.

[0040] Thereby, in particular the following technical advantage is achieved: It can be effectively ensured that the determined prerequisites for motor vehicle remote control, which are currently safety conditions, are fulfilled before and / or after and / or during carrying out the respective method steps. Thereby, in particular the following technical advantage is achieved: If the safety conditions are fulfilled, the motor vehicle can be safely and reliably remotely controlled.

[0041] In one embodiment provision is made that, after outputting the remote control signal, the remote control of the motor vehicle is checked on the basis of the output remote control signal in order to detect an error, wherein, in the event of an error being detected, the remote control is interrupted or an emergency remote control signal is generated and output, which is used to control the lateral guidance and / or longitudinal guidance of the motor vehicle in an emergency.

[0042] The emergency remote control signal acts, for example, such that, when the lateral guidance and / or longitudinal guidance of the motor vehicle is remotely controlled on the basis of the emergency remote control signal, the motor vehicle is brought into a safe and secure state, in particular is brought to a standstill.

[0043] In one embodiment provision is made that, after outputting the remote control signal, the remote control of the motor vehicle is checked on the basis of the output remote control signal in order to detect an error, wherein, in the event of an error being detected, the remote control is interrupted or an emergency remote control signal is generated and output, which is used to control the lateral guidance and / or longitudinal guidance of the motor vehicle in an emergency.

[0044] The emergency remote control signal acts, for example, such that, when the lateral guidance and / or longitudinal guidance of the motor vehicle is remotely controlled on the basis of the emergency remote control signal, the motor vehicle is brought into a safe and secure state, in particular is brought to a standstill.

[0045] The emergency remote control signal is thus an emergency control signal which is generated by or in the motor vehicle itself.

[0046] Thereby, for example, the following technical advantage is achieved: Even in the event of a failure of the communication between the motor vehicle and the device according to the second aspect or the remote control means for remotely controlling the motor vehicle, which corresponds, for example, to an emergency situation, the motor vehicle itself can bring itself into a safe and secure state.

[0047] The embodiments made in connection with the remote control signal or the emergency control signal in the vehicle apply analogously to the emergency remote control signal and vice versa.

[0048] According to a further embodiment provision is made that the checking of the remote control comprises checking whether at least one safety condition is fulfilled, wherein it is determined that a result which states that the at least one safety condition is not fulfilled is an error.

[0049] Thereby, for example, the following technical advantage is achieved: When the at least one safety condition is no longer fulfilled during the remote control of the motor vehicle on the basis of the generated remote control signal, this can be reacted to effectively.

[0050] According to an embodiment provision, the checking of the remote control comprises checking whether a result to be achieved by the remote control has been achieved, wherein it is determined that a checking result of whether the result to be achieved by the remote control has been achieved is false, which checking result states that the result to be achieved by the remote control has not been achieved.

[0051] Thereby, for example, the following technical advantage arises: it is possible to react effectively to the fact that the result to be achieved by the remote control has not been achieved.

[0052] For example, the result to be achieved comprises one or more of the following results: the motor vehicle has a predetermined desired speed, the motor vehicle has a predetermined desired acceleration, the motor vehicle is located at a predetermined desired position, a navigation system of the motor vehicle has a predetermined desired target position and / or adopts a predetermined desired route, a motor vehicle device adopts a predetermined motor vehicle setting.

[0053] According to an embodiment provision, as an additional alternative to interrupting the remote control and generating and outputting the emergency remote control signal, a further remote control signal for remotely controlling the motor vehicle is generated and outputted on the basis of the result to be achieved, in order to still achieve the result to be achieved when the motor vehicle is remotely controlled on the basis of the further remote control signal.

[0054] Thereby, for example, the following technical advantage arises: there is another effective possibility of still achieving the result to be achieved by the remote control.

[0055] According to an embodiment provision, an emergency plan signal is received, which emergency plan signal represents a specific emergency plan for the detected error, wherein the emergency remote control signal is generated on the basis of the specific emergency plan.

[0056] Thereby, for example, the following technical advantage arises: the emergency remote control signal can be generated effectively. This means, in particular, that the emergency plan is specifically intended for the detected error.

[0057] According to an embodiment provision, the determination that the motor vehicle is to be remotely controlled comprises a determination that the motor vehicle is to be remotely controlled at a predetermined time, wherein the checking of whether at least one safety condition is fulfilled comprises a checking of whether at least one safety condition is fulfilled at the predetermined time.

[0058] Thereby, for example, the following technical advantage arises: the checking of whether at least one safety condition is fulfilled can be carried out effectively. In particular, thereby, the following technical advantage arises: when the motor vehicle is to be remotely controlled, it can be checked effectively whether at least one safety condition is fulfilled at this point in time.

[0059] In one embodiment, the check as to whether at least one safety condition is fulfilled comprises a check as to whether at least one safety condition is fulfilled at a predetermined time.

[0060] In particular, this leads to the technical advantage that it can be effectively checked at the point in time when the motor vehicle should be remotely controlled whether at least one safety condition is fulfilled.

[0061] For example, a time signal is received, which time signal specifies a predetermined time at which the motor vehicle should be remotely controlled.

[0062] In one embodiment, a situation signal is received, which situation signal represents a situation in which the motor vehicle is located, wherein a table signal is received, which table signal represents a table, which table specifies predetermined situations for predetermined assignments for remotely controlling the motor vehicle, wherein the situation in which the motor vehicle is located is assigned to the predetermined situations, and wherein the remote control signal is generated on the basis of the assignment for remotely controlling the motor vehicle, which corresponds to the predetermined situation.

[0063] This leads, for example, to the technical advantage that the remote control signal can be effectively generated.

[0064] According to one embodiment, a surrounding signal is received, which surrounding signal represents a surrounding of the motor vehicle, wherein the remote control signal is generated on the basis of the surrounding.

[0065] This leads, for example, to the technical advantage that the remote control signal can be effectively generated. In particular, this leads to the technical advantage that the surrounding of the motor vehicle can be effectively taken into account when generating the remote control signal.

[0066] According to one embodiment, it is checked on the basis of the surrounding of the motor vehicle whether the current traffic situation allows for a remote control of the motor vehicle. In particular, it is provided that the remote control signal is generated or output on the basis of the result of the check as to whether the current traffic situation allows for a remote control.

[0067] For example, if the current traffic situation does not allow for a remote control, the remote control of the motor vehicle is abandoned.

[0068] This leads, for example, to the technical advantage that other traffic participants in the environment of the motor vehicle are not endangered or injured.

[0069] According to one embodiment, one or more method steps are carried out in addition to the steps of generating and outputting the remote control signal inside the motor vehicle, and / or one or more method steps are carried out outside the motor vehicle, in particular in an infrastructure, preferably in a cloud infrastructure.

[0070] Thereby, for example, the following technical advantages arise, the respective method steps can be carried out efficiently and redundantly. This can further improve the safety in an advantageous manner, in particular.

[0071] According to an embodiment provision, one or more method steps are recorded, in particular in a blockchain.

[0072] Thereby, for example, the following technical advantages are achieved: The method can also be analyzed after its execution or implementation on the basis of the recording retrospectively. Recording in a blockchain has the following technical advantages, in particular: The recording is tamper-proof and forgery-proof.

[0073] A blockchain (English "Block Chain") is, in particular, a continuously expandable list of data groups (called "blocks"), which are linked to one another by means of one or more cryptographic methods. Here, each block contains, in particular, a secure and reliable hash (dispersion value) of the previous block in an encrypted manner, in particular a timestamp, in particular transaction data.

[0074] According to an embodiment provision, the output of the generated remote control signal comprises transmitting the remote control signal to the motor vehicle via a communication network, in particular via a wireless communication network.

[0075] According to an embodiment provision, the method according to the first aspect comprises remotely controlling the motor vehicle on the basis of the generated remote control signal.

[0076] In an embodiment provision, it is provided to check whether the overall system consisting of the motor vehicle and the infrastructure participating in the method according to one of the above-mentioned embodiments (including the communication between the infrastructure and the motor vehicle) is secure and reliable in order to check the motor vehicle and / or the local infrastructure and / or the global infrastructure and / or the communication between the motor vehicle and the infrastructure accordingly. The remote control signal is generated, in particular, on the basis of the check result.

[0077] This means, in particular, that the components used in the implementation of the method according to the first aspect are checked in terms of security before the driving operation is intervened, i.e. the motor vehicle is remotely controlled, i.e. it is checked whether the components meet certain safety conditions.

[0078] The important or relevant criteria are, for example, one or more of the safety conditions mentioned above.

[0079] In an embodiment provision, the remote control signal comprises an adaptation signal for adapting at least one motor vehicle setting of a motor vehicle device of the motor vehicle.

[0080] Thereby, for example, the following technical advantages arise: At least one motor vehicle setting can be adapted remotely efficiently.

[0081] The at least one motor vehicle setting is, for example, an element selected from the group of motor vehicle settings consisting of an internal combustion engine setting of a motor vehicle internal combustion engine, in particular an injection parameter, an operating state of a motor vehicle electric motor, an allowed motor vehicle maximum speed, an allowed motor vehicle maximum acceleration, navigation data, in particular a destination and / or a route, a motor vehicle lighting setting.

[0082] The at least one motor vehicle device is, for example, an element selected from the group of motor vehicle devices consisting of a steering system, a brake system, a drive system, a transmission, a motor vehicle environment sensor device comprising one or more environmental sensors, a drive motor, a motor vehicle lighting device, a navigation system.

[0083] Thus, it is also possible that the remote control signal does not control the lateral guidance and / or the longitudinal guidance of the motor vehicle, but rather that one or more motor vehicle parameters or motor vehicle settings, in particular a drive setting and / or a navigation setting, are adapted.

[0084] According to an implementation variant, the method according to the first aspect is a computer-implemented method.

[0085] According to an implementation variant, the method according to the first aspect is executed or carried out by means of the device according to the second aspect.

[0086] The device features are analogously generated by the respective method features and vice versa. This means, in particular, that the technical functions of the device according to the second aspect are generated analogously to the respective technical functions of the method according to the first aspect and vice versa.

[0087] The expression "at least one" represents, in particular, "one or more".

[0088] The expression "or" represents, in particular, "and / or".

[0089] The expression "and / or" represents, in particular, "or". BRIEF DESCRIPTION OF DRAWINGS

[0090] Embodiments of the application are shown in the drawings and are explained in detail in the following description. In the drawings:

[0091] Figure 1 A flow chart of a method for remotely controlling a motor vehicle is shown,

[0092] Figure 2 A device is shown,

[0093] Figure 3 A machine-readable storage medium is shown, and

[0094] Figure 4 A motor vehicle located within an infrastructure is shown. DETAILED DESCRIPTION

[0095] Figure 1 A flow chart of a method for remotely controlling a motor vehicle is shown, the method comprising the steps of:

[0096] determining 101 that a motor vehicle should be remotely controlled,

[0097] receiving 103 a safety condition signal, the safety condition signal representing at least one safety condition that has to be fulfilled in order to allow remotely controlling the motor vehicle,

[0098] checking 105 whether the at least one safety condition is fulfilled,

[0099] generating 107 a remote control signal for remotely controlling the motor vehicle on the basis of a result of the checking whether the at least one safety condition is fulfilled,

[0100] outputting 109 the generated remote control signal.

[0101] It is noted in this connection that the determining step 101 is an optional step. In another embodiment it can be provided that the determining step 101 is not included in the method according to the first aspect.

[0102] In an embodiment it is provided that a request signal is received, the request signal representing a request for remotely controlling the motor vehicle.

[0103] In response to the reception of the request signal, it is determined according to an embodiment that the motor vehicle should be remotely controlled.

[0104] In an embodiment it is provided that a situation signal is received, the situation signal representing a situation in which the motor vehicle is. According to an embodiment the situation signal is processed in order to derive whether the motor vehicle has to be remotely controlled. If it is derived that the motor vehicle has to be remotely controlled, it is determined according to an embodiment that the motor vehicle should be remotely controlled.

[0105] For example, the motor vehicle can be in a situation in which the motor vehicle cannot resolve or overcome by itself. It is determined, for example, that the motor vehicle should be remotely controlled.

[0106] For example, the checking result indicates that the at least one safety condition is fulfilled. For example, the checking result indicates that the at least one safety condition is not fulfilled.

[0107] In an embodiment it is provided that the remote control signal is generated only if the checking result indicates that the at least one safety condition is fulfilled.

[0108] In an embodiment it is provided that the generation of the remote control signal is abandoned if the checking result indicates that the at least one safety condition is not fulfilled.

[0109] According to an embodiment, the output 109 is configured to transmit the generated remote control signal to the motor vehicle via a communication network, in particular via a wireless communication network.

[0110] According to an embodiment, the method according to the first aspect comprises the step of remotely controlling the motor vehicle based on the output remote control signal.

[0111] Figure 2 The device 201 is shown.

[0112] The device 201 is configured to carry out all steps of the method according to the first aspect.

[0113] The device 201 comprises an input configured to receive the safety condition signal.

[0114] The device 201 further comprises a processor 205 configured to check whether the at least one safety condition is fulfilled.

[0115] The processor 205 is in another (not shown) embodiment in particular configured to determine that the motor vehicle shall be remotely controlled.

[0116] The processor 205 is further configured to generate a remote control signal.

[0117] The device 201 further comprises an output 207 configured to output the generated remote control signal.

[0118] According to an embodiment, the device 201 comprises a remote control device configured to remotely control the motor vehicle based on the output remote control signal.

[0119] Generally, the signal to be received is received by means of the input 203. Thus, the input 203 is in particular configured to receive the respective signal.

[0120] Generally, the signal to be output is output by means of the output 207. Thus, the output 207 is in particular configured to output the respective signal.

[0121] According to an embodiment, instead of one processor 205, a plurality of processors is provided.

[0122] According to an embodiment, the processor 205 is configured to carry out the previously and / or subsequently described generation step and the check step.

[0123] According to an embodiment, one or more method steps are carried out in the motor vehicle, in particular the steps of generating the remote control signal and outputting the remote control signal, and / or one or more method steps are carried out outside the vehicle, in particular in an infrastructure, preferably in a cloud infrastructure.

[0124] The device 201 is for example part of an infrastructure, in particular a cloud infrastructure, or part of a motor vehicle.

[0125] In order to redundantly implement the respective method steps, according to an embodiment a plurality of devices 201 can be provided, such that for example not only the motor vehicle comprises a device 201, but also the infrastructure, in particular the cloud infrastructure.

[0126] Figure 3 A machine-readable storage medium 301 is shown.

[0127] On the machine-readable storage medium 301 a computer program 303 is stored, the computer program 303 comprising instructions which, when the computer program 303 is executed by a computer, arrange the computer to implement the method according to the first aspect.

[0128] According to an embodiment, an infrastructure or infrastructure system is provided, which for example comprises a device according to the second aspect.

[0129] Figure 4 A motor vehicle 401 is shown, which is driving within an infrastructure 403.

[0130] The infrastructure 403 comprises a road 405, on which the motor vehicle 401 is driving.

[0131] The infrastructure 403 further comprises an environmental sensor 407, a light signal device 409, and a cloud infrastructure 411, in which for example a device according to the second aspect is arranged or provided.

[0132] In an embodiment not shown, the infrastructure 403 comprises a plurality of environmental sensors, which are arranged spatially distributed within the infrastructure.

[0133] The environmental sensors of the infrastructure 403 sense their respective environment and provide environmental sensor data corresponding to the respective sensed environment.

[0134] The environmental signal explained here is based on or comprises the environmental sensor data.

[0135] In an embodiment not shown, the infrastructure 403 comprises further traffic devices, for example signs, communication systems, in addition to or instead of the light signal device 409.

[0136] The motor vehicle 401 comprises an environmental sensor 413 at the roof side.

[0137] According to Figure 4The two environmental sensors 407, 413 are exemplarily shown as video cameras. It is noted that any environmental sensor as explained herein can be used.

[0138] In an embodiment not shown, the motor vehicle 401 can have further environmental sensors in addition to or instead of the environmental sensor 413, which are arranged, for example, at the front and / or rear and / or side of the motor vehicle.

[0139] Further in Figure 4 three double arrows 415, 417, 419 are marked. These double arrows characterize corresponding communication routes or, respectively, corresponding communication channels between the individual elements shown in Figure 4

[0140] The double arrow with reference 415 thus characterizes a communication route between the motor vehicle 401 and the cloud infrastructure 411.

[0141] The double arrow with reference 417 characterizes a communication route between the environmental sensor 407 of the infrastructure 403 and the cloud infrastructure 411.

[0142] The double arrow with reference 419 characterizes a communication route between the motor vehicle 401 and the light signal device 409.

[0143] According to the approach explained herein, in order to allow remote control of the motor vehicle 401, it is a prerequisite that the whole consisting of the motor vehicle 401 and the elements participating in the method according to the first aspect is safe and secure, i.e. "SAFE" and "SECURE".

[0144] The elements participating in the method according to the first aspect thus currently comprise, inter alia, the infrastructure 403 and the motor vehicle 401. According to the embodiment shown in Figure 4

[0145] Further, the corresponding communication routes 415, 417, 419 between the respective elements also belong to the whole.

[0146] This means, inter alia, that, for example, the communication route 415 between the motor vehicle 401 and the cloud infrastructure 411 is checked whether it is safe and secure.

[0147] Correspondingly, for example, it is checked whether the environmental sensor 407 is safe and secure.

[0148] ​​According to the approach described herein, one or more safety conditions are predefined as a criterion for whether the overall communication route or element is safe and reliable, and these safety conditions must be fulfilled in order to determine that the respective element or the respective communication route is safe.

[0149] For example, the communication route between two elements must have a minimum latency time, so that the communication route is considered to be safe and reliable.

[0150] For example, an environmental sensor must fulfill a certain quality criterion, so that the environmental sensor is considered to be safe and reliable.

[0151] For example, an environmental sensor data processing algorithm executed in the device according to the second aspect in the cloud infrastructure 411 must have a certain quality requirement.

[0152] For example, a certain emergency plan must be saved or stored in the cloud infrastructure 411 in order to allow remote control of the vehicle.

[0153] In one embodiment, the remote control comprises a change of the drive means (for example in order to reduce emissions, limit speed) and / or a predetermination of the trajectory to be driven over (for example due to predetermination, prevent accidents).

[0154] This means, in particular, that the remote control signal comprises an adaptation signal for adapting the drive setting of the motor vehicle drive means and / or an adaptation signal for adapting the navigation setting of the motor vehicle navigation system.

[0155] It follows that the remote control signal does not necessarily control the lateral guidance and / or longitudinal guidance of the motor vehicle, but rather can adapt one or more motor vehicle parameters and / or vehicle settings, in particular drive settings and / or navigation settings.

[0156] In one embodiment in the preparation phase (Vorfeld) of the intervention (remote control) and according to another embodiment during the intervention, it is ensured that the intervention or the action resulting therefrom is safe and reliable, which means, in particular, that the intervention does not lead to an accident. At the same time, this means, in particular, that the intervention must be "safe" and "reliable" (for a further explanation of these two concepts, reference is made to the further embodiments below), which means, in particular, that there is no change in the predetermination / action, for example by a hacker.

[0157] In one embodiment, for example, the following is provided:

[0158] An analysis or check is carried out as to whether at least one safety condition is fulfilled. Here, for example, it is checked when the remote control is reliable and when it is safe and reliable for an intervention from the outside;

[0159] analyzing or checking whether at least one safety condition is fulfilled at the point in time at which intervention is desired.

[0160] If yes, remote control is implemented by generating and outputting a corresponding remote control signal.

[0161] If no, no remote control is implemented, i.e. no corresponding remote control signal is generated and output.

[0162] Furthermore, in another embodiment, it is periodically checked during the intervention (remote control) whether the at least one safety condition is still fulfilled.

[0163] In the case that the at least one safety condition is no longer fulfilled, an emergency remote control signal is generated and output, for example on the basis of a specific emergency plan. The specific emergency plan is preferably analyzed and defined in the preparation phase for each individual possible error. For example, the emergency plan can bring the motor vehicle into a stationary state, i.e. into a safe and reliable driving state, as quickly as possible. Preferably, this is done in view of / considering the environment and in such a way that a warning to other road users is accompanied.

[0164] Furthermore, in another embodiment, it is periodically checked during the intervention (remote control) whether the planned remote control or the result of the planning of the remote control occurs.

[0165] If this is not the case, a reaction action is implemented, for example.

[0166] In one embodiment, the reaction action can comprise an additional action which also follows the original result. For example, braking is further increased and driving is further increased, for example in order to also achieve a desired speed.

[0167] In another embodiment, the reaction action can comprise interrupting the action, since the action is no longer goal-oriented (zielführend).

[0168] In another embodiment, an emergency remote control signal is generated and output on the basis of an emergency plan in relation to the situation / error.

[0169] In another embodiment, an emergency remote control signal is generated and output on the basis of an emergency plan, in particular specifically in the case of an error.

[0170] The checking of whether the at least one safety condition is fulfilled is based, in particular, on a check of under which pre-given and / or conditions the planned remote control is safe and reliable.

[0171] Here, first of all, it is analyzed, for example, which dangers the action (remote control) can have. In particular, whether it is possible to cause an accident with damage (to a motor vehicle, etc.), in particular whether it is possible to cause an accident with injuries or deaths of participants.

[0172] In the following, it is examined according to an embodiment how these consequences can be prevented.

[0173] Here, in particular, it is sought how to deal with errors, i.e. whether a reaction action and / or an emergency plan ("fallback action") should be implemented and, if so, which reaction action and / or emergency plan should be implemented.

[0174] Here, there are, in particular, static pre-givings and / or conditions and / or, in particular, dynamic pre-givings and / or conditions, more precisely, in particular, for the entire system, which preferably consists of at least a motor vehicle, infrastructure (in particular traffic means, sensors and components in the infrastructure), computing means in the infrastructure and / or in the cloud and communication routes (e.g. WLAN / WIFI and / or mobile radio).

[0175] The pre-givings are therefore, in particular, applicable to the entire system and, in the following, in particular, to all parts of the entire system.

[0176] Here, the static pre-givings or conditions are preferably analyzed in the preparation phase (before the remote control) and generally do not change over time. For example, which components are present in the process and how safe and secure (in general) are these components.

[0177] Here, the current state of the dynamic pre-givings or conditions can not be analyzed in the preparation phase, but depends on the current situation. For example:

[0178] How is the current environment (number of traffic participants, weather...)?

[0179] Are the components currently error-free?

[0180] However, it is preferably analyzed in the preparation phase how the then present states of the dynamic pre-givings or conditions should be reacted to. Thus, for example, the action (remote control) can be implemented. Or the action can only be implemented restrictedly / partially / with limitations.

[0181] In the case of static pre-givings or conditions, in particular, it is analyzed: which qualities the entire system must have and / or which qualities the participating components (availability, failure rate, accuracy...) must have and / or which qualities the participating algorithms, measures, methods (e.g. tests, processes, redundant calculations...) must have.

[0182] Furthermore, it is analyzed, inter alia, how the overall context must be. For example, with regard to the overall time behavior of the system and thus of the individual individual systems / methods: for example, how fast, where, in which way, which aspects (for example waiting behavior) must be calculated and transmitted.

[0183] Here, for example (depending on the specific remote control), it is investigated: (A)SILs of the overall system, (A)SILs of components, (A)SILs of methods / measures, latency and bandwidth for data transmission, time / reaction function for calculation / communication, security measures (hacker protection), redundancy / diversity of components / algorithms / communication possibilities required in the event of necessity, service quality, availability specification, measures for reducing errors / failures / error analysis / misinterpretation, backup scenarios, permissions of functions / traffic situations, etc. Permissions of weather, etc. / , etc.

[0184] For this purpose, inter alia, there are rules, standards, etc. (for development, quality analysis, etc.):

[0185] https: / / de.wikipedia.org / wiki / Sicherheitsanforderungsstufe

[0186] https: / / de.wikipedia.org / wiki / ISO_26262.

[0187] This means, inter alia, that it is analyzed under which pre-givens / conditions the described action can / may be carried out without consequences (accidents, serious injuries, deaths).

[0188] In the analysis of whether the pre-givens are met at the point in time at which the intervention is desired, for example, it is checked whether the pre-givens are currently present (statically, dynamically, i.e. whether the pre-givens are met.

[0189] And below, in relation to the result of the analysis, the remote control signal is generated and output accordingly or not at all.

[0190] Here, the checks (is the pre-given currently present? Is the action carried out correctly? Etc.) can or should preferably be carried out several times (out of safety -> safety / reliability), in particular by different methods, in particular also on different systems. Thus, the checks are carried out, inter alia, redundantly and diversely.

[0191] Since consequences (deaths, etc.) can arise, this process is preferably recorded in a forgery-proof and comprehensible manner, for example in a blockchain

[0192] According to an embodiment, a precondition for remote control or intervention is that the remote control is safe and secure. In the sense of the present description, "safe and secure" means, inter alia, "safe" and "secure". Although both English terms are usually translated into German as "sicher", they have partly different meanings in English.

[0193] The term "safe" is inter alia directed to the topic of accidents and accident avoidance. A "safe" remote control is inter alia characterized by the fact that the probability of an accident or collision is less than or equal to a predetermined probability threshold.

[0194] The term "secure" is inter alia directed to the topic of computer protection or hacker protection, i.e. inter alia how securely the (computer) infrastructure and / or the communication infrastructure between the motor vehicle and the remote control device for remote control of the motor vehicle is protected against unauthorized access or data manipulation by third parties ("hackers").

[0195] A "secure" remote control is therefore inter alia based on adequate and sufficient computer protection or hacker protection.

[0196] For example, according to an embodiment, it is checked whether the overall system consisting of the motor vehicle and the infrastructure participating in the method according to the first aspect, including the communication between the infrastructure and the motor vehicle, is currently safe and secure for the scenario "intervene in the motor vehicle for critical actions" described herein. This means inter alia that the motor vehicle and / or the local infrastructure and / or the global infrastructure and / or the communication are checked accordingly. The remote control signal is generated inter alia on the basis of the results of the check.

[0197] This means inter alia that the components used in the implementation of the method according to the first aspect are checked in terms of safety, i.e. it is checked whether these components meet certain safety conditions before the intervention in the driving operation, i.e. before the remote control of the motor vehicle, is carried out.

[0198] Important criteria or relevant criteria are for example one or more of the above-mentioned safety conditions.

[0199] According to an embodiment, it is provided that the entire system (motor vehicle, infrastructure, communication route, cloud, etc.) is checked inter alia in terms of safety conditions.

[0200] According to an embodiment, it is also checked whether the individual parts meet the safety conditions. This is inter alia carried out before the remote control of the motor vehicle.

[0201] Herein, in one embodiment, the one or more checking steps are implemented within the motor vehicle and / or outside the motor vehicle, in particular in the infrastructure.

[0202] According to one embodiment, the checking steps are checked later, i.e. at a later point in time, for example periodically. For example, the one or more checking steps are checked later with a predetermined frequency, for example every 100 ms.

[0203] For example, according to one embodiment, such a check is carried out before and / or after and / or during one or more predetermined method steps, i.e. a check is carried out as to whether at least one safety condition is fulfilled.

[0204] According to one embodiment, the check is carried out or performed in case of a problem.

Claims

1. A method for remote control of a motor vehicle (401), comprising the following steps: receiving (103) a safety condition signal representing at least one safety condition which must be fulfilled in order to allow remote control of the motor vehicle (401); checking (105) whether the at least one safety condition is fulfilled; generating (107) a remote control signal for remote control of the motor vehicle (401) on the basis of the result of the checking of whether the at least one safety condition is fulfilled; outputting (109) the generated remote control signal, wherein, after outputting the remote control signal, a check is made of the remote control of the motor vehicle (401) on the basis of the outputted remote control signal in order to detect errors, wherein, in the event of a detected error, an emergency remote control signal for remote control of the motor vehicle (401) in an emergency situation is generated and outputted, wherein an emergency plan signal is received, the emergency plan signal representing a specific emergency plan for the detected error, wherein the emergency remote control signal is generated on the basis of the specific emergency plan, wherein, in addition, it is checked periodically whether the emergency plan signal is received and / or the emergency remote control signal is generated, wherein, if the emergency plan signal is not received and / or the emergency remote control signal is not generated, a reaction action is carried out. The at least one safety condition is respectively an element selected from the following safety condition group: there is a safety integrity level of at least the motor vehicle (401) and of an infrastructure (403) for remote control of the motor vehicle (401); there is a maximum waiting time of a communication between the motor vehicle (401) and a remote control device for remote control of the motor vehicle (401) on the basis of a remote control signal; there is a predetermined computer protection level of a device for carrying out the method steps; there are predetermined components and / or algorithms and / or communication possibilities for carrying out the method steps; there is a redundancy and / or diversity in predetermined components and / or algorithms and / or communication possibilities for carrying out the method steps; there is a predetermined availability specification which specifies the availability of predetermined components and / or algorithms and / or communication possibilities; there are predetermined quality criteria of predetermined components and / or algorithms and / or communication possibilities; there is a plan which comprises measures for reducing errors and / or measures in the event of failure of predetermined components and / or algorithms and / or communication possibilities and / or measures for error analysis and / or measures in the event of misinterpretation; there is one or more backup scenarios; there is a predetermined functionality; there is a predetermined traffic situation; there is a predetermined weather; there is a maximum possible time for carrying out one or more method steps respectively; there is a checking result that an element or a functionality for carrying out the method is currently functioning without errors. The remote control signal is generated only when the at least one safety condition is fulfilled. ​ ​ ​ ​ ​ 2. The method of claim 1, wherein, ​ ​ ​ ​ ​ ​ 3. The method of claim 1 or 2, wherein, ​ 4. The method of claim 1 or 2, wherein, Checking whether the at least one safety condition is fulfilled before and / or after and / or during implementing one or more predetermined method steps.

5. The method of claim 1 or 2, wherein, The checking of the remote control comprises checking whether the at least one safety condition is fulfilled, wherein it is determined that a result stating that the at least one safety condition is not fulfilled is false.

6. The method of claim 1 or 2, wherein, The checking of the remote control comprises checking whether a result to be achieved by the remote control is achieved, wherein it is determined that a checking result stating that the result to be achieved by the remote control is not achieved is false.

7. The method of claim 6, wherein, As an additional alternative to generating and outputting the emergency remote control signal, other remote control signals for remotely controlling the motor vehicle (401) are generated and outputted on the basis of the result to be achieved, so that the result to be achieved is still achieved when remotely controlling the motor vehicle (401) on the basis of the other remote control signals.

8. The method of claim 1 or 2, wherein, The checking whether the at least one safety condition is fulfilled comprises checking whether the at least one safety condition is fulfilled at a predetermined time.

9. The method of claim 1 or 2, wherein, A situation signal is received, which represents a situation in which the motor vehicle (401) is, wherein a table signal is received, which represents a table, which predetermines a predetermined situation for a predetermined pre-given for remotely controlling the motor vehicle (401), wherein the situation in which the motor vehicle (401) is is assigned to one of the predetermined situations, wherein the remote control signal is generated on the basis of the pre-given for remotely controlling the motor vehicle (401) corresponding to the predetermined situation.

10. The method of claim 1 or 2, wherein, One or more method steps are implemented in addition to the step of generating and outputting the remote control signal inside the motor vehicle, and / or wherein one or more method steps are implemented outside the motor vehicle.

11. The method of claim 1 or 2, wherein, One or more method steps are logged.

12. The method of claim 1 or 2, wherein, Checking whether the overall system consisting of the motor vehicle (401) and the infrastructure (403) participating in the method according to any one of the preceding claims is safe and reliable, including the communication between the infrastructure (403) and the motor vehicle (401), so that the motor vehicle (401) and / or the local infrastructure and / or the global infrastructure and / or the communication between the motor vehicle (401) and the infrastructure (403) is checked accordingly.

13. The method of claim 2, wherein, One of the safety conditions comprises a predetermined safety integrity level of the communication route (415, 417, 419) and / or of the communication components.

14. The method of claim 2, wherein, One of the safety conditions comprises a predetermined safety integrity level with respect to the overall system and individual parts in the motor vehicle (401) and the infrastructure (403).

15. The method of claim 14, wherein, The individual parts are components, algorithms, interfaces.

16. The method of claim 10, wherein, One or more method steps are implemented in the infrastructure (403).

17. The method of claim 16, wherein, The infrastructure (403) is a cloud infrastructure.

18. The method of claim 11, wherein, One or more method steps are logged in a blockchain.

19. A device (201) set up for implementing all steps of the method according to any one of claims 1 to 18.

20. A computer program product comprising a computer program which comprises instructions arranged to cause a computer to implement the method according to any one of claims 1 to 18 when said computer program is executed by the computer.

21. A machine readable storage medium (301) on which a computer program (303) is stored, the computer program comprising instructions arranged to cause a computer to implement the method according to any one of claims 1 to 18 when said computer program (303) is executed by the computer.

Images