Equipment used to control the autonomous driving operation of the vehicle

Abstract

The present invention relates to a device (1) for controlling an automatic driving operation of a vehicle, the device comprising at least two braking systems (2.1, 2.2), at least two steering systems (3.1, 3.2), an engine controller, a first automatic driving controller (ADC1) and a second automatic driving controller (ADC2), an environmental sensor assembly (6) and an inertial sensor, wherein the automatic driving controllers (ADC1, ADC2) are designed to be redundant and are configured to plan a trajectory of the vehicle based on signals from the environmental sensor assembly (6) and the inertial sensor, generate target values ​​of acceleration and steering angle required for driving along the planned trajectory, and transmit the target values ​​to the braking systems (2.1, 2.2), the steering systems (3.1, 3.2) and the engine controller, and a third automatic driving controller (ADC3) is provided. The third automatic driving controller is at least configured to control the parking of the vehicle, and the device (1) is configured so that the automatic driving operation is started and / or maintained only when the braking system (2.1, 2.2), the steering system (3.1, 3.2) and at least two of the automatic driving controllers (ADC1, ADC2, ADC3) can operate normally, and if only one of the automatic driving controllers (ADC1, ADC2, ADC3) can operate normally and / or if one of the braking systems (2.1, 2.2) and / or one of the steering systems (3.1, 3.2) and / or the engine controller cannot operate normally, the automatic driving operation is terminated, in which case the automatic driving controller (ADC1, ADC2, ADC3) that is still operating normally takes over the vehicle control and guides the vehicle to park.

Description

Technical Field

[0001] The present invention relates to a device for controlling automatic driving operation of a vehicle. Background Art

[0002] Single redundancy in automated driving controllers (ADCs) is known in the prior art. With single redundancy, any single failure in a critical component of the AD suite triggers a fallback level that includes an immediate shutdown (degradation level 1). Due to the complex architecture, this fallback level can be required very frequently, leading to so-called "paralysis." A second fallback level is implemented in the braking system (EBS) as an emergency shutdown for double failures (degradation level 2). Summary of the Invention

[0003] The object of the present invention is to provide an improved device for controlling an autonomous driving operation of a vehicle.

[0004] According to the invention, this object is achieved by the device according to the invention.

[0005] According to the present invention, a device for controlling automated driving operation of a vehicle includes at least two braking systems, at least two steering systems, an engine controller, a first automated driving controller, a second automated driving controller, an environmental sensor assembly, and an inertial sensor. The automated driving controllers are redundantly configured to plan a vehicle trajectory based on signals from the environmental sensor assembly and the inertial sensor, generate target values ​​for acceleration and steering angle required for driving along the planned trajectory, and transmit these target values ​​to the braking system, steering system, and engine controller. According to the present invention, a third automated driving controller is provided, which is configured at least to control parking of the vehicle. The device is configured to initiate and / or maintain automated driving operation only when the braking system, steering system, and at least two of the automated driving controllers are functioning properly. The automated driving operation is terminated if only one of the automated driving controllers is functioning properly and / or if one of the braking systems, one of the steering systems, and / or the engine controller is not functioning properly. In this case, the still functioning automated driving controller takes over vehicle control and guides the vehicle to a parking position. According to the present invention, a first power supply unit is provided for supplying power to one of the steering systems and one of the braking systems, and / or a second power supply unit is provided for supplying power to the first autonomous driving controller and the first motion sensor assembly, and / or a third power supply unit is provided for supplying power to the other braking system, the other steering system, the second autonomous driving controller, and the second motion sensor assembly. According to the present invention, one of the two braking systems and the steering system is connected to a first actuator bus and to the first autonomous driving controller; the two braking systems and the other steering system are connected to a second actuator bus and to the second autonomous driving controller.

[0006] To achieve high functional reliability, the system includes multiple controllers, multiple steering systems, and multiple braking systems. Based on various sensor signals, the controllers plan a trajectory and generate acceleration and steering angle target values ​​to ensure the vehicle follows the planned trajectory. These target values ​​are adjusted by the vehicle's steering and braking systems, as well as the engine controller. The engine controller is configured to achieve the target torque specified by the braking system in the vehicle's drive unit (internal combustion engine / electric motor).

[0007] According to the present invention, at least three controllers are provided, one of which is designed as a secondary controller solely for parking the vehicle, while the other controllers are designed as primary controllers for automatically guiding the vehicle. Automatic driving is initiated and executed only if and as long as the steering and braking systems and at least two controllers are functioning properly. If only one control unit is functioning properly, or if one of the steering systems, one of the braking systems, or the engine controller is no longer functioning properly, the automatic driving is terminated, and the remaining functioning controller takes over control of the vehicle and specifically guides it to a parking position.

[0008] By adding a third, simpler autopilot controller (ADC) to the two commonly used autopilot master controllers, the overall system availability is significantly improved, providing greater safety against common causes and system failures in the presence of two autopilot master controllers. The quality and performance of the second fallback level are significantly improved by using an environmental sensor component in this fallback level. By adding this fallback level, the overall degradation scheme is again significantly improved.

[0009] Extending the degradation scheme with another fallback level yields the following advantages:

[0010] - Increased availability of automated driving functions (unavailability was roughly halved),

[0011] - A high-quality fallback level is also available for double faults or system failures,

[0012] - ensure lane keeping in the event of any single fault, and

[0013] - Minimize the probability of emergency stops (last fallback level) in the braking system.

[0014] In one embodiment, the third automatic driving controller is designed solely for controlling vehicle parking. This additional third automatic driving controller is, for example, a slave controller whose functional scope is smaller than the primary automatic driving controller. Therefore, this additional third automatic driving controller can also be manufactured at a lower cost than the automatic driving controller. In this embodiment, the third automatic driving controller is not designed to continue automatic driving operation. It is designed solely for guiding the vehicle to a safe parking position. The goal is to park the vehicle in the safest possible location, such as on the side of the road.

[0015] In one embodiment, the two brake systems are redundant with respect to one another and / or the two steering systems are redundant with respect to one another.

[0016] In one embodiment, the first autopilot controller and the second autopilot controller are connected to each other via a motion sensor bus and are connected to the first motion sensor assembly, and / or the second motion sensor assembly is connected to the second actuator bus.

[0017] In one embodiment, the third autopilot controller is connected to the first actuator bus and the second actuator bus.

[0018] The third automatic driving controller is connected to the first power supply unit or the second power supply unit or the third power supply unit or the fourth power supply unit.

[0019] In one specific embodiment, the third autonomous driving controller configured as a slave controller and the two first and second autonomous driving controllers configured as master controllers are configured to access an environmental sensor assembly via a sensor COM bus. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0021] Figure 1 A schematic diagram showing an apparatus for controlling an autonomous driving operation of a vehicle according to the prior art; and

[0022] Figure 2 A schematic diagram shows a device for controlling automatic driving operation of a vehicle according to the present invention. DETAILED DESCRIPTION

[0023] In all the figures, mutually corresponding parts are provided with the same reference numerals.

[0024] Figure 1 A schematic diagram of a device 1 for controlling an autonomous driving operation of a vehicle according to the prior art is shown.

[0025] The device 1 includes a first braking system 2.1 and a second braking system 2.2 that are redundant with each other. In addition, a first steering system 3.1 and a second steering system 3.2 that are redundant with each other are provided. The first braking system 2.1, the second braking system 2.2, and the first steering system 3.1 are connected to a first actuator bus COM1 and to a first autonomous driving controller ADC1. In addition, the first braking system 2.1 and the second steering system 3.2 are connected to a second actuator bus COM2 and to a second autonomous driving controller ADC2. The first autonomous driving controller ADC1 and the second autonomous driving controller ADC2 are connected to each other via a motion sensor bus COMM and to a first motion sensor assembly 4.1. The second motion sensor assembly 4.2 is connected to a second actuator bus COM2.

[0026] The first power supply unit 5.1 is used to power the first steering system 3.1 and the second braking system 2.2. The second power supply unit 5.2 is used to power the first autonomous driving controller ADC1 and the first motion sensor assembly 4.1. The third power supply unit 5.3 is used to power the first braking system 2.1, the second steering system 3.2, the second autonomous driving controller ADC2, and the second motion sensor assembly 4.2.

[0027] The environment sensor assembly 6 includes an environment sensor system, which includes, for example, one or more radar sensors, lidar sensors, and cameras, whose signals are transmitted to the automatic driving controllers ADC1 and ADC2 (for example, via a sensor COM bus).

[0028] Motion sensor assemblies 4.1 and 4.2 include inertial sensor systems, each comprising three rotational speed sensors and three inertial sensors for three coordinate axes. A DGNSS (Differential Global Navigation Satellite System) sensor system is installed at a suitable location, such as in one of the motion sensor assemblies 4.1 and 4.2, for satellite-assisted positioning.

[0029] The autonomous driving controllers ADC1 and ADC2 are designed to be redundant. They operate in parallel and perform the same tasks: based on signals from the environmental sensor assembly 6, the inertial sensors of the motion sensor assemblies 4.1 and 4.2, and the DGNSS sensors, they plan the trajectory to be driven autonomously by the vehicle and determine the target values ​​for the acceleration and steering angle required to drive along the planned trajectory.

[0030] The acceleration target values ​​are transmitted to the redundantly designed braking systems 2.1 and 2.2 and to the engine controller (not shown). The engine controller can, but need not, be redundant. The engine controller converts positive and partially negative acceleration target values ​​into driving torque or recuperation torque, and the braking systems 2.1 and 2.2 convert negative acceleration target values ​​(i.e., deceleration values) into braking torque for the vehicle's brakes.

[0031] The target value for the steering angle is transmitted to steering systems 3 . 1 , 3 . 2 , which are also designed redundantly, and which adjust the steering angle at the steerable wheels of the vehicle in accordance with the target value.

[0032] The two steering systems 3.1, 3.2 work together. They are designed so that they can also perform their tasks independently. That is, if one of the steering systems 3.1, 3.2 fails, the other steering system 3.1, 3.2, which is still functioning properly, continues to function independently. However, it must do more work. The steering system 3.1, 3.2 that is still functioning properly detects the failure of the other steering system 3.1, 3.2 from the fact that the other steering system 3.1, 3.2 is not providing a control signal to the steering actuator. The steering system 3.1, 3.2 that is functioning properly reports the failure of the other steering system 3.1, 3.2 to the two automatic driving controllers ADC1, ADC2, allowing them to make decisions regarding further driving operations.

[0033] The two brake systems 2.1, 2.2 work together. They are designed so that they can also perform their tasks independently, that is, if one of the brake systems 2.1, 2.2 fails, the brake system 2.1, 2.2 that is still functioning normally continues to work independently. However, it has to do more work. The brake system 2.1, 2.2 that is still functioning normally recognizes the failure of the other brake system 2.1, 2.2 from the fact that the other brake system 2.1, 2.2 does not provide a control signal to the brake actuator. The brake system 2.1, 2.2 that is still functioning normally reports the failure of the other brake system 2.1, 2.2 to the automatic driving controller ADC1, ADC2 so that they can make a decision on further driving operation. In one embodiment, the first brake system 2.1 may include an electronic stability program. The second brake system 2.2 may include an electronic brake booster.

[0034] Since both autopilot controllers ADC1, ADC2 operate in parallel, if they are fully functional, they also provide corresponding target values ​​in parallel, and these target values ​​are also within a predetermined valid range. Braking systems 2.1, 2.2 and steering systems 3.1, 3.2 recognize this and, in this case, perform steering or braking interventions based solely on the target value of one of the autopilot controllers ADC1, ADC2. The target value of the other autopilot controller ADC1, ADC2 is not considered when performing steering or braking interventions. If one of the autopilot controllers ADC1, ADC2 fails to provide a target value or provides an invalid target value (outside the valid range), a failure of the corresponding autopilot controller ADC1, ADC2 is inferred, and a corresponding notification is issued to the still functioning autopilot controller ADC1, ADC2.

[0035] If one of the steering systems 3.1, 3.2 or one of the brake systems 2.1, 2.2 fails, the vehicle is safely braked to a stop using the still functioning system 2.1, 2.2, 3.1, 3.2. The goal is to park the vehicle in the safest possible position, such as on the side of the road.

[0036] This also applies if one of the automated driving controllers ADC1 or ADC2 fails, regardless of whether the failure is due to an internal fault in one of the automated driving controllers ADC1 or ADC2, a fault in the power supply units 5.1, 5.2, or 5.3, or a fault in one of the actuator buses COM1 or COM2. This means that if the first automated driving controller ADC1 fails, the vehicle cannot continue driving, even though the second automated driving controller ADC2 is still fully functional and automated driving could therefore continue. Automatic driving is only permitted if there is redundancy; if the first automated driving controller ADC1 fails, automated driving is no longer permitted. This also applies if the second automated driving controller ADC2 fails while the first automated driving controller ADC1 is still fully functional.

[0037] If both automated driving controllers ADC1 and ADC2 fail, the vehicle is braked to a standstill in a targeted manner using first brake system 2.1. First brake system 2.1 uses signals from the inertial sensors of second motion sensor assembly 4.2 to control lateral dynamics (through steering intervention (steering angle control)) in order to keep the vehicle stable in its lane during braking.

[0038] Figure 2 A schematic diagram of a device 1 according to the invention for controlling an automated driving operation of a vehicle is shown.

[0039] The device 1 includes a first braking system 2.1 and a second braking system 2.2 that are redundant with each other. In addition, a first steering system 3.1 and a second steering system 3.2 that are redundant with each other are provided. The first braking system 2.1, the second braking system 2.2, and the first steering system 3.1 are connected to a first actuator bus COM1 and to a first autonomous driving controller ADC1. In addition, the first braking system 2.1, the second braking system 2.2, and the second steering system 3.2 are connected to a second actuator bus COM2 and to a second autonomous driving controller ADC2. The first autonomous driving controller ADC1 and the second autonomous driving controller ADC2 are connected to each other via a motion sensor bus COMM and to a first motion sensor assembly 4.1. The second motion sensor assembly 4.2 is connected to a second actuator bus COM2.

[0040] Furthermore, a third automatic driving controller ADC3 is provided, which is connected to the first actuator bus COM1 and the second actuator bus COM2, and therefore the signal of the second motion sensor assembly 4.2 is also supplied to the third automatic driving controller.

[0041] The first power supply unit 5.1 is used to power the first steering system 3.1, the second braking system 2.2, and the third autonomous driving controller ADC3. The second power supply unit 5.2 is used to power the first autonomous driving controller ADC1 and the first motion sensor assembly 4.1. The third power supply unit 5.3 is used to power the first braking system 2.1, the second steering system 3.2, the second autonomous driving controller ADC2, and the second motion sensor assembly 4.2. The third autonomous driving controller ADC3 can also be powered by any of the other power supply units 5.2 and 5.3, or by a fourth power supply unit.

[0042] The environmental sensor assembly 6 includes an environmental sensor system, which includes, for example, one or more radar sensors, lidar sensors, and cameras, whose signals are transmitted to the automatic driving controllers ADC1, ADC2, and ADC3.

[0043] Motion sensor assemblies 4.1 and 4.2 include inertial sensor systems, each comprising three rotational speed sensors and three inertial sensors for three coordinate axes. A DGNSS (Differential Global Navigation Satellite System) sensor system is installed at a suitable location, such as in one of the motion sensor assemblies 4.1 and 4.2, for satellite-assisted positioning.

[0044] The autonomous driving controllers ADC1 and ADC2 are the main controllers. They are designed to be redundant. They operate in parallel and perform the same tasks: based on the signals from the sensors of the environmental sensor assembly 6, the inertial sensors of the motion sensor assemblies 4.1 and 4.2, and the DGNSS sensors, they plan the trajectory to be driven automatically by the vehicle and determine the target values ​​for the acceleration and steering angle required to drive along the planned trajectory. The additional third autonomous driving controller ADC3 is a secondary controller, with a smaller functional scope than the autonomous driving controllers ADC1 and ADC2 designed as the main controllers. Therefore, the additional third autonomous driving controller ADC3 can also be manufactured at a lower cost than the autonomous driving controllers ADC1 and ADC2. The third autonomous driving controller ADC3 is not designed to continue the autonomous driving operation. The third autonomous driving controller ADC3 is designed only to guide the vehicle to a safe parking position. The goal is to park the vehicle in the safest possible position, such as on the side of the road.

[0045] The acceleration target values ​​are transmitted to the redundantly designed braking systems 2.1 and 2.2 and to the engine controller (not shown). The engine controller can, but need not, be redundant. The engine controller converts positive and partially negative acceleration target values ​​into driving torque or recuperation torque, and the braking systems 2.1 and 2.2 convert negative acceleration target values ​​(i.e., deceleration values) into braking torque for the vehicle's brakes.

[0046] The target value for the steering angle is transmitted to steering systems 3 . 1 , 3 . 2 , which are also designed redundantly and which adjust the steering angle at the steerable wheels of the vehicle in accordance with the target value.

[0047] The two steering systems 3.1, 3.2 work together. They are designed so that they can also perform their tasks independently. That is, if one of the steering systems 3.1, 3.2 fails, the other steering system 3.1, 3.2, which is still functioning properly, continues to function independently. However, it must do more work. The steering system 3.1, 3.2 that is still functioning properly detects the failure of the other steering system 3.1, 3.2 from the fact that the other steering system 3.1, 3.2 is not providing a control signal to the steering actuator. The steering system 3.1, 3.2 that is functioning properly reports the failure of the other steering system 3.1, 3.2 to the two automatic driving controllers ADC1, ADC2, allowing them to make decisions regarding further driving operations.

[0048] The two brake systems 2.1, 2.2 work together. They are designed so that they can also perform their tasks independently, that is, if one of the brake systems 2.1, 2.2 fails, the brake system 2.1, 2.2 that is still functioning normally continues to work independently. However, it has to do more work. The brake system 2.1, 2.2 that is still functioning normally recognizes the failure of the other brake system 2.1, 2.2 from the fact that the other brake system 2.1, 2.2 does not provide a control signal to the brake actuator. The brake system 2.1, 2.2 that is still functioning normally reports the failure of the other brake system 2.1, 2.2 to the automatic driving controller ADC1, ADC2 so that they can make a decision on further driving operation. In one embodiment, the first brake system 2.1 may include an electronic stability program. The second brake system 2.2 may include an electronic brake booster.

[0049] Since both autopilot controllers ADC1, ADC2 operate in parallel, if they are fully functional, they also provide corresponding target values ​​in parallel, and these target values ​​are also within a predetermined valid range. Braking systems 2.1, 2.2 and steering systems 3.1, 3.2 recognize this and, in this case, perform steering or braking interventions based solely on the target value of one of the autopilot controllers ADC1, ADC2. The target value of the other autopilot controller ADC1, ADC2 is not considered when performing steering or braking interventions. If one of the autopilot controllers ADC1, ADC2 fails to provide a target value or provides an invalid target value (outside the valid range), a failure of the corresponding autopilot controller ADC1, ADC2 is inferred, and a corresponding notification is issued to the still functioning autopilot controller ADC1, ADC2.

[0050] If one of the steering systems 3.1, 3.2 or the braking systems 2.1, 2.2 fails, the vehicle is safely braked to a stop using the still functioning systems 2.1, 2.2, 3.1, 3.2. The goal is to park in the safest possible position, such as on the side of the road.

[0051] If one of the automatic driving controllers ADC1, ADC2 fails, whether due to an internal fault in one of the automatic driving controllers ADC1, ADC2, a fault in the power supply units 5.1, 5.2, 5.3, or a fault in one of the actuator buses COM1, COM2, the surviving automatic driving controller ADC1, ADC2 takes over control, and the vehicle thus continues its automatic driving (first fallback level: continue automatic driving operation). An additional third automatic driving controller ADC3 serves as an additional safety feature, taking over vehicle control and braking the vehicle to a standstill if an additional fault also occurs in the previously surviving automatic driving controller ADC1, ADC2 (second fallback level: terminate automatic driving operation). A failure of one of the two automatic driving controllers ADC1, ADC2, designed as the primary controller, therefore does not render the vehicle "unable to continue driving," as long as the automatic driving controller ADC3, designed as the secondary controller, is functioning properly.

[0052] If both automatic driving controllers ADC1 and ADC2 fail, the third automatic driving controller ADC3 takes over and brakes the vehicle safely to a stop using the still functioning systems. The goal is to park the vehicle in the safest possible position, such as on the side of the road.

[0053] If two autonomous driving controllers ADC1 and ADC2, designed as master controllers, fail, and a third autonomous driving controller ADC3, additionally designed as slave controller, also fails, the vehicle is braked to a standstill in a targeted manner using first brake system 2.1. First brake system 2.1 performs lateral dynamics control (via steering intervention (steering angle control)) based on signals from the inertial sensors of second motion sensor assembly 4.2 in order to keep the vehicle stable in its lane during braking.

[0054] If one of the autonomous driving controllers ADC1 or ADC2 configured as the main controller or the third autonomous driving controller ADC3 configured as the secondary controller fails, the surviving autonomous driving controller ADC1 or ADC2 configured as the main controller takes over control tasks and guides the vehicle to a stop. In this case, autonomous driving will not continue.

[0055] If the third autonomous driving controller ADC3, configured as a slave controller, fails, control tasks continue to be fulfilled by the autonomous driving controller ADC1, configured as the master controller, and the vehicle thus continues its autonomous driving (first fallback level: continuing autonomous driving). The second autonomous driving controller ADC2, configured as the master controller, can serve as an additional safety device. If an additional failure also occurs in the first autonomous driving controller ADC1, it can take over control of the vehicle and brake it to a stop (second fallback level: terminating autonomous driving operation). Therefore, a failure of the third autonomous driving controller ADC3, configured as a slave controller, does not render the vehicle "unable to continue driving" as long as both autonomous driving controllers ADC1 and ADC2, configured as master controllers, remain functional.

[0056] In one embodiment, a third autonomous driving controller ADC3, configured as a slave controller, can be connected to the first actuator bus COM1, either alternatively or in addition. Alternatively, the power supply for the third autonomous driving controller ADC3, configured as a slave controller, can also be supplied by one of the two other power supply units 5.1, 5.3. As a further possibility for further increasing availability, an additional fourth on-board electrical network can also be used. In addition to the two autonomous driving controllers ADC1, ADC2, configured as master controllers, the third autonomous driving controller ADC3, configured as a slave controller, can also access the entire sensor system of the environmental sensor assembly 6, for example via the sensor COM bus.

[0057] Reference Signs List

[0058] 1 device

[0059] 2.1 First brake system

[0060] 2.2 Second brake system

[0061] 3.1 First Steering System

[0062] 3.2 Second Steering System

[0063] 4.1 First motion sensor assembly

[0064] 4.2 Second motion sensor assembly

[0065] 5.1 First power supply unit

[0066] 5.2 Second power supply unit

[0067] 5.3 The third power supply unit

[0068] 6 Environmental sensor components

[0069] ADC1 first autonomous driving controller

[0070] ADC2 second autonomous driving controller

[0071] ADC3 third autonomous driving controller

[0072] COM1 First actuator bus

[0073] COM2 Second actuator bus

[0074] COMM Motion Sensor Bus

Claims

1. A device (1) for controlling an automatic driving operation of a vehicle, the device comprising at least two braking systems (2.1, 2.2), at least two steering systems (3.1, 3.2), an engine controller, a first automatic driving controller (ADC1) and a second automatic driving controller (ADC2), an environmental sensor assembly (6) and an inertial sensor, wherein the first automatic driving controller (ADC1) and the second automatic driving controller (ADC2) are designed as main controllers for automatically guiding the vehicle, the first automatic driving controller (ADC1) and the second automatic driving controller (ADC2) are designed to be redundant and work in parallel, and are configured to plan a trajectory of the vehicle based on signals from the environmental sensor assembly (6) and the inertial sensor and generate target values ​​of acceleration and steering angle required for driving along the planned trajectory and transmit the target values ​​to the braking systems (2.1, 2.2), the steering systems (3.1, 3.2) and the engine controller, characterized in that A third automatic driving controller (ADC3) is provided, which is at least configured to control the parking of the vehicle, and the device (1) is configured so that the automatic driving operation is started and / or maintained only when the braking system (2.1, 2.2), the steering system (3.1, 3.2) and at least two of the automatic driving controllers (ADC1, ADC2, ADC3) are able to operate normally, and if only one of the automatic driving controllers (ADC1, ADC2, ADC3) is able to operate normally and / or if one of the braking systems (2.1, 2.2) and / or one of the steering systems (3.1, 3.2) and / or the engine controller cannot operate normally, the automatic driving operation is terminated, in which case the automatic driving controller (ADC1, ADC2, ADC3) that is still operating normally takes over the vehicle control and guides the vehicle to park, and A first power supply unit (5.1) is provided for supplying power to one of the steering systems (3.1) and one of the braking systems (2.2), and / or a second power supply unit (5.2) is provided for supplying power to a first autonomous driving controller (ADC1) and a first motion sensor assembly (4.1), and / or a third power supply unit (5.3) is provided for supplying power to another of the braking systems (2.1), another of the steering systems (3.2), a second autonomous driving controller (ADC2) and a second motion sensor assembly (4.2), and The two braking systems (2.1, 2.2) and one of the steering systems (3.1) are connected to a first actuator bus (COM1) and to a first automatic driving controller (ADC1), and The two brake systems (2.1, 2.2) and the other steering system (3.2) are connected to a second actuator bus (COM2) and to a second automatic driving controller (ADC2).

2. The device (1) according to claim 1, characterized in that The third automatic driving controller (ADC3) is configured only to control the parking of the vehicle.

3. The device (1) according to claim 1 or 2, characterized in that The two braking systems (2.1, 2.2) are redundant with each other, and / or the two steering systems (3.1, 3.2) are redundant with each other.

4. The device (1) according to claim 1, characterized in that The first automatic driving controller (ADC1) and the second automatic driving controller (ADC2) are connected to each other via a motion sensor bus (COMM) and are connected to a first motion sensor assembly (4.1), and / or the second motion sensor assembly (4.2) is connected to a second actuator bus (COM2).

5. The device (1) according to claim 1 or 4, characterized in that The third automatic driving controller (ADC3) is connected to the first actuator bus (COM1) and the second actuator bus (COM2).

6. The device (1) according to claim 1, characterized in that The third automatic driving controller (ADC3) is connected to the first power supply unit (5.1) or the second power supply unit (5.2) or the third power supply unit (5.3) or the fourth power supply unit.

7. The device (1) according to claim 1 or 2, characterized in that The third autonomous driving controller (ADC3) configured as a slave controller and the first and second autonomous driving controllers (ADC1, ADC2) configured as master controllers are configured to access an environmental sensor assembly (6) via a sensor COM bus.

Images