Asymmetrical fail-safe system architecture

Abstract

The invention relates to a method (1) for controlling a vehicle (2) having an autonomous vehicle system (5), the autonomous vehicle system having an autonomous operating drive system (9) which is configured to execute dynamic driving tasks (FA) in the fault-free operation of the autonomous operating drive system (9) and having a redundant drive system (11) which is configured to execute reduced driving tasks (FAR). The autonomous operating drive system (9) executes a trajectory planning and provides a planned trajectory (TR) for the reduced driving tasks (FAR) to the redundant drive system (11). If a fault (E1) of the autonomous operating drive system (9) is identified, the redundant drive system (11) actuates at least one vehicle actuator (7) in order to execute the reduced driving tasks (FAR) by using the planned trajectory (TR). The invention also relates to an autonomous vehicle system (5) and to a vehicle (2) having an autonomous vehicle system (5).

Description

Technical Field

[0001] This invention relates to a method for controlling a vehicle, particularly a commercial vehicle, having an autonomous vehicle system configured to control the vehicle via a plurality of vehicle actuators. The vehicle system includes an autonomous driving system configured to perform dynamic driving tasks during trouble-free operation. The autonomous driving system drives at least one of the vehicle actuators during trouble-free operation to perform the dynamic driving tasks. The invention also relates to redundant driving systems. Furthermore, the invention relates to autonomous vehicle systems. Background Technology

[0002] An autonomous vehicle system is configured with one or more actuators to drive and control the vehicle, enabling it to perform driving tasks. Here, the autonomous vehicle system adjusts the vehicle's lateral and longitudinal accelerations, partially or completely independently of the human user. To enable driverless operation, numerous different sensors are needed for environmental detection, and significant computing power is required to evaluate the sensor data streams. Based on the sensor data, the autonomous vehicle system learns a trajectory for the vehicle's driving task. While the vehicle follows this trajectory, the autonomous vehicle system monitors the surrounding environment and modifies the trajectory as necessary.

[0003] The Society of Automotive Engineers (SAE) has developed a common five-level system for classifying the degree of automation of vehicles controlled by autonomous vehicle systems. Even in the event of a malfunction, the vehicle must be able to continue operating safely until the malfunction no longer poses a danger. In automation levels 3 through 5, the driving environment is monitored by an autonomous driving system. In level 3, the human user takes full control of the vehicle in the event of a malfunction in the autonomous driving system. Levels 4 and 5 incorporate redundant systems that, in the event of a failure in the autonomous driving system, at least partially perform the driving tasks. This redundancy is necessary to prevent collisions with other vehicles, people, or the vehicle's surroundings in the event of a system malfunction, and to perform safe braking to a stop if necessary.

[0004] Although redundant systems are rarely used or may never be used during vehicle operation, in some cases they are implemented as complete replicas of autonomous driving systems, including highly complex sensor technologies, resulting in high overall system costs. To avoid the high costs of fully redundant systems, different methods are known. For example, a control device for a vehicle with multiple driver assistance systems and monitoring devices is known from DE 10 2015 206 496 A1, wherein the driver assistance systems are configured to control the vehicle using a number of vehicle actuators. In one embodiment of the control device, a control unit may also be provided, configured to monitor for failures of the computing unit and / or the monitoring unit. If a failure is detected, the control unit may at least output an alarm signal to the driver assistance systems and prevent the control signals from being restricted by the monitoring unit. In another embodiment, the driver assistance system may be configured to calculate an emergency trajectory for safely braking the vehicle to a stop upon receiving an alarm signal and drive the vehicle actuators according to the calculated emergency trajectory. However, this system does not disclose redundancy in the event of a failure of the driver assistance systems and / or related sensors. In addition, the monitoring function has been permanently implemented, which has led to increased energy demand.

[0005] DE 10 2018 126 270 A1 discloses a vehicle with a virtual vehicle driver system having multiple platform control units for vehicle actuators. The vehicle computer is programmed to obtain recommendations regarding minimum risk conditions from the platform control units in the event of a failure, select an event from the received recommendations, and then implement that event. In the event of failure of one or more sensors, the minimum risk conditions are implemented using the remaining sensors. Redundancy of the sensors themselves is not disclosed.

[0006] US 2019 0171205 A1 discloses a method for operating a vehicle control system, the vehicle control system including at least one downstream system having at least one actuator. The downstream system receives signals from an upstream system and influences the motion of the vehicle using these signals. The method includes the steps of: transmitting signals from the upstream system to the downstream system in real time; determining that a fault has occurred in the upstream of the downstream system; and using a response plan for the downstream system, the response plan defining a functional sequence of at least one actuator of the downstream system, and the response plan having been pre-stored in a memory accessible to the downstream system. Because the response plan has been pre-stored, the redundant system cannot respond to changing environmental conditions. Furthermore, the upstream and downstream systems are arranged in a common loop, wherein no redundancy is provided for failure conditions of the downstream system.

[0007] The drawback of the proposed solutions is that none provide sufficient redundancy. For example, the system does not offer adequate redundancy in the event of failure of highly complex sensor components in the main system, the main processing unit, and / or one or more actuators. Consequently, it cannot always adequately ensure safety in the event of a main system failure.

[0008] Therefore, there are methods for controlling vehicles and autonomous vehicle systems that are inexpensive or use inexpensive components and ensure sufficient safety in the event of a failure in the autonomous driving system. Summary of the Invention

[0009] In a first aspect of the present invention, the task is solved by constructing a redundant driving system for performing redundant driving tasks, wherein the autonomous driving system is configured to perform trajectory planning in order to execute and provide the redundant driving system with a planned trajectory for reducing driving tasks, wherein the autonomous driving system and the redundant driving system are connected to each other and are aware of the presence of faults in each other's systems, and wherein, upon learning of a fault in the autonomous driving system, the redundant driving system drives at least one of the vehicle actuators to perform the reduced driving tasks by using the planned trajectory.

[0010] This invention utilizes the understanding that reduced driving tasks can be performed using a simplified redundant driving system, which is significantly cheaper than an autonomous driving system. Both autonomous and redundant driving systems are configured to drive and control vehicle actuators. In the absence of malfunctions, the autonomous driving system preferably performs dynamic driving tasks entirely independently of the redundant driving system. Dynamic driving tasks typically include steering, braking, and accelerating the vehicle considering environmental conditions, as well as determining intermediate destinations and waypoints. Within the scope of dynamic driving tasks, the autonomous driving system must respond at least to other traffic users, signals and signs, environmental influences, and road conditions. For example, a dynamic driving task could be the autonomous driving of a vehicle on a public road from a first location to a second location, where the second location is several kilometers from the first location. Compared to dynamic driving tasks, reduced driving tasks have a reduced range of functions.

[0011] The planned trajectory for reduced driving tasks describes the planned movement path of the vehicle and is known within the scope of trajectory planning. Preferably, trajectory planning is performed considering vehicle state, especially speed, mass, and lateral acceleration, as well as other environmental conditions and influences. Such environmental conditions and influences can be, for example, ambient temperature, road temperature, road conditions, lane width, lane direction, and traffic volume. Since the planned trajectory for reduced driving tasks is provided to the redundant driving system by the autonomous driving system, the redundant driving system does not need to perform its own trajectory planning for reduced driving tasks. This improves the availability of the planned trajectory in the event of a malfunction. Preferably, the redundant driving system is configured to perform driving assistance functions in non-autonomous operation. Particularly preferably, in non-autonomous vehicle operation, the redundant driving system implements emergency braking, lane keeping assist, or distance keeping assist functions. Preferably, the redundant driving system has redundant memory for storing the planned trajectory.

[0012] According to a first preferred embodiment, a redundant driving system is configured to perform reduced trajectory planning when the autonomous driving system fails to provide a valid planned trajectory, in order to obtain a reduced trajectory for a reduced driving task. This is achieved by the redundant driving system driving at least one of the vehicle actuators after a failure is detected in the autonomous driving system, in order to perform the reduced driving task using the reduced trajectory. In cases of particularly severe failure, the autonomous driving system is unable to perform trajectory planning and cannot provide a planned trajectory to the redundant driving system. Furthermore, the planned trajectory may become invalid, for example, due to transmission failures or timestamp expiration. To still perform the reduced driving task, the redundant driving system can perform reduced trajectory planning, whose functional scope is limited compared to the planned trajectory. For example, in the case of reduced trajectory planning, a reduced set of parameters can be used compared to the planned trajectory. Furthermore, the reduced trajectory planning can be performed based on reduced data in qualitative and / or quantitative aspects compared to the planned trajectory. Additionally, the reduced trajectory may be limited compared to the planned trajectory. For example, the maximum length of the reduced trajectory may be reduced compared to the planned trajectory. In addition, the maximum length of the track and / or the maximum time required for a vehicle to travel across the track are limited.

[0013] Preferably, the redundant driving system is configured to determine whether a planned trajectory provided by the autonomous driving system is suitable for performing a reduced driving task. Furthermore, preferably, the redundant driving system is configured to responsively perform reduced trajectory planning when it is determined that the planned trajectory is invalid, in order to obtain a reduced trajectory for the reduced driving task.

[0014] Preferably, the autonomous driving system cyclically performs trajectory planning to obtain a planned trajectory, and provides the planned trajectory to redundant driving systems. The redundant driving systems each use the last provided planned trajectory to perform a reduced driving task. Cyclic trajectory planning allows the planned trajectory to be matched to changing conditions of the vehicle or its surrounding environment. This is advantageous, for example, when another vehicle changes lanes and thus obstructs the planned trajectory after it has been executed. Particularly preferably, the cycle time between two consecutive trajectory plans is in the range of 1 ms to 10 seconds, preferably 1 ms to 1 second, more preferably 1 ms to 500 ms, more preferably 1 ms to 20 ms, and particularly preferably approximately 10 ms.

[0015] The shorter the cycle time between two consecutive trajectory plans, the lower the probability that the planned trajectory used to reduce driving tasks will become unsafe due to changing conditions. However, in general, the energy demand of autonomous driving systems increases as the cycle time decreases.

[0016] In another preferred embodiment, the autonomous driving system has one or more primary sensors that provide sensor data to the central control unit of the autonomous driving system, wherein the central control unit uses the sensor data to perform trajectory planning. Preferably, the primary sensors are highly complex sensors, such as at least one 3D LiDAR scanner, imaging radar, stereo camera, monocular camera, receiver for V2X data, receiver for GPS information, environmental fusion of imaging sensors, acceleration sensor, yaw rate sensor, wheel speed sensor and / or steering wheel angle sensor.

[0017] The central control unit is configured to evaluate sensor data and thereby generate information about the vehicle's state and / or its surrounding environment. For example, the central control unit can use sensor data to determine the direction of the driving lane. The primary sensors allow for particularly precise determination of the vehicle's state and / or its surrounding environment. By using sensor data for trajectory planning, a high degree of accuracy and / or safety of the planned trajectory can be ensured.

[0018] According to another preferred embodiment, the redundant driving system has one or more simple redundant sensors that provide redundant sensor data to a central redundant control unit. The central redundant control unit uses the redundant sensor data to determine whether obstacles exist on the planned or reduced trajectory, and modifies the planned or reduced trajectory using the redundant sensor data when an obstacle is detected on the planned or reduced trajectory. Compared to the particularly complex primary sensors, the redundant sensors are preferably simple and inexpensive, although the quality of the redundant sensor data provided by the redundant sensors is lower than that of the primary sensor data. This, for example, limits the resolution of the vehicle's environment. Preferably, the redundant sensors have radar and / or cameras. Particularly preferably, the redundant sensors are sensors commonly used in driving assistance systems such as lane keeping assist or emergency braking assist. Sensors commonly used in assistance systems are frequently used and are therefore relatively inexpensive. Preferably, the functional scope of the central redundant control unit is limited compared to the central control unit. For example, computing power and / or memory storage capacity can be implemented at a lower level. This enables cost savings and reduced energy requirements within the initial equipment range. Because the redundant driving system has its own redundant sensors, it can safely perform reduced driving tasks even when highly complex primary sensors fail. Furthermore, in the event of a complete failure of the operating driving system, the redundant driving system can ensure safe performance of reduced tasks even if obstacles appear along the planned and / or reduced trajectory after trajectory planning or reduced trajectory planning. For example, when the central redundant control unit detects an obstacle on the planned trajectory using redundant sensor data, it can modify the planned trajectory for moderate braking of the vehicle into a trajectory for full braking of the vehicle.

[0019] According to a preferred embodiment, the redundant driving system is powered by a redundant voltage source independent of the operating driving system. This design eliminates potential sources of failure that could jeopardize the safe operation of the autonomous vehicle system. Even when the autonomous operating driving system fails due to a main power supply failure, the redundant driving system can still be powered by the redundant voltage source and can perform reduced driving tasks. Preferably, the redundant voltage source has a lower capacity than the main voltage source. Therefore, the cost of the redundant voltage source can be reduced compared to the main voltage source. Because the redundant driving system has a smaller functional range, its energy consumption is reduced compared to the autonomous operating driving system, thus allowing it to be powered by a smaller capacity redundant voltage source.

[0020] Preferably, the redundant sensors also provide redundant sensor data to the central control unit. This allows the central control unit to utilize the redundant sensor data when performing trajectory planning. Consequently, the quality of the trajectory planning and the resulting planned trajectory can preferably be further improved. Preferably, the central control unit is configured to verify at least a portion of the sensor data from the primary sensors using the redundant sensor data.

[0021] Preferably, the reduced driving task is controlled braking, wherein the redundant driving system prevents wheel lock-up of the vehicle's axles. Wheel lock-up leads to uncontrolled movement of the vehicle, potentially making it impossible to maintain the planned or reduced trajectory. Furthermore, the braking distance is longer when wheels lock. Preferably, the planned and / or reduced trajectory for controlled braking is constructed such that the vehicle decelerates with a moderate acceleration value and thus makes full use of the available braking distance. A moderate acceleration value prevents the vehicle or trailer from skidding to one side, rear-ending following vehicles, and / or damaging the vehicle's load. However, it should be understood that controlled braking can also be necessary for full braking of the vehicle. This occurs, for example, when there is insufficient braking distance available for moderate braking. Controlled braking ensures safe braking of the vehicle to a stop. If the autonomous driving system fails, the vehicle is safely brought to a stop by the redundant driving system, which avoids collisions with other vehicles and / or obstacles in the surrounding environment.

[0022] Preferably, the controlled braking action is a lane-keeping braking action, in which the vehicle remains in the driving lane, and / or a lane-changing braking action, in which the vehicle is decelerated and steered to a drivable alternative driving lane, preferably a shoulder, wherein a central redundant control unit monitors the maintenance of the planned or reduced trajectory using redundant sensor data. In lane-keeping braking actions, also known as stop-in-lane braking actions, the planned and / or reduced trajectory extends along the driving lane in which the vehicle is located. It should be understood that the driving lane may also be curved or may have bends. Preferably, lane-keeping braking actions are implemented when there is no drivable alternative driving lane. This occurs, for example, when the vehicle is traveling on a single-lane road or when the shoulder is blocked by a defective vehicle. The planned and / or reduced trajectory for lane-changing braking actions extends from the first driving lane in which the vehicle is located to another drivable driving lane. It should be understood that the planned and / or reduced trajectory for lane-changing braking actions may also extend to more than two driving lanes. The central redundant control unit is preferably configured to modify or reduce the planned trajectory using redundant sensor data. Preferably, it performs lane change braking, also known as stop-on-hard-shoulder braking. Particularly preferably, the redundant driving system is configured to determine whether lane change braking can be performed. Preferably, the redundant control unit is configured to determine whether there are obstacles in the vehicle's current lane or an alternative lane using redundant sensor data.

[0023] In a preferred embodiment, when the central control unit is functioning correctly, trajectory planning is performed to obtain a trajectory, which is then provided to the operation controller and a redundancy controller. The operation controller and / or redundancy controller drives at least one of the vehicle actuators to keep the vehicle on the pre-planned trajectory. Here, the trajectory is planned by the central control unit of the autonomous driving system, whereby the operation controller drives the vehicle actuators using the trajectory provided by the central control unit, keeping the vehicle on the pre-planned trajectory. Preferably, the autonomous driving system is modularly constructed, with the central control unit performing planning and the operation controller performing the planned driving task. The redundancy controller represents the redundancy level for the operation controller; in the event of a failure in the operation controller, the central control unit provides the planned trajectory to the redundancy controller, allowing at least some of the vehicle actuators to continue to be driven. Preferably, the operation controller and / or redundancy controller are configured to detect the presence of a vehicle actuator failure. Particularly preferably, the operation controller and / or redundancy controller are configured to provide the detected vehicle actuator failure to the central control unit and / or redundancy control unit.

[0024] Furthermore, preferably, the vehicle actuator has at least one vehicle actuator from the group consisting of: a transmission, a motor, a main braking system, a redundant braking system, or a steering actuator. Preferably, the transmission is an automatic transmission. The main braking system and / or redundant braking system are preferably constructed as pneumatic braking systems. Furthermore, the main braking system and / or redundant braking system are preferably electronic braking systems. Additionally, the main braking system and / or redundant braking system preferably individually regulate the braking pressure from the brake cylinders of the wheels.

[0025] According to another preferred embodiment, the central redundant control unit provides a planned trajectory or a reduced trajectory of a reduced driving task to the operation controller and the redundancy controller, wherein the operation controller and / or the redundancy controller drives at least one of the vehicle actuators to keep the vehicle on the reduced driving task trajectory when the autonomous driving system fails and no operating trajectory is available. The reduced driving task trajectory can be either a planned trajectory or a reduced trajectory. Preferably, the operation controller and the redundancy controller are configured to accept the planned trajectory or the reduced trajectory of the reduced driving task only when no operating trajectory is provided from the central control unit of the autonomous driving system. Preferably, the central control unit is connected to the operation controller and the redundancy controller, and the central redundant control unit is also connected to the operation controller and the redundancy controller. Therefore, even if, for example, the central control unit and the redundancy controller fail simultaneously, the safe operation of the vehicle can be ensured. This advantageously improves system safety. Furthermore, even when the autonomous driving system or the redundant driving system completely fails, the safe operation of the vehicle is ensured.

[0026] Preferably, the operation controller monitors the fault status of the redundant controller, and the redundant controller monitors the fault status of the operation controller. Particularly preferably, the operation controller and the redundant controller are configured to provide the fault status of the other component to the central control unit and / or the redundant control unit when the other component fails. Preferably, the central control unit performs trajectory planning and / or operation trajectory planning by using the fault status of the operation controller and / or the redundant controller. Similarly, the central redundant control unit preferably performs reduced trajectory planning by using the fault status of the operation controller and / or the redundant controller. With this design, it is possible to consider the scope of operation trajectory planning, trajectory planning, and / or reduced trajectory planning when one or more vehicle actuators cannot be driven due to a fault in the operation controller and / or the redundant controller.

[0027] In a preferred embodiment, in the event of a failure of the main braking system of the driving system, the vehicle brakes using a redundant braking system independent of the main voltage source of the driving system. However, it can be advantageously achieved that the vehicle can safely brake to a stop even in the event of a main braking system failure. The control of the redundant braking system can be performed not only by the driving controller but also by the redundant controller. However, it should be understood that the main braking system can be powered by a redundant voltage source, and the redundant braking system can be powered by the main voltage source.

[0028] According to another preferred embodiment, vehicle steering is achieved by a steering actuator driven by a redundant controller and independent of the main voltage source of the operating driving system. Therefore, the vehicle can still steer even in the event of a failure of the main voltage source of the operating driving system. Particularly preferably, the main braking system and the steering actuator are powered by different voltage sources. It should be understood that in trouble-free operation, the steering actuator is driven by the redundant controller or the operating controller using a trajectory provided by the central control unit.

[0029] Preferably, in the event of a steering actuator failure in the driving system, emergency steering of the vehicle is implemented using the main braking system, which is preferably driven by a redundant controller. Also preferably, the main braking system can be driven by a driving controller. Preferably, the main braking system is powered by a main voltage source. However, it is also possible that the main braking system is powered independently of the main voltage source and powered by a redundant voltage source. Preferably, emergency steering is performed by selectively braking individual wheels of the vehicle, preferably individual front wheels. For example, if the left front wheel of a commercial vehicle is braked, the steering wheel of the commercial vehicle can be turned to the left due to the special axle kinematics of the commercial vehicle. Emergency steering enables the vehicle to remain in its lane even if the steering actuator, the autonomous driving system, and / or the voltage source connected to the steering actuator fails. Preferably, emergency steering also enables lane changing.

[0030] According to a second aspect, the present invention utilizes an autonomous vehicle system for controlling vehicles, particularly commercial vehicles, to solve the task proposed at the beginning. The autonomous vehicle system comprises: an autonomous driving system configured to drive at least one vehicle actuator of the vehicle to perform a dynamic driving task during fault-free operation of the autonomous driving system; and a redundant driving system configured to perform a reduced driving task, wherein the autonomous driving system is configured to execute a trajectory plan to obtain a planned trajectory for the reduced driving task and to provide the planned trajectory to the redundant driving system, wherein the autonomous driving system and the redundant driving system are interconnected and configured to detect faults in the other system, wherein the redundant driving system is configured to drive at least one vehicle actuator to perform the reduced driving task using the planned trajectory in the event of a fault in the autonomous driving system.

[0031] During trouble-free operation, the driving task is taken over by the autonomous driving system, while the redundant driving system serves as a backup in case the autonomous driving system fails. However, it should be understood that the autonomous driving system can preferably also drive one or more sub-components of the redundant driving system to perform autonomous driving tasks, and / or can provide driving trajectories to the sub-components of the redundant driving system. Preferably, the autonomous driving system controls a greater number of vehicle actuators than the redundant driving system.

[0032] According to a first preferred embodiment, the redundant driving system is configured to perform reduced trajectory planning so as to obtain a reduced trajectory for a reduced driving task when the autonomous driving system does not provide a valid planned trajectory, and wherein the redundant driving system is configured to drive at least one vehicle actuator so as to perform a reduced driving task by using the reduced trajectory when it is known that the autonomous driving system has malfunctioned.

[0033] According to a preferred improvement, the driving system includes one or more main sensors for acquiring sensor data, a central control unit connected to the sensors, and a main voltage source for operating the driving system. The central control unit is configured to perform trajectory planning using the sensor data when there are no faults, in order to obtain a planned trajectory. Preferably, there is no redundancy for the main sensors, thereby reducing the procurement and / or production costs of the autonomous vehicle system.

[0034] Preferably, the driving system further includes a driving controller connected to a central control unit, the driving controller being configured to drive at least one vehicle actuator and / or a first set of vehicle actuators of the vehicle system. The central control unit preferably performs trajectory planning and driving trajectory planning, and provides the planned trajectory and driving trajectory to the driving controller. The driving controller drives at least one vehicle actuator and / or a first set of vehicle actuators, thereby causing the vehicle to follow the planned trajectory or driving trajectory. Preferably, the autonomous vehicle system has multiple sets of vehicle actuators.

[0035] Preferably, the first group of vehicle actuators includes a transmission, a motor, and / or a main braking system, wherein one or more vehicle actuators are connected to the main voltage source of the driving system. It should be understood that the first group of vehicle actuators may also have only one or two of the aforementioned vehicle actuators. Preferably, a main braking system is provided in all cases. Preferably, the first group of vehicle actuators is equipped with those that affect the longitudinal acceleration of the vehicle. However, it is also possible to provide the first group of vehicle actuators with, or only with, one or more vehicle actuators that affect the lateral acceleration of the vehicle. It should be understood that vehicle actuators can affect both the longitudinal and lateral acceleration of the vehicle. This is, for example, when the vehicle's wheels brake asymmetrically.

[0036] Alternatively, the first group of vehicle actuators may include steering actuators and / or redundant braking systems, wherein one or more vehicle actuators are connected to the main voltage source of the operating driving system. The difference in the proposed alternatives lies in which vehicle actuators are controlled by the operating controller.

[0037] Preferably, the redundant driving system has one or more simple redundant sensors for acquiring redundant sensor data, which are connected to the central control unit of the operating driving system and the central redundant control unit of the redundant driving system. Therefore, it is preferably possible to use redundant sensor data within the scope of trajectory planning, reduced trajectory planning, trajectory planning, and / or monitoring of driving tasks or reduced driving tasks. In fault-free operation, the central control unit of the operating driving system preferably performs trajectory planning using sensor data from the primary sensors and redundant sensor data from the redundant sensors. In the event of a failure in the autonomous operating driving system, the redundant control unit can perform reduced trajectory planning for reduced driving tasks and / or monitor reduced driving tasks along the planned or reduced trajectory using redundant sensor data. The redundant sensors thus form a redundancy level relative to the primary sensors. Compared to the primary sensors, redundant sensors have a smaller functional range and are less expensive. For example, the data acquisition frequency, resolution, accuracy, or measurement principle of redundant sensors can be implemented more simply than the corresponding comparison values ​​of the primary sensors. Furthermore, preferably, the total number of primary sensors is greater than the number of redundant sensors.

[0038] According to a preferred improvement, the redundant driving system further includes a redundant voltage source for supplying power to the redundant driving system and a redundant controller configured to drive and control the vehicle actuators and / or a second set of vehicle actuators. Preferably, the central control unit of the driving system also provides an operating trajectory to the redundant controller. Therefore, the redundant controller can be configured to drive and control the second set of vehicle actuators within the scope of autonomous driving tasks. Preferably, the redundant controller is configured to drive and control the second set of vehicle actuators only using a planned trajectory for a reduced driving task when the central control unit does not provide an operating trajectory for the autonomous driving task. Therefore, the second set of vehicle actuators is also driven and controlled to perform autonomous driving tasks in fault-free operation. If the central control unit does not provide an operating trajectory due to a failure in the driving system, the redundant controller drives and controls the second set of vehicle actuators according to the reduced driving task.

[0039] Preferably, the second group of vehicle actuators includes steering actuators and / or a redundant braking system connected to a redundant voltage source of the redundant driving system. Alternatively, the second group of vehicle actuators may include a transmission and / or a motor and / or a main braking system, wherein one or more vehicle actuators are connected to a redundant voltage source of the redundant driving system. Preferably, a main braking system is provided in all cases. Preferably, the steering actuators and main braking system of the autonomous driving system are assigned to different groups of vehicle actuators powered by different voltage sources of the autonomous vehicle system. This ensures that, in the event of a failure of the main voltage source or the redundant voltage source, the vehicle can still be steered by means of the steering actuators or that the vehicle can be steered urgently by means of the main braking system. Furthermore, preferably, the main braking system and the redundant braking system are assigned to different groups of vehicle actuators powered by different voltage sources of the autonomous vehicle system. Therefore, in the event of a failure of the main voltage source or the redundant voltage source, braking of the vehicle can be ensured by means of the redundant braking system or the main braking system. It should be understood that other assignment relationships between vehicle actuators and vehicle actuator groups are also preferred.

[0040] In a preferred embodiment, the redundant sensors include vehicle side sensors, particularly side radar, side ultrasonic, and / or side lidar sensors, configured to determine the distance to the lateral lane boundary. Furthermore, the vehicle side sensors may also be configured to determine the presence of obstacles in the lateral area of ​​the vehicle. Particularly preferably, the vehicle sensors are configured to monitor the vehicle's blind spots. When the vehicle performs reduced driving tasks using a planned trajectory and / or a reduced trajectory, the vehicle side sensors enable and / or improve monitoring of the vehicle's lane-keeping ability. Furthermore, trajectory planning, running trajectory planning, and / or reduced trajectory planning are preferably performed using lateral sensor data from the vehicle side sensors. It should be understood that the primary sensors may preferably include one or more primary side sensors.

[0041] Preferably, the redundant sensors include front radar and / or wide-angle lidar sensors with short effective ranges, configured to detect drivable space up to the edge of the vehicle. Drivable space is the area around the vehicle through which it is safe to drive. Detection up to the edge of the vehicle, such as the front, rear, and / or sides, ensures that obstacles in the vicinity of the vehicle are also detected. It should be understood that the primary sensor is preferably configured to detect drivable space up to the edge of the vehicle.

[0042] According to a preferred embodiment, the operation controller is configured to learn the fault status of a first group of vehicle actuators and provide this information to the central control unit. Preferably, the central control unit is configured to determine whether a fault exists in one or more vehicle actuators in the first group by using the fault status of the first group of vehicle actuators, and particularly preferably to determine which of the vehicle actuators is faulty. Preferably, the central control unit is also configured to perform trajectory planning and / or operation trajectory planning by using the learned fault status of the first group of vehicle actuators.

[0043] Furthermore, preferably, the redundant controller is configured to learn the fault status of the second group of vehicle actuators and provide this information to the central redundant control unit and / or the central control unit. Preferably, the central control unit and / or the redundant control unit are configured to learn whether a fault exists in one or more vehicle actuators in the second group by using the fault status of the second group of vehicle actuators, and particularly preferably to learn which of the vehicle actuators is faulty. Preferably, the central control unit is configured to perform trajectory planning and / or running trajectory planning by using the learned fault status of the second group of vehicle actuators. Similarly, the redundant control unit may also be configured to perform reduced trajectory planning by using the fault status of the second group of vehicle actuators.

[0044] In a third aspect of the invention, the aforementioned task is solved by a vehicle, particularly a commercial vehicle, having an autonomous vehicle system according to any of the above-described preferred embodiments of the invention's second aspect, the vehicle system being configured to implement the method according to any of the above-described preferred embodiments of the invention's first aspect. It should be understood that the method for controlling a vehicle according to the invention's first aspect, the autonomous vehicle system according to the invention's second aspect, and the vehicle according to the invention's third aspect have the same or similar sub-aspects, particularly those recorded in the dependent claims. In this regard, reference is made in its entirety to the foregoing description.

[0045] Embodiments of the invention will now be described with reference to the accompanying drawings. The drawings are not necessarily to scale, but are illustrated in a schematic and / or slightly distorted form to aid explanation. For supplementary information regarding teachings directly identifiable from the drawings, refer to the relevant prior art. It should be understood that various modifications and variations in the form and details of the embodiments can be made without departing from the overall spirit of the invention. Features of the invention disclosed in the specification, the drawings, and the claims, whether individually or in any combination, may be important for improvements to the invention. Furthermore, all combinations of at least two features disclosed in the specification, the drawings, and / or the claims fall within the scope of the invention. The overall spirit of the invention is not limited to the exact form or details of the preferred embodiments shown and described below, nor is it limited to the subject matter that would be limited compared to the subject matter claimed in the claims. In the case of the stated measurement ranges, values ​​within the limits should also be disclosed as limit values ​​and can be used freely and claimed to be protected. For simplicity, the same reference numerals are used below for the same or similar parts or parts having the same or similar functions. Attached Figure Description

[0046] Further advantages, features, and details of the invention will become apparent from the following description of preferred embodiments and with reference to the accompanying drawings; wherein:

[0047] Figure 1 A schematic diagram of a vehicle having an autonomous vehicle system according to a first embodiment is shown;

[0048] Figure 2 A schematic diagram of an autonomous vehicle system according to a first embodiment is shown;

[0049] Figure 3 A schematic diagram of an autonomous vehicle system according to a first embodiment is shown, illustrating the provision of control commands, trajectories, and fault information;

[0050] Figure 4A schematic diagram of an autonomous vehicle system according to a second embodiment is shown, illustrating the provision of control commands, trajectories, and fault information;

[0051] Figure 5 A schematic diagram of an autonomous vehicle system according to a third embodiment is shown;

[0052] Figure 6 A schematic diagram of a vehicle with an autonomous vehicle system is shown, in which the vehicle performs lane-keeping braking.

[0053] Figure 7 A schematic diagram of a vehicle with an autonomous vehicle system is shown, in which the vehicle performs lane-changing braking maneuvers;

[0054] Figure 8 A schematic diagram of a vehicle with an autonomous vehicle system is shown, in which the vehicle performs autonomous driving tasks;

[0055] Figure 9 A schematic flowchart illustrating a preferred embodiment of the method when there are no faults in the autonomous driving system; and

[0056] Figure 10 A schematic flowchart illustrating another preferred embodiment of the method is shown when the autonomous driving system malfunctions. Detailed Implementation

[0057] Vehicle 2, especially commercial vehicles 3, has an autonomous vehicle system 5, which has an operational driving system 9 and a redundant driving system 11 (see...). Figure 1 , Figure 2 and Figure 5 Vehicle 2 is shown here as a commercial vehicle 3 having a first rear axle HA1, a second rear axle HA2, and a front axle VA. The front wheels 100.1 and 100.2 of the front axle VA are steerable. The rear wheels 102.1, 102.2, 102.3, and 102.4 of the first and second rear axles HA1 and HA2 are non-steerable wheels. However, it is also possible to configure the rear wheels 102.1 and 102.2 of the first rear axle HA1 and / or the rear wheels 102.3 and 102.4 of the second rear axle HA2 to be steerable. For this purpose, first and second rear axle steering actuators (not shown) can be provided.

[0058] If passed Figure 1The arrows shown illustrate that the primary sensor 13 of the autonomous driving system 9 provides sensor data SD to the central control unit 15 of the driving system 9. Additionally, redundant sensor 17 provides redundant sensor data SDR to the central control unit 15. Furthermore, redundant sensor 17 also provides redundant sensor data SDR to the central redundant control unit 19. The sensor data and / or redundant sensor data SDR can represent information about the vehicle's state and / or the environment surrounding the vehicle.

[0059] Preferably, the number of primary sensors 13.1, 13.2, and 13.3 is greater than the number of redundant sensors 17.1 and 17.2. Compared to redundant sensors 17, primary sensors 13 have an improved functional range and can be described as highly complex sensors. Preferably, the amount of primary sensor data SD is greater than the amount of redundant sensor data SDR. Furthermore, the frequency of providing primary sensor data SD to the central control unit 15 can be greater than the frequency of providing redundant sensor data SDR to both the central control unit 15 and the redundant control unit 19. Since redundant sensor data SDR is provided to both the central control unit 15 and the central redundant control unit 19 of the driving system 9, the amount of data provided to the central control unit 15 is greater than the amount of data provided to the redundant control unit 19. Therefore, the redundant control unit 19 of the redundant driving system 11 can be implemented with a smaller functional range than the central control unit 15 of the driving system 9. For example, the redundant control unit 15 may have lower computing power or limited computational capabilities compared to the central control unit 15. Here, the first main sensor 13.1 is implemented as a 3D LiDAR scanner, the second main sensor 13.2 is implemented as a stereo camera, and the third main sensor 13.3 is implemented as an imaging radar. Figure 1 The primary sensor 13 shown is configured to detect data about the vehicle's surrounding environment 24. Furthermore, the primary sensor 13 can also detect information about the vehicle's condition, such as its speed. The first redundant sensor 17.1 is configured as a radar, while the second redundant sensor 17.2 is a monocular camera.

[0060] If passed Figure 1 The double arrows arranged between the central control unit 15 and the redundant control unit 19 illustrate that the central control unit 15 is configured to detect whether the redundant control unit 19 has a fault E2 (see [reference]). Figure 3 , Figure 4Similarly, the redundant control unit 19 is configured to detect the presence of a fault E1 in the central control unit 15. It should be understood that the detection of faults E1 and E2 can also be based on the absence of a signal and / or on timeout signals of the central control unit 15 and / or the redundant control unit 19. Furthermore, the central control unit 15 and / or the redundant control unit 19 can be configured to directly output fault signals E1 and E2.

[0061] The central control unit 15 is configured to perform trajectory planning to obtain the trajectory TRB for the autonomous driving task FA. Trajectory planning is performed using sensor data SD provided by the primary sensor 13 and / or redundant sensor data SDR provided by the redundant sensor 17. Furthermore, the central control unit 15 is configured to perform trajectory planning for the reduced driving task FAR to obtain the reduced trajectory TR. Preferably, the reduced driving task FAR is implemented when a fault E1 occurs in the autonomous driving system 9, preventing the autonomous driving task FA from being performed by the driving system 9. Preferably, the central control unit 15 performs trajectory planning cyclically, preferably at a frequency of 0.1 to 1000 Hz, more preferably 1 to 1000 Hz, more preferably 2 to 1000 Hz, more preferably 10 to 1000 Hz, more preferably 50 to 1000 Hz, and particularly preferably 100 Hz. Particularly preferably, the cycle time ZT of the trajectory planning is equivalent to the cycle time ZTB of the driving trajectory planning. However, it is also possible to set the cycle time ZT of the trajectory planning to be greater than the cycle time ZTB of the driving trajectory planning. This is particularly desirable to reduce energy consumption, memory requirements of the central control unit 15's memory 23, and / or computing power. The trajectory TR for the reduced driving task FAR is provided to the redundant control unit 19. If the trajectory TR is not provided to the redundant control unit 19 due to a failure of the central control unit 15, the redundant control unit 19 can perform reduced trajectory planning to obtain a reduced trajectory TRR. It should be understood that the redundant control unit 15 can also perform reduced trajectory planning cyclically. Preferably, the cycle time ZTR of the reduced trajectory planning, measured between two consecutive reduced trajectory TRRs provided, preferably has a range of 0.1 to 1000 Hz, more preferably 1 to 1000 Hz, more preferably 2 to 1000 Hz, more preferably 10 to 1000 Hz, more preferably 50 to 1000 Hz, and particularly preferably 100 Hz. It is also preferable that the reduced trajectory planning is performed only when the redundant control unit 15 learns of a failure E1 in the central control unit 15.

[0062] For example, if the main voltage source 21 of the autonomous driving system 9 fails and the central control unit 15 is not supplied with voltage, then the central control unit 15 will experience a fault E1. To prevent the entire autonomous vehicle system 5 from failing in the event of a main voltage source 21 failure, the redundant driving system 11 has a redundant voltage source 22 (see [link to documentation]). Figure 1 and Figure 2 This ensures that at least the redundant driving system 11 remains operational. Due to the limited functional range of the central redundant control unit 19, it has lower energy requirements compared to the central control unit 15, allowing the redundant voltage source 22 to be smaller and / or cheaper than the main voltage source 21. For example, by... Figure 1 The dashed line indicates that the main voltage source 21 also supplies power to the autonomous driving system 9, the operation controller 29, and the first group 41 vehicle actuators 7.1, 7.2, and 7.3. In a similar manner, the redundant driving system 11 includes a redundant controller 31 and a second group 53 vehicle actuators 7.4 and 7.5, which are powered by the redundant voltage source 22.

[0063] The operation controller 29 is configured to monitor the failure state ES2 of the redundant controller 31. Similarly, the redundant controller 31 is configured to monitor the failure state ES1 of the operation controller 29 (see [link to documentation]). Figure 3 and Figure 4 Monitoring can preferably be performed by sending fault states ES1, ES2, by querying fault states ES1, ES2, and / or by receiving timeout signals from the other controllers 29 and 31, respectively. Preferably, the operating controller 29 and / or the redundant controller 31 are configured to provide the central control unit 15 and / or the redundant control unit 19 with the fault state ES2 of the redundant controller 31 or the fault state ES1 of the operating controller 29.

[0064] During fault-free operation, the central control unit 15 provides the operating trajectory TRB to the operation controller 29 and the redundancy controller 31. Furthermore, the redundancy control unit 19 provides the trajectory TR or reduced trajectory TRR to the operation controller 29 and the redundancy controller 31 in parallel. However, it is also possible to configure the redundancy control unit 19 to provide the trajectory TR or reduced trajectory TRR only when a fault E1 is detected in the central control unit 15. The operation controller 29 and the redundancy controller 31 are configured to use the trajectory TR or reduced trajectory TR only when the central control unit 15 does not provide a valid operating trajectory TRB. For this purpose, the operation controller 29 and / or the redundancy controller 31 are preferably configured to perform trajectory prioritization. Furthermore, the central control unit 15 may also be configured to provide the operating trajectory TRB to the operation controller 29 and the redundancy controller 31 with a higher priority than the trajectory TR or reduced trajectory TRR provided by the redundancy control unit 19. Therefore, it is preferable to ensure that autonomous driving task FA is performed using the operating trajectory TRB during fault-free operation, and that the trajectory TR and reduced trajectory TRR are not considered for performing autonomous driving task FA. If the autonomous driving system 9 malfunctions and the central control unit 15 fails to provide the driving trajectory TRB, it is preferable to perform the reduced driving task FAR by using the trajectory TR provided by the redundant control unit 19 or the reduced trajectory TRR.

[0065] The operation controller 29 is configured to drive the first group 41 vehicle actuators 7.1, 7.2, and 7.3 to perform autonomous driving task FA or reduced driving task FAR. The operation controller 29 drives at least one of the first group 41 vehicle actuators 7.1, 7.2, and 7.3, causing the vehicle 2 to move along a driving trajectory TRB, trajectory TR, or reduced trajectory TRR. Preferably, the operation controller 29 is adapted to perform stability adjustments on the vehicle 2 independently of the central control unit 15, so that the vehicle 2 remains stably on the driving trajectory TRB, trajectory TR, or reduced trajectory TRR. Similarly, the redundancy controller 31 is configured to drive the second group 53 vehicle actuators 7.4 and 7.5 to perform autonomous driving task FA or reduced driving task FAR. Here, the redundancy controller drives at least one of the second group 53 vehicle actuators 7.4 and 7.5, causing the vehicle 2 to move along the driving trajectory TRB, trajectory TR, or reduced trajectory TRR. The redundant controller 31 is preferably adapted to perform stability adjustment of the vehicle 2 independently of the redundant control unit 19. Preferably, the operation controller 29 and the redundant controller 31 work together to perform stability adjustment of the vehicle 2. It should be understood that in fault-free operation, the first group 41 vehicle actuators 7.1, 7.2, 7.3 and the second group 53 vehicle actuators 7.4, 7.5 can both be driven to perform autonomous driving task FA. Redundancy is ensured such that, in the event of failure of the autonomous driving system 9, at least the second group 53 vehicle actuators 7.4, 7.5 can be driven to perform reduced driving task FAR. If only a fault E1 exists in the central control unit 15, the reduced driving task FAR can also be performed by the operation controller 29 and / or the redundant controller 31, wherein the trajectory TR or the reduced trajectory TRR is provided by the redundant control unit 19 to the operation controller 29 and the redundant controller 31. Preferably, when a fault E2 is detected in the redundant driving system 11, the autonomous driving system 9 is also preferably configured to perform the reduced driving task FAR. This enables the immediate execution of reduced driving tasks (FAR) upon learning of faults E1 or E2 in the autonomous driving system 9 or the redundant driving system 11. Preferably, the central control unit 15 also provides the reduced trajectory (TRR) to the operation controller 29.

[0066] According to this embodiment, the fault state ES3 of the first group 41 vehicle actuators 7 can be known by the operation controller 29 and is particularly preferably provided to the central control unit 15 and / or the redundant control unit 19. Similarly, the fault state ES4 of the second group 53 vehicle actuators 7 can be known by the redundant controller 31 and is particularly preferably provided to the central control unit 15 and / or the redundant control unit 19. Therefore, the central control unit 15 can perform operation trajectory planning and / or trajectory planning by using the fault state ES3 of the first group 41 vehicle actuators 7. Preferably, the central control unit 15 is configured to determine whether to perform reduced driving task FAR or autonomous driving task FA based on knowing the fault state ES3 of the first group 41 vehicle actuators 7 and / or the fault state ES4 of the second group 53 vehicle actuators 7. The redundant control unit 19 is also preferably adapted to consider the fault state ES3 of the first group 41 vehicle actuators 7 and / or the fault state ES4 of the second group 53 vehicle actuators 7 in the case of reduced trajectory planning.

[0067] According to the first embodiment ( Figure 1 , Figure 2 , Figure 3The first set of vehicle actuators 41 includes the vehicle 2's motor 7.1, transmission 7.2, and main braking system 7.3. Then, preferably, the second set of vehicle actuators 53 includes a redundant braking system 7.4 and a steering actuator 7.5. The redundant braking system 7.4 is configured to decelerate the vehicle 2 in the event of a failure of the main braking system 7.3. Preferably, the functional range of the redundant braking system 7.4 is reduced compared to the main braking system 7.3. Therefore, the redundant braking system 7.4 can be implemented more cost-effectively. For example, the adjustment precision of the redundant braking system 7.4 can be lower than the corresponding adjustment precision of the main braking system 7.3. Furthermore, individual drive control of each wheel 100.1, 100.2, 100.3, 100.4, 100.5, and 100.6 of each of the respective axles VA, HA1, and HA2 can be achieved using only the main braking system 7.3. Preferably, the main braking system 7.3 and the redundant braking system 7.4 are connected in such a way that braking of the vehicle 2 can be performed using only one of the braking systems 7.3 and 7.4. For this purpose, the main braking system 7.3 and the redundant braking system 7.4 can be pneumatically connected such that braking of the vehicle 2 using the redundant braking system 7.4 is only possible when the main braking system 7.3 fails. According to the first embodiment of the autonomous vehicle system 5, when the first group 41 vehicle actuators 7 cannot be driven due to a malfunction E1 in the driving system 9, the reduced driving task FAR is performed by the second group 53 vehicle actuators. Since braking cannot be performed using the main braking system 7.3 in this situation, braking of the vehicle 2 is performed using the redundant braking system 7.4, while the vehicle 2 can be steered using the steering actuator 7.5.

[0068] According to the second embodiment ( Figure 4 The first group 41 of vehicle actuators 7 includes a redundant braking system 7.4 and a steering actuator 7.5. The second group 53 of vehicle actuators 7 includes a motor 7.1, a transmission 7.2, and a main braking system 7.3. The design of the main braking system 7.3 and the redundant braking system 7.4 is completely consistent with the description of the first embodiment above. If the autonomous driving system 9 in the autonomous vehicle system 5 according to the second embodiment malfunctions (E1), the vehicle 2 can be braked by means of the main braking system 7.3. If the steering actuator 7.5 cannot be driven due to the malfunction (E1) of the driving system 9, an emergency steering of the vehicle 2 can be performed by using the main braking system 7.4. During an emergency steering maneuver, each wheel 100 of the vehicle 2, especially the front wheels 100.1 and 100.2 of the front axle VA, is individually braked by the main braking system 7.3, thereby keeping the vehicle 2 in the driving lane 25. Similarly, the main braking system 7.3 can preferably be configured to enable lane changing and / or turning of the vehicle 2 within the range of an emergency steering maneuver.

[0069] It should be understood that emergency steering within the range of reduced driving task FAR is only performed when the steering actuator 7.5 is no longer controllable.

[0070] According to the third embodiment, the autonomous vehicle system 5 ( Figure 5 This is essentially similar in construction to the autonomous vehicle system 5 according to the first embodiment. The autonomous vehicle system 5 can be classified into classification levels: the primary sensor 13 and redundant sensor 17 are assigned to the "detection" classification level. The central control unit 15 and redundant control unit 19 belong to the "control" classification level, while the vehicle actuator 7 is assigned to the "activation" classification level. Furthermore, according to this embodiment, the "control" classification level includes a manual control device 54 capable of enabling manual driving tasks (FAM) performed by the user. The user's manual control commands are provided to the operation controller 29 and redundant controller 31, which are arranged between the "control" and "activation" classification levels and drive the vehicle actuator 7 using these manual control commands.

[0071] The dashed line 83 originating from the main braking system 7.3 illustrates emergency steering in the event of a failure in the steering actuator 7.5, while the dashed line 85 originating from the redundant braking system 7.4 illustrates vehicle deceleration using the redundant braking system 7.4. Preferably, the autonomous vehicle system 5 also includes a communication unit 51. This communication unit is assigned to the "connectivity" category level and is configured to enable communication with other traffic users (not shown) and / or objects in the vehicle's surrounding environment 24 and / or with a central traffic control system (not shown). For example, information describing traffic volume on the planned route can be received via the communication unit 51 and used by the central control unit 15 within the planned operating trajectory. Furthermore, when a reduced driving task (FAR) is implemented, a warning signal can be sent to vehicles in the vehicle's surrounding environment 24 via the communication unit 51.

[0072] Preferred, reduced driving task FAR is Figure 6 The lane keeping braking action BMSH or as described in the document Figure 7 The lane change braking action MBSW is described in the text. Figure 6Vehicle 2, configured here as a commercial vehicle 3, is shown traveling along lane 25 of road 28. Road 28 here does not have a shoulder 57. If a fault E1 is detected in the autonomous driving system 9, the autonomous vehicle system 5 implements reduced driving task FAR by using a reduced trajectory TRR or trajectory TR. Preferably, the central control unit 15 is configured to perform lane keeping braking action BMSH when no alternative lane 26 is available. For example, no alternative lane 26 is available when only one lane 25 or another existing lane is inaccessible due to other vehicles or obstacles. Preferably, the redundant driving system 11 is configured to perform lane change braking action BMSW. Preferably, lane keeping braking action BMSH is therefore only performed when lane change braking action MBSW is not feasible or cannot be fully performed. Figure 6 From the front of vehicle 2 at 65 degrees forward, that is, at Figure 6 The upward-pointing arrow indicates that vehicle 2 remains in lane 25 and decelerates until it comes to a stop. According to this embodiment, lane 25 is unobstructed along the direction of travel of vehicle 2, allowing vehicle 2 to moderately decelerate until it comes to a stop. It should be understood that the lane-keeping braking action BMSH can also be an emergency braking of vehicle 2. This is especially true when there is insufficient braking distance to moderately decelerate vehicle 2 due to obstacles placed in lane 25.

[0073] Depend on Figure 7 The reduced driving task FAR performed by vehicle 2, which is configured here as commercial vehicle 3, is the lane change braking action BMSW. Vehicle 2, in lane 25, is positioned at location P1 at the start of the trajectory. At the end of the trajectory TR, vehicle 2 is stopped on shoulder 27. The deceleration of vehicle 2 is illustrated by the decreasing length of the arrow representing the trajectory TR from location P1 to location P2 of vehicle 2. It should be understood that the reduced driving task FAR can also be performed using a reduced trajectory TRR provided by the redundant control unit 19. The lane change braking action BMSW is performed because shoulder 27 is present and driving is possible. It should be understood that the lane change braking action BMSW may also include changing lanes to an alternative lane 26, which is not shoulder 27. Preferably, the lane change braking action BMSW and / or the lane keeping braking action BMSH may also include a brief acceleration of vehicle 2. Furthermore, when a fault E2 is detected in the redundant driving system 11, the reduced driving task FAR is preferably performed by operating the driving system 9.

[0074] Autonomous driving tasks (FA) can include handling various driving situations in normal road traffic or off-road conditions. Vehicle 2's overtaking maneuver... Figure 8The following is illustrated as an example of an autonomous driving task. Here, the autonomous vehicle system 5 controls vehicle 2, shown here as a commercial vehicle 3, which travels at a constant speed along a driving trajectory TRB from the third position P3 through the fourth position P4 to the fifth position P5. At the start of the autonomous driving task FA, vehicle 2 travels at a constant speed in lane 25. Using sensor data SD from the primary sensor 13 and / or redundant sensor data SDR from the redundant sensor 17, the central control unit 15 learns that a second vehicle 67 is moving at a relatively lower speed in lane 25 than vehicle 2, thereby reducing the distance between the front of vehicle 65 and the second vehicle 67 traveling ahead. Using sensor data SD and / or redundant sensor data SDR, the central control unit 15 performs driving trajectory planning to obtain the driving trajectory TRB. The driving trajectory TRB is provided to the operation controller 29 and the redundant controller 31. The operation controller 29 and / or the redundant controller 31 drive the vehicle actuator 7, causing vehicle 2 to be turned into the empty second lane 28. After passing the second vehicle 67, the vehicle actuator 7 is actuated to steer vehicle 2 back into the driving lane 25. It should be understood that the autonomous driving system 9 monitors the vehicle's surroundings 24 to match the driving trajectory TRB as needed.

[0075] In this embodiment ( Figure 6In this system, vehicle 2 has a side sensor 55, which is here a side radar 56. Preferably, the side radar 56 is configured to know the distance A between the lateral lane boundary 57 and the lateral vehicle edge 63 and provide it to the central control unit 15 and / or the redundant control unit 19. It should be understood that the side sensor 55 may also only provide side sensor data SDSS, and the distance A is known by the central control unit 15 and / or the redundant control unit 19. It is also possible that the autonomous vehicle system 5 has multiple side sensors 55. In addition, the side sensor 55 may also be configured to identify whether there is a second vehicle 67, an obstacle, and / or a drivable road segment next to vehicle 2. For example, a ditch or embankment may be a ditch or road segment. Preferably, the central control unit 15 and / or the redundant control unit 19 are configured to take into account vehicle parameters of vehicle 2 for trajectory planning, running trajectory planning, and / or reduced trajectory planning. For example, vehicle parameters may be the size of vehicle 2, the weight of vehicle 2, the load weight of vehicle 2, and / or the acceleration capability of vehicle 2. It should be understood that vehicle parameters may include multiple additional parameters, and are not limited to those mentioned. Preferably, vehicle parameters are pre-stored in the memory 23 of the central control unit 15 and / or the redundant memory 33 of the redundant control unit 19. However, it is also possible to configure the central control unit 15 and / or the redundant control unit 19 to obtain vehicle parameters by using vehicle parameter data provided to the central control unit 15 or the redundant control unit 19.

[0076] Furthermore, the redundant sensor data 17 here includes a short-range front radar 59, a short-range rear radar 60, and two wide-angle lidar sensors 61, wherein the wide-angle lidar sensors 61 are arranged on the lateral vehicle edges 63. The short-range front radar 59 is arranged at the front of the vehicle 65, while the short-range rear radar 60 is arranged at the rear of the vehicle 2 66. The short-range front radar 59, the short-range rear radar 60, and the wide-angle lidar sensors 61 are configured to monitor the vehicle surroundings 24, schematically shown here, up to the vehicle edges 62 including the lateral vehicle edges 63, the front of the vehicle 65, and the rear of the vehicle 66. Additionally, the redundant sensor data 17 may also include a height sensor (not shown), configured to determine the drivable height of the vehicle surroundings 24. It should be understood that the primary sensor 13 may also be configured to monitor the vehicle surroundings 24 up to the front of the vehicle 65, the rear of the vehicle 66, and the lateral vehicle edges 63.

[0077] Figure 9The process of a preferred embodiment of method 1 for controlling vehicle 2 using autonomous vehicle system 5 is described. In the first step S1, the primary sensor 13 and redundant sensor 17 provide sensor data SD and redundant sensor data SDR to the central control unit 15 of the autonomous driving system 9. Using the sensor data SD and redundant sensor data SDR, the central control unit 15 performs trajectory planning S2 and running trajectory planning S3 to obtain the planned trajectory TR and running trajectory TRB. Trajectory planning S2 is repeated cyclically for cycle time ZT and running trajectory planning S3 is repeated for cycle time TZB. In step S4, the central control unit 15 provides the planned trajectory TR to the central redundant control unit 19 of the redundant driving system 11. Furthermore, the central control unit 15 provides the planned trajectory TR and running trajectory TRB to the operation controller 29 and redundant controller 31 (step S5). Simultaneously, the central redundant control unit 19 provides the planned trajectory TR to the operation controller 29 and redundant controller 31 in step S6. In step S7, the operation controller 29 and the redundant controller 31 receive the provided operating trajectory TRB and drive the vehicle actuator 7 to perform the autonomous driving task FA (step S8). It should be understood that, in parallel with steps S1 to S8, the autonomous driving system 9 and the redundant driving system 11 monitor whether the driving system 9 has a fault E1 (step S9) and / or whether the redundant driving system 11 has a fault E2 (step S10).

[0078] Figure 10The process of a preferred embodiment of method 1 is described when the driving system 9 fails due to fault E1 and does not provide a trajectory TR. In step S11, the redundant driving system 11 learns of the presence of fault E1 and that the central control unit 15 does not provide a valid trajectory TR. Using the redundant sensor data SDR provided by the redundant sensor 17 in step S12, the central redundant control unit 19 performs reduced trajectory planning in step S13 to obtain a reduced trajectory TRR for the reduced driving task FAR. Subsequently, the reduced trajectory TRR is provided to the operation controller 29 and the redundant controller 31 (step S14). Using the fault state ES1 of the operation controller 29, the redundant controller 31 learns that the operation controller 29 has failed. Furthermore, the redundant controller 31 learns that there is no valid trajectory TR or driving trajectory TRB. It should be understood that step S15 may also be performed in parallel with or before steps S11 to S14. Subsequently, the redundant controller 31 drives the second group 53 vehicle actuators 7 to perform the reduced driving task FAR (step S17). In parallel with the execution of the reduced driving task FAR (step S17), the central redundant control unit 19 monitors the vehicle's surrounding environment 24 using redundant sensor data SDR provided by redundant sensors 17 (step S18). If it is determined that the reduced driving task FAR is impossible, the reduced trajectory planning is re-executed (step S13). For example, if it is determined that there is an obstacle in the route of the reduced trajectory TRR, the reduced driving task FAR cannot be achieved.

[0079] It should be understood that Figure 9 and Figure 10 The method 1 shown, or steps S1 to S18 of the method, is preferably repeated cyclically.

[0080] List of reference numerals (part of the instruction manual)

[0081] 1. Method

[0082] 2 vehicles

[0083] 3 Commercial vehicles

[0084] 5. Autonomous vehicle system

[0085] 7 Vehicle actuators

[0086] 7.1 Motor

[0087] 7.2 Transmission Device

[0088] 7.3 Main Braking System

[0089] 7.4 Redundant Braking System

[0090] 7.5 Steering actuator

[0091] 9. Operating the driving system

[0092] 11. Redundant driving system

[0093] 13 Main Sensors

[0094] 13.1 First Primary Sensor

[0095] 13.2 Second main sensor

[0096] 13.3 The Third Main Sensor

[0097] 15. Central Control Unit

[0098] 17 Redundant Sensors

[0099] 17.1 First Redundant Sensor

[0100] 17.2 Second Redundant Sensor

[0101] 19. Central Redundant Control Unit

[0102] 21 Main Voltage Source

[0103] 22 Redundant voltage sources

[0104] 23 Memory

[0105] 24. The surrounding environment of the vehicle

[0106] 25 lanes

[0107] 26 Alternative driving lanes

[0108] 27 shoulder

[0109] 28 Second lane

[0110] 29. Operation Controller

[0111] 31 Redundant Controller

[0112] 33. Redundant memory

[0113] 41 First group of vehicle actuators

[0114] 53 Second group of vehicle actuators

[0115] 54 Manual control device

[0116] 55 Side Sensors

[0117] 56 Side Radar

[0118] 57 Lateral lane boundaries

[0119] 59 Short-range forward radar

[0120] 60 Short-range rear radar

[0121] 61 Wide-angle lidar sensor

[0122] 62 Vehicle Edge

[0123] 63 Lateral vehicle edge

[0124] 65. Front of the vehicle

[0125] 66. Rear of the vehicle

[0126] 67 Second vehicle

[0127] 83 Dashed line

[0128] 85 Dashed line

[0129] 100.1, 100.2 front wheels

[0130] Rear wheels of models 102.1, 102.2, 102.3, and 102.4

[0131] A distance

[0132] BMSH Lane Keeping Brake Action

[0133] BMSW Lane Change Braking Action

[0134] ES1 Operation Controller Fault Status

[0135] Fault conditions of the ES2 redundant controller

[0136] ES3 First Group of Vehicle Actuator Fault Status

[0137] ES4 Second Group of Vehicle Actuator Fault Status

[0138] FA Driving Mission

[0139] FAM manual driving mission

[0140] FAR Reduced Driving Duties

[0141] HA1 First Rear Axle

[0142] HA2 Second Rear Axle

[0143] SD sensor data

[0144] SDR Redundant Sensor Data

[0145] SDSS lateral sensor data

[0146] Steps S1–S18

[0147] TR trajectory

[0148] TRB trajectory

[0149] The trajectory of TRR reduction

[0150] VA front axle

[0151] ZT trajectory planning loop time

[0152] ZTB trajectory planning cycle time

Claims

1. A method (1) for controlling a vehicle (2), the vehicle having an autonomous vehicle system (5), the autonomous vehicle system being configured to control the vehicle (2) by means of a plurality of vehicle actuators (7), wherein, The vehicle system (5) has: An autonomous driving system (9) configured to perform dynamic driving tasks (FA) during fault-free operation of the autonomous driving system (9), wherein the autonomous driving system (9) drives at least one of the vehicle actuators (7) during fault-free operation to perform the dynamic driving tasks (FA), and A redundant driving system (11) is configured to perform reduced driving tasks (FAR). The autonomous driving system (9) is configured to perform trajectory planning in order to perform and provide the redundant driving system (11) with a planned reduced trajectory (TRR) for the reduced driving task (FAR) in addition to the driving trajectory (TRB). The autonomous driving system (9) and the redundant driving system (11) are interconnected and can detect faults (E1, E2) in each other's systems. The redundant driving system (11) drives at least one of the vehicle actuators (7) after learning of a fault (E1) in the autonomous driving system (9) to perform the reduced driving task (FAR) using a planned trajectory (TR) provided by the autonomous driving system. The feature is that the redundant driving system (11) is configured to perform reduced trajectory planning so as to obtain a reduced trajectory (TRR) for the reduced driving task (FAR) when the autonomous driving system (9) does not provide a valid planned trajectory (TR). The redundant driving system (11) has one or more simple redundant sensors (17, 17.1, 17.2) that provide redundant sensor data (SDR) of lower quality than the data of the main sensors of the autonomous driving system to the central redundant control unit (19). The central redundant control unit (19) uses the redundant sensor data (SDR) to determine whether there is an obstacle on the planned trajectory (TR) or the reduced trajectory (TRR), and when it determines that there is an obstacle on the planned trajectory (TR) or the reduced trajectory (TRR), it modifies the planned trajectory (TR) or the reduced trajectory (TRR) using the redundant sensor data (SDR). Furthermore, the redundant driving system (11) drives at least one of the vehicle actuators (7) after it learns that the autonomous driving system (9) has malfunctioned (E1) in order to perform the reduced driving task (FAR) using the reduced trajectory (TRR). Compared to the planned trajectory (TR), the reduced trajectory (TRR) has one or more of the following characteristics: Use a reduced set of parameters; Performed based on reduced qualitative and / or quantitative data; The maximum length and / or the maximum time required for a vehicle to travel along the track are limited.

2. The method (1) according to claim 1, wherein, The autonomous driving system (9) cyclically executes the trajectory planning to obtain a planned trajectory (TR), and provides the planned trajectory (TR) to the redundant driving system (11).

3. The method (1) according to any one of the preceding claims, wherein, The autonomous driving system (9) has one or more main sensors (13, 13.1, 13.2, 13.3) that provide sensor data (SD) to the central control unit (15) of the autonomous driving system (9), and wherein the central control unit (15) performs the trajectory planning using the sensor data (SD).

4. The method (1) according to claim 1, wherein, The redundant driving system (11) is powered by a redundant voltage source (21) that is independent of the autonomous driving system (9).

5. The method (1) according to claim 3, wherein, The simple redundant sensors (17, 17.1, 17.2) also provide the redundant sensor data (SDR) to the central control unit (15).

6. The method (1) according to claim 1 or 2, wherein, The reduced driving task (FAR) is a controlled braking action (BM), wherein the redundant driving system (11) prevents the wheels (100.1, 100.2, 102.1, 102.2, 102.3, 102.4) of the axles (VA, HA1, HA2) of the vehicle (2) from locking up.

7. The method (1) according to claim 1 or 2, wherein, The reduced driving task (FAR) is a controlled braking action (BM), wherein the controlled braking action (BM) is a lane keeping braking action (SH-BM), wherein the vehicle remains in the driving lane (25), and / or a lane changing braking action (SW-BM), wherein the vehicle is steered into an existing drivable alternative driving lane (26) and decelerates. The central redundant control unit (19) monitors the maintenance of the planned trajectory (TR) or the reduced trajectory (TRR) using the redundant sensor data (RSD).

8. The method (1) according to claim 5, wherein, When there is no fault (E1), the central control unit (15) performs a trajectory planning to obtain a trajectory (TRB) and provides the trajectory (TRB) to the operation controller (29) and the redundancy controller (31), wherein the operation controller (29) and / or the redundancy controller (31) drive at least one of the vehicle actuators (7) to keep the vehicle on the pre-planned trajectory (TRB).

9. The method (1) according to claim 8, wherein, The vehicle actuator (7) has at least one vehicle actuator (7) from the group consisting of: a transmission (7.1), a motor (7.2), a main braking system (7.3), a redundant braking system (4), or a steering actuator (7.5).

10. The method (1) according to claim 8, wherein, The central redundant control unit (19) provides the planned trajectory (TR) or the reduced trajectory (TRR) of the reduced driving task (FAR) to the operation controller (29) and the redundant controller (31), wherein the operation controller (29) and / or the redundant controller (31) drive at least one of the vehicle actuators (7) to keep the vehicle on the reduced trajectory (TRR) of the reduced driving task (FAR) when the autonomous driving system (9) fails and there is no operating trajectory (TRB).

11. The method according to claim 8, wherein, The operation controller (29) monitors the fault status (ES2) of the redundant controller (31), and wherein the redundant controller (31) monitors the fault status (ES1) of the operation controller (29).

12. The method (1) according to claim 1 or 2, wherein, In the event of failure of the main braking system (7.3) of the autonomous driving system (9), the vehicle (2) brakes by means of a redundant braking system (7.4), which is independent of the main voltage source (37) of the autonomous driving system (9).

13. The method (1) according to claim 12, wherein, The steering of the vehicle (2) is achieved by means of a steering actuator (39) driven by a redundant controller (31) and independent of the main voltage source (37) of the autonomous driving system (9).

14. The method (1) according to claim 1 or 2, wherein, In the event of a failure of the steering actuator (39) of the autonomous driving system (9), the vehicle’s emergency steering is performed by means of the main braking system (7.3).

15. The method (1) according to claim 1, wherein, The vehicle in question is a commercial vehicle (3).

16. The method (1) according to claim 7, wherein, wherein, The alternative lane (26) is the shoulder (27).

17. The method (1) according to claim 14, wherein, In the event of a failure of the steering actuator (39) of the autonomous driving system (9), the vehicle’s emergency steering is performed by means of the main braking system (7.3) driven by the redundant controller (31).

18. An autonomous vehicle system (5) for controlling a vehicle (2), said autonomous vehicle system having: An autonomous driving system (9) is configured to drive at least one vehicle actuator (7) of the vehicle (2) to perform dynamic driving tasks (FA) during fault-free operation of the autonomous driving system (9). A redundant driving system (11) is configured to perform reduced driving tasks (FAR). in, The autonomous driving system (9) is configured to perform trajectory planning in order to obtain a planned trajectory (TR) for the reduced driving task (FAR) and to provide the planned trajectory (TR) to the redundant driving system (11). The autonomous driving system (9) and the redundant driving system (11) are connected to each other and are configured to detect whether the other system has a fault (E1, E2). The redundant driving system (11) is configured to drive at least one vehicle actuator (7) to perform the reduced driving task (FAR) by applying the planned trajectory (TR) in the event of a failure (E1) of the autonomous driving system (9). The feature is that the redundant driving system (11) is configured to perform reduced trajectory planning so as to obtain a reduced trajectory (TRR) for the reduced driving task (FAR) when the autonomous driving system (9) does not provide a valid planned trajectory (TR). The redundant driving system (11) has one or more simple redundant sensors (17, 17.1, 17.2) that provide redundant sensor data (SDR) of lower quality than the data of the main sensors of the autonomous driving system to the central redundant control unit (19). The central redundant control unit (19) uses the redundant sensor data (SDR) to determine whether there is an obstacle on the planned trajectory (TR) or the reduced trajectory (TRR), and when it determines that there is an obstacle on the planned trajectory (TR) or the reduced trajectory (TRR), it modifies the planned trajectory (TR) or the reduced trajectory (TRR) using the redundant sensor data (SDR). Furthermore, the redundant driving system (11) is configured to drive at least one vehicle actuator (7) to perform the reduced driving task (FAR) with the application of a reduced trajectory (TRR) in the event of a failure (E1) of the autonomous driving system (9). The reduced trajectory (TRR) has one or more of the following characteristics compared to the planned trajectory (TR): Use a reduced set of parameters; Performed based on reduced qualitative and / or quantitative data; The maximum length and / or the maximum time required for a vehicle to travel along the track are limited.

19. The autonomous vehicle system (5) according to claim 18, wherein, The autonomous driving system (9) has one or more main sensors (13, 13.1, 13.2) for acquiring sensor data (SD), a central control unit (15) connected to the main sensors (13, 13.1, 13.2), and a main voltage source (37) for the autonomous driving system (9), wherein the central control unit (15) is configured to perform trajectory planning using the sensor data (SD) when there is no fault (E1) in order to obtain a planned trajectory (TR).

20. The autonomous vehicle system (5) according to claim 19, wherein, The autonomous driving system (9) also has a driving controller (29) connected to the central control unit (15), the driving controller being configured to drive at least one vehicle actuator (7) and / or a first group (41) of vehicle actuators (7) of the vehicle system (5).

21. The autonomous vehicle system (5) according to claim 20, wherein, The first group (41) of vehicle actuators (7) includes a transmission (7.1), a motor (7.2) and / or a main braking system (7.3) connected to the main voltage source (37) of the autonomous driving system (9).

22. The autonomous vehicle system (5) according to claim 20, wherein, The first group (41) of vehicle actuators (7) includes a steering actuator (7.5) and / or a redundant braking system (7.4) connected to the main voltage source (37) of the autonomous driving system (9).

23. The autonomous vehicle system (5) according to any one of claims 19 to 22, wherein, The redundant driving system (11) has one or more simple redundant sensors (17) for obtaining redundant sensor data (SDR), which are connected to the central control unit (15) of the autonomous driving system (9) and the central redundant control unit (19) of the redundant driving system (11).

24. The autonomous vehicle system (5) according to claim 23, wherein, The redundant driving system (11) also includes a redundant voltage source (51) for supplying power to the redundant driving system (11) and a redundant controller (31), the redundant controller being configured to drive the vehicle actuators (7) and / or a second set (53) of the vehicle actuators (7) of the vehicle system (5).

25. The autonomous vehicle system (5) according to claim 21, wherein, The redundant driving system (11) further includes a redundant voltage source (51) and a redundant controller (31) for powering the redundant driving system (11), the redundant controller being configured to drive the vehicle actuators (7) and / or a second set (53) of vehicle actuators (7) of the vehicle system (5), wherein the second set (53) of vehicle actuators (7) includes a steering actuator (7.5) and / or a redundant braking system (7.4) connected to the redundant voltage source (51) of the redundant driving system (11).

26. The autonomous vehicle system (5) according to claim 22, wherein, The redundant driving system (11) further includes a redundant voltage source (51) and a redundant controller (31) for supplying power to the redundant driving system (11). The redundant controller is configured to drive the vehicle actuators (7) and / or a second set (53) of vehicle actuators (7) of the vehicle system (5). The second set (53) of vehicle actuators (7) includes a transmission (7.1), a motor (7.2) and / or a main braking system (7.3) connected to the redundant voltage source (51) of the redundant driving system (11).

27. The autonomous vehicle system (5) according to claim 23, wherein, The simple redundant sensor (17) has a vehicle side sensor (55) configured to know the distance (A) to the lateral lane boundary (57).

28. The autonomous vehicle system (5) according to claim 23, wherein, The simple redundant sensor (177) includes a short-range front radar (59) and / or a wide-angle lidar sensor (61) configured to know the drivable space up to the edge of the vehicle (62).

29. The autonomous vehicle system (5) according to claim 20, wherein, The operation controller (29) is configured to detect and provide the central control unit (15) with the fault status (ES3) of the first group (41) vehicle actuators (7).

30. The autonomous vehicle system (5) according to claim 24, wherein, The redundancy controller (31) is configured to detect and provide the central redundancy control unit (19) and / or the central control unit (15) with the fault status (E4) of the second group (53) vehicle actuators (7).

31. The autonomous vehicle system (5) according to claim 18, wherein, The vehicle in question is a commercial vehicle (3).

32. The autonomous vehicle system (5) according to claim 27, wherein, The vehicle side sensor (55) is a side radar and / or a side ultrasonic sensor.

33. The autonomous vehicle system (5) according to claim 27, wherein, The vehicle side sensor (55) is a side lidar sensor.

34. A vehicle (2) having an autonomous vehicle system (5) according to any one of claims 18 to 33, said autonomous vehicle system being configured to implement the method (1) according to any one of claims 1 to 17.

Images