Methods for determining the trajectory used to control the vehicle

Abstract

The present invention relates to a computer-implemented method for determining the trajectory (120, 122) of a controlled vehicle (100), wherein the vehicle (100) is equipped with a sensor system (102, 102a, 102b) for capturing the environment of the vehicle (100) and a vehicle computer (112) for processing sensor data (116) and controlling the vehicle (100). The method includes the following steps: receiving sensor data (116) generated by the sensor system (102, 102a, 102b) in the control module (206) of the vehicle computer (112); inputting the sensor data (116) into a safety algorithm configured to identify safety-related objects (104, 106, 109) based on the sensor data (116); inputting the sensor data (116) into a comfort algorithm configured to identify comfort-related objects (108, 109) based on the sensor data (116); and using an environmental model (226) representing the environment of the vehicle (100) to estimate the future of the identified objects (104, 106, 108, 109). The environment model stores identified objects (104, 106, 108, 109) and tracks them over time; based on the estimated future states of the identified objects (104, 106, 108, 109), a safety trajectory (120) is calculated considering safety specifications and a comfort trajectory (122) is calculated considering comfort specifications; it is checked whether the comfort trajectory (122) meets the safety specifications; if the comfort trajectory (122) meets the safety specifications, the vehicle (100) is controlled using the comfort trajectory (122); if the comfort trajectory (122) does not meet the safety specifications, the vehicle (100) is controlled using the safety trajectory (120).

Description

Technical Field

[0001] This invention relates to a method for determining the trajectory of a controlled vehicle. Furthermore, this invention relates to a vehicle computer, vehicle system, computer program, and computer-readable medium for performing the method. Background Technology

[0002] Autonomous driving places high demands on the safety of vehicle control components. At the same time, it is essential to ensure the most comfortable driving experience possible. However, factors affecting the driving experience can vary significantly depending on the vehicle's environment. Therefore, it is desirable to reliably identify these factors under as many vehicle conditions as possible. Continued adherence to safety requirements for control components is crucial in this regard.

[0003] The vehicle may have a sensor system for capturing the vehicle's environment and a vehicle computer for processing sensor data and controlling the vehicle. The sensor system may, for example, include multiple sensors of different types. The vehicle computer may, for example, be configured to merge sensor data from the individual sensors, also known as sensor data fusion, to identify objects in the vehicle environment by evaluating the merged sensor data, and to calculate a suitable trajectory for the vehicle, taking into account the future states of both the vehicle and the identified objects. Summary of the Invention

[0004] Against this backdrop, a method, a vehicle computer, a vehicle system, a computer program, and a computer-readable medium according to the present invention are proposed using the solutions presented herein. Advantageous extensions and improvements to the solutions presented herein are derived from the specification.

[0005] Advantages of the present invention

[0006] Embodiments of the present invention advantageously allow the vehicle computer architecture to be subdivided into a safety domain for calculating the safest possible trajectory and a comfort domain for calculating the most comfortable possible trajectory. Here, for example, different algorithms can be used for sensor data processing and / or trajectory calculation in each of the two domains. This is advantageous because the corresponding algorithms can be specifically adapted to the respective requirements of these domains—safety requirements or comfort requirements—thereby improving both recognition accuracy and computational efficiency.

[0007] A first aspect of the invention relates to a computer-implemented method for determining a trajectory for controlling a vehicle, wherein the vehicle is equipped with a sensor system for capturing the vehicle's environment and a vehicle computer for processing the sensor data and controlling the vehicle. The method includes the steps of: receiving sensor data generated by the sensor system in a control module of the vehicle computer; inputting the sensor data into a safety algorithm configured to identify safety-related objects based on the sensor data; inputting the sensor data into a comfort algorithm configured to identify comfort-related objects based on the sensor data; estimating the future state of the identified objects using an environment model representing the vehicle's environment, the environment model storing the identified objects and tracking them over time; calculating a safety trajectory considering safety specifications and a comfort trajectory considering comfort specifications based on the estimated future states of the identified objects; checking whether the comfort trajectory satisfies the safety specifications; using the comfort trajectory to control the vehicle if the comfort trajectory satisfies the safety specifications; and using the safety trajectory to control the vehicle if the comfort trajectory does not satisfy the safety specifications.

[0008] Vehicles can be, for example, passenger cars, trucks, buses, or motorcycles. Alternatively, vehicles can also be understood as robots.

[0009] This method can, for example, be executed automatically by the vehicle computer. The vehicle computer may include hardware modules and / or software modules. Therefore, the control module can be implemented in hardware and / or software. Furthermore, the vehicle computer may include a processor, memory, and a bus system for data communication between the processor and the memory. Additionally, the vehicle computer may include one or more interfaces for data communication with external devices (e.g., also with other vehicles or infrastructure) (also known as Car-to-X communication) or with the Internet.

[0010] The sensor system may include at least one environmental sensor, such as an ultrasonic sensor, radar sensor, lidar sensor, or camera. Additionally, the sensor system may include at least one driving dynamics sensor, such as a yaw rate sensor, acceleration sensor, wheel speed sensor, or steering wheel angle sensor. Furthermore, the sensor system may include a position sensor for determining the vehicle's absolute position using a global navigation satellite system such as GPS, GLONASS, etc. The vehicle's absolute position may be determined additionally or alternatively based on sensor data from one or more driving dynamics sensors.

[0011] The vehicle computer can be configured to partially or fully automatically control the vehicle, i.e., steering, acceleration, braking, or navigation, by correspondingly manipulating the vehicle's actuator system. The actuator system may, for example, include at least one steering actuator, at least one braking actuator, and / or engine control equipment. To operate the actuator system, the vehicle may be equipped with one or more driver assistance functions, for example. These driver assistance functions can be implemented as hardware and / or software and may, for example, be integrated into the vehicle computer.

[0012] The sensor data can be the output of each sensor in a sensor system. For example, the output can be data generated by filtering and / or transforming the raw data from the sensors. However, the sensor data can also be data generated by processing the sensor outputs.

[0013] For example, when identifying objects, the object category of the object, such as "oncoming vehicle," "pedestrian," or "road marking," can be identified at multiple consecutive time steps, as well as the current state of the object, such as its speed, position, and / or orientation relative to vehicles and / or other identified objects. Identified objects, i.e., their object category, speed, position, and / or orientation, can be stored in an object list and continuously updated.

[0014] Here, safe and comfortable trajectories can also be calculated based on the estimated current state of the identified objects.

[0015] In addition, digital maps can be used to identify objects (see below).

[0016] To track identified objects over time, state estimators such as Bayesian filters, particle filters, or Kalman filters can be used.

[0017] The vehicle's environment can be represented, for example, by an environment model configured to predict the movement of vehicles and other traffic participants in a shared traffic space based on objects stored in a list of objects. The traffic space can be defined by identified objects such as road markings, free-roaming zones, traffic signs, or traffic signal systems.

[0018] Vehicles and / or identified objects can be located, for example, by comparing the measured location of the vehicle or identified object with the object's location stored in a digital map. For instance, objects stored in a digital map can be integrated into an environment model.

[0019] Comfort algorithms and safety algorithms can be different from each other. For example, a comfort algorithm can be trained using machine learning, while a safety algorithm can be a simpler algorithm for protection and deployment, such as within the scope of SOTIF (Safety Of The Intended Functionality) or ISO 26262 standards.

[0020] For example, the nature of the road on which a vehicle moves may be related to comfort. For instance, whether the road is smooth or uneven, has few or many curves, is paved or unpaved, scenic or poorly located, has smooth or congested traffic, whether pedestrians, cyclists, skateboarders, etc., are beside the road, whether there are special buildings such as hospitals, or whether special vehicles such as trucks, vans, motorcycles, or street cleaning vehicles are in adjacent or more distant lanes, all relate to the comfort of vehicle occupants. Generally, comfort algorithms can be configured to identify and predict a significantly greater number of object categories over a much larger action distance than is needed for safe trajectory planning, such as objects further away from the road. Conversely, for the comfort of other road users, especially pedestrians or cyclists, factors such as whether the road on which the vehicle moves is wet or dry, dirty or clean may be relevant. For example, it should be avoided that other road users are splashed with water, soiled, or otherwise disturbed by passing vehicles.

[0021] Safety-related objects can be understood as objects that decisively affect or may affect the safety of vehicles and / or other road users. For example, these objects could be things that a vehicle should not collide with, other road users, or road markings.

[0022] Safety-related objects can also be comfort-related objects, and vice versa.

[0023] Safety specifications may include, for example, a pre-defined distance, pre-defined orientation, and / or pre-defined relative speed of the vehicle relative to safety-related objects (such as other road users, road markings, etc.).

[0024] Similarly, comfort specifications can be, for example, a pre-given distance, pre-given orientation, and / or pre-given relative speed of the vehicle relative to comfort-related objects. Comfort specifications can also take the form of machine learning algorithms, such as artificial neural networks, which evaluate environmental models and / or sensor data (e.g., camera images) and have been trained on naturally observed human driving behavior.

[0025] In other words, this method is based on the architecture of the vehicle's computer, which is divided into comfort and safety layers (or domains), allowing the use of algorithms best suited to that architecture at each layer. Thus, for example, to identify relatively complex comfort-related features, correspondingly trained machine learning algorithms such as artificial neural networks can be used, while to identify safety-related features, algorithms that are easier to protect and deploy can be used.

[0026] To keep programming costs low, the same software components can be used, for example, at least partially, for different levels.

[0027] A second aspect of the invention relates to a vehicle computer configured to perform a method according to an embodiment of the first aspect of the invention. Features of the method may also be features of the vehicle computer, and vice versa.

[0028] A third aspect of the invention relates to a vehicle system comprising a sensor system for capturing the vehicle environment and a vehicle computer according to an embodiment of the second aspect of the invention. Features of the method according to an embodiment of the first aspect of the invention may also be features of the vehicle system, and vice versa.

[0029] Other aspects of the invention relate to a computer program that, when executed by a vehicle computer according to an embodiment of a second aspect of the invention, performs a method according to an embodiment of a first aspect of the invention, and to a computer-readable medium having such a computer program stored thereon.

[0030] The computer-readable medium can be a volatile or non-volatile data storage device. For example, the computer-readable medium can be a hard disk, a USB storage device, RAM, ROM, EPROM, or flash memory. The computer-readable medium can also be a data communication network that enables the download of program code, such as the Internet or a cloud. The features of the method according to the first aspect of the invention can also be features of the computer program and / or the computer-readable medium, and vice versa.

[0031] The ideas for embodiments of the present invention can be considered, in particular, based on the ideas and findings described below.

[0032] According to one implementation, the output of the safety algorithm is also input into the comfort algorithm, which is configured to further identify comfort-related objects based on the output of the safety algorithm. Therefore, it is possible to consider certain safety guidelines when identifying comfort-related objects. In other words, in this way, the safety algorithm can make the comfort algorithm safer.

[0033] It can also process raw sensor data such as images using comfort algorithms without the need for dedicated object recognition.

[0034] According to one implementation, the comfort algorithm is trained via machine learning to identify comfort-related and / or safety-related objects based on sensor data. This enables a relatively high level of autonomous driving performance.

[0035] According to one implementation, the comfort algorithm is based on an artificial neural network. The artificial neural network can be, for example, a multilayer perceptron or a convolutional neural network.

[0036] According to one implementation, based on an estimated future state of an identified object, an additional safe trajectory is calculated to transition the vehicle to a safe state, taking into account other safety specifications. This additional safe trajectory can be understood as a risk-optimized trajectory for stopping the vehicle in a safe, i.e., least risky, state. For example, the vehicle can be stopped at the edge of the driving road using this additional safe trajectory. When the calculation of the safe trajectory fails, the additional safe trajectory is used to control the vehicle. The difference between the safe trajectory and the additional safe trajectory can be, for example, that the additional safe trajectory transitions the vehicle to a safe state, while the safe trajectory continues driving and aligns with the comfort trajectory at an appropriate future point in time.

[0037] According to one embodiment, the method further includes the following steps: receiving the sensor data in a separate control module of the vehicle computer, wherein the control module and the separate control module are independently powered; inputting the sensor data into the safety algorithm by the separate control module; estimating the future state of the identified object by the separate control module using the environmental model; calculating an additional safety trajectory for transitioning the vehicle to a safe state based on the estimated future state of the identified object, taking into account additional safety specifications; checking whether the control module is functioning; and controlling the vehicle using the additional safety trajectory when the control module is not functioning. This creates redundancy to safely and accident-free transition the vehicle to a safe state in the event of vehicle computer failure.

[0038] According to one embodiment, the vehicle system includes a control module configured to perform a method according to an embodiment of the first aspect of the invention, and at least one additional control module that can be supplied with electrical power independently of the control module and is also configured to perform a method according to an embodiment of the first aspect of the invention.

[0039] According to one embodiment, the control module includes a software module configured to perform the method according to an embodiment of the first aspect of the invention. Furthermore, the additional control module also includes a software module configured to perform the method according to an embodiment of the first aspect of the invention. Here, the software module of the additional control module is at least partially a copy of the software module of the control module. Attached Figure Description

[0040] Embodiments of the present invention are described below with reference to the accompanying drawings, which should not be construed as limiting the invention.

[0041] Figure 1 A vehicle having a vehicle system according to an embodiment of the present invention is shown.

[0042] Figure 2 It shows Figure 1 The vehicle system in the middle.

[0043] These figures are schematic only and not to scale. In the figures, the same reference numerals denote the same features or features with the same effect. Detailed Implementation

[0044] Figure 1 A vehicle 100 is shown, equipped with a sensor system 102 for capturing objects in the environment of the vehicle 100 (road marking 104 is exemplified here), a vehicle 106 traveling ahead, a puddle 108 and a pedestrian 109 standing near the puddle 108, an actuator system 110, and a vehicle computer 112. The actuator system 110 may include, for example, one or more steering or braking actuators and engine control devices. The vehicle computer 112, sensor system 102, and actuator system 110 are components of a vehicle system 114, which may be configured to control the vehicle 100 in a partially and / or fully automated manner. For example, the vehicle computer 112 may manipulate the actuator system 110 to steer, accelerate, or brake the vehicle 100.

[0045] To this end, the vehicle computer 112 first receives sensor data 116 from various sensors of the sensor system 102, exemplarily from camera 102a and radar sensor 102b, and calculates at least one safe trajectory 120 and a comfort trajectory 122 (indicated by two dashed arrows) for the vehicle 100 by evaluating the sensor data 116. Here, the vehicle computer 112 identifies road markings 104, a vehicle 106 traveling ahead, a puddle 108, and a pedestrian 109. For the calculation of the comfort trajectory 122, puddle 108 and pedestrian 109 may be particularly relevant, while for the calculation of the safe trajectory 120, road markings 104 and the vehicle 106 traveling ahead may also be relevant, in addition to pedestrian 109.

[0046] Generally, everything related to the calculation of the safety trajectory 120 can also be related to the calculation of the comfort trajectory 122. Figure 1 The identification and avoidance of puddles shown are merely examples.

[0047] The two tracks 120 and 122 can be different from each other because safety track 120 is calculated with safety specifications prioritized, while comfort track 122 is calculated with comfort specifications prioritized. This will be explained below based on... Figure 2 To describe in more detail. In short, comfort trajectory 122 is designed to provide the occupants of vehicle 100 with the most pleasant driving experience possible, while minimizing the adverse effects of vehicle 100 on other road users. For example, unlike safety trajectory 120, comfort trajectory 122 avoids puddles 108 so that pedestrians 109 will not be splashed when vehicle 100 passes by.

[0048] The vehicle computer 112 also checks whether the comfort trajectory 122 is safe enough, for example, whether the vehicle 100 avoids colliding with oncoming vehicles while avoiding the puddle 108. If the comfort trajectory 122 is safe enough, the vehicle computer 112 controls the actuator system 110 to guide the vehicle 100 according to the comfort trajectory 122. Otherwise, the vehicle computer 112 uses the safety trajectory 120 to control the vehicle 100.

[0049] Figure 2 It shows Figure 1 Possible architecture of the vehicle computer 112. This architecture includes a safety layer 200, a comfort layer 202, and a redundancy layer 204. Layers 200, 202, and 204 represent separate domains of the vehicle computer 112's architecture. Safety layer 200 and comfort layer 202 are implemented in control module 206, which can also be referred to as the main computing cluster. Redundancy layer 204 is implemented in another control module 208, which can be powered independently of control module 206. The other control module 208 can also be referred to as an auxiliary computing cluster. In the event of a failure, such as a voltage supply interruption or a malfunction of control module 206, the other control module 204 takes over control of the vehicle 100.

[0050] The vehicle computer 112 is subdivided into different functional areas across all three levels 200, 202, and 204, which will be described in more detail below. Modules contained within these functional areas can be implemented as hardware and / or software. Modules with the same reference numerals should be understood as the same module if they are executed at different levels. For example, a module of another control module 208 may be at least partially a copy of a module of control module 206. Data flows between modules are indicated by arrows.

[0051] The first functional area 210 relates to perceiving the environment of vehicle 100 and detecting objects by merging sensor data 116 from multiple consecutive time steps. To this end, a safety perception module 212 is executed at the safety layer 200 and redundancy layer 204. This safety perception module executes a safety algorithm, to which the sensor data 116 is input, and the safety algorithm provides identified safety-related objects as output, such as a vehicle 106 traveling ahead, a road sign 104, or a pedestrian 109. In parallel, a comfort perception module 214 is executed at the comfort layer 202. This comfort perception module executes a comfort algorithm, to which the sensor data 116 is also input, and the comfort algorithm provides identified comfort-related objects as output, such as a pedestrian 109 and a puddle 108.

[0052] Comfort algorithms can be based on corresponding trained classifiers, such as artificial neural networks. In particular, artificial neural networks can be deep neural networks, such as convolutional neural networks with a large number of trainable convolutional layers (also known as convolutional layers).

[0053] Safety algorithms can be computationally less demanding than comfort algorithms. The safety awareness module 212 may have been developed in accordance with quality standards ASIL-B(D) or ASIL-D.

[0054] The second functional area 216 involves locating vehicle 100 and identified objects 104, 106, 108, and 109 in a digital map, which may include a safety layer 218 and a comfort layer 220. The safety requirements of safety layer 218 and comfort layer 220 may differ from each other. Safety layer 218 is located within safety layer 200 and redundancy layer 204. Comfort layer 220 is located within comfort layer 202. The location is performed by a location module 222, which can be performed on both safety layer 200 and redundancy layer 204. The output of location module 222 can be input from safety layer 200 or integrated into comfort layer 220.

[0055] The third functional area 224 involves an environment model 226, in which identified objects 104, 106, 108, 109 and vehicle 100 are stored as models and continuously updated.

[0056] Environment model 226 may be developed according to ASIL-D and may contain data on different levels of reliability. Environment model 226 resides in security layer 200 and may include a security subgraph 228, the data of which can be used in both security layer 200 and redundancy layer 204. Security access module 230 controls access to the data in environment model 226.

[0057] Comfort level 202 includes a comfort access module 232, which can input data into environment model 226, such as data related to identified comfort-related objects 108 and 109, and read data from environment model 226, such as data related to identified security-related objects 104, 106, and 109. In both cases, access is performed via security access module 230.

[0058] The fourth functional area 234 involves using the corresponding model in the environment model 226 to predict the movement of identified objects 104, 106, 108, 109 or vehicle 100.

[0059] To this end, a comfort prediction module 236 can be implemented at comfort level 202, which estimates the future state of environmental model 226 in terms of comfort. The comfort prediction module 236 can also, for example, generate comfort-oriented boundary conditions for subsequent trajectory planning. Such boundary conditions could, for example, be distances relative to other traffic participants that should be followed for comfort reasons.

[0060] The output of the comfort prediction module 236 can be used to determine the comfort-oriented target state of the environment model 226 for trajectory planning in the comfort state estimator 238.

[0061] Similarly, a safety prediction module 240 can be implemented at both the safety layer 200 and the redundancy layer 204. This module estimates the future state of the environment model 226 in terms of safety. The safety prediction module 240 can, for example, generate safety-oriented boundary conditions for subsequent trajectory planning. Such boundary conditions could, for example, be distances relative to other traffic participants that should be followed for safety reasons.

[0062] The safety-oriented target state of the environment model 226 can be determined for trajectory planning in the safety state estimator 242 based on the output of the safety prediction module 240. The safety state estimator 242 can be implemented only at the safety layer 200.

[0063] Furthermore, a risk-optimized, safety-oriented target state for the environment model 226, representing the state with the lowest possible risk to vehicle 100 and / or other traffic participants, can be determined in an additional safety state estimator 244. The additional safety state estimator 244 can be implemented at both the safety layer 200 and the redundancy layer 204.

[0064] In the event of a failure, trajectory planning can be performed, for example, based on the target state optimized by risk.

[0065] The fifth functional area 246 involves trajectory planning. In this case, solvers 248 for calculating the safety trajectory 120 or the comfort trajectory 122 can be implemented on all three levels 200, 202, and 204.

[0066] Boundary condition evaluator 250 evaluates the corresponding boundary conditions. Based on the corresponding target state and the output of boundary condition evaluator 250, solver 248 calculates multiple possible safe or comfortable trajectories.

[0067] The safety trajectory weighter 252, implemented on the safety layer 200 and the redundancy layer 204, allocates the cost to each possible safety trajectory based on the safety cost function and selects the most suitable safety trajectory 120 from them.

[0068] Similarly, the comfort trajectory weighter 254 implemented on the comfort level 202 allocates costs to each possible comfort trajectory based on the comfort cost function and selects the most suitable comfort trajectory 122 from them.

[0069] The safety cost function and the comfort cost function can be different functions and, for example, can differ in terms of complexity.

[0070] Solver 248 can calculate an additional safe trajectory based on the target state of risk optimization, which can be used to transform vehicle 100 into a safe state. The additional safe trajectory can be calculated similarly to the calculation of safe trajectory 120. The additional safe trajectory can be calculated both at the safety level 200 (i.e., by control module 206) and the redundancy level 204 (i.e., by another control module 208), and is therefore redundantly calculated.

[0071] The sixth functional area 256 involves arbitration. Here, the checking module 258, implemented on safety layer 200, which can also be called an arbitrator, checks whether the comfort trajectory 122 is compatible with or violates the safety-oriented boundary conditions. If the comfort trajectory 122 is compatible with the safety-oriented boundary conditions, the checking module 258 outputs the comfort trajectory 122. Otherwise, the checking module 258 outputs the safety trajectory 120 or another safety trajectory. If the calculation of the safety trajectory 120 fails for some reason, the other safety trajectory can be output.

[0072] Furthermore, the status monitor 260 can monitor all relevant components of the control module 206 or another control module 208. The status monitor 260 can be implemented at both the safety layer 200 and the redundancy layer 204. For example, if the status monitor 260 at the redundancy layer 204 determines an abnormal state of one of the relevant components of the control module 206, then the other control module 208 takes over control of the vehicle 100 based on an additional safety trajectory calculated by the other control module 208.

[0073] The seventh functional section 262 relates to the control of the actuator system 110, such as the drive system 264, braking system 266, and steering system 268 of the vehicle 100. For this purpose, a vehicle control module 270 is implemented at the safety layer 200 and the redundancy layer 204, which sends corresponding control commands to the actuator system 110. Thus, the actuator system 110 is redundantly operated via the safety layer 200 and the redundancy layer 204, wherein control commands from the safety layer 200 take precedence over control commands from the redundancy layer 204, provided that the status monitor 260 does not detect functional impairment or a failure of the safety layer 200.

[0074] Finally, it should be noted that terms such as "having" or "comprising" do not exclude other elements or steps, while terms such as "a" do not exclude a plurality. Reference numerals in the claims should not be considered limiting.

Claims

1. A computer-implemented method for determining the trajectory (120, 122) of a controlled vehicle (100), wherein the vehicle (100) is equipped with a sensor system (102, 102a, 102b) for capturing the environment of the vehicle (100) and a vehicle computer (112) for processing sensor data (116) and controlling the vehicle (100), wherein the method comprises: The control module (206) of the vehicle computer (112) receives sensor data (116) generated by the sensor system (102, 102a, 102b). The sensor data (116) is input into a security algorithm, which is configured to identify security-related objects based on the sensor data (116); The sensor data (116) is input into a comfort algorithm, which is configured to identify comfort-related objects based on the sensor data (116); An environment model (226) representing the environment of the vehicle (100) is used to estimate the future state of the identified object, in which the identified object is stored and tracked over time; Based on the estimated future state of the identified objects, the safety trajectory (120) is calculated with regard to safety specifications and the comfort trajectory (122) is calculated with regard to comfort specifications. Check whether the comfort trajectory (122) meets the safety specifications; If the comfort trajectory (122) meets the safety specifications, then the comfort trajectory (122) is used to control the vehicle (100). If the comfort trajectory (122) does not meet the safety specifications, the safety trajectory (120) is used to control the vehicle (100). The output of the safety algorithm is also input into the comfort algorithm; The comfort algorithm is configured to also identify the comfort-related objects based on the output of the safety algorithm.

2. The method according to claim 1, The comfort algorithm is trained by machine learning to identify comfort-related objects and / or safety-related objects based on the sensor data (116).

3. The method according to claim 2, The comfort algorithm mentioned above is based on artificial neural networks.

4. The method according to any one of the preceding claims, Based on the estimated future state of the identified object, an additional safety trajectory for converting the vehicle (100) into a safe state is calculated, taking into account other safety specifications. If the calculation of the safety trajectory (120) fails, the alternative safety trajectory is used to control the vehicle (100).

5. The method according to any one of claims 1 to 3, further comprising: The sensor data (116) is received in a separate control module (208) of the vehicle computer (112), wherein the separate control module (208) is supplied with electrical power independently of the control module (206); The sensor data (116) is input into the security algorithm by the additional control module (208); The additional control module (208) uses the environment model (226) to estimate the future state of the identified objects; The additional control module (208) calculates an additional safety trajectory for converting the vehicle (100) into a safe state based on the estimated future state of the identified object, taking into account additional safety specifications. The additional control module (208) checks whether the control module (206) is functioning; When the control module (206) is not functioning, the vehicle (100) is controlled by the additional control module (208) using the additional safety trajectory (120).

6. A vehicle computer (112) configured to perform the method according to any one of the preceding claims.

7. The vehicle computer (112) according to claim 6, comprising: Control module (206), the control module being configured to perform the method according to any one of claims 1 to 4; and At least one additional control module (208) is provided with electrical power independently of the control module (206) and is configured to perform the method according to claim 5.

8. The vehicle computer (112) according to claim 7. The control module (206) includes a software module configured to perform the method according to any one of claims 1 to 4; The additional control module (208) includes a software module configured to perform the method according to claim 5; The software module of the additional control module (208) is at least partially a copy of the software module of the control module (206).

9. A vehicle system (114), comprising: Sensor systems (102, 102a, 102b) for capturing the environment of the vehicle (100). The vehicle computer (112) according to any one of claims 6 to 8 is used to process sensor data (116) of the sensor system (102, 102a, 102b) and control the vehicle (100).

10. A computer program product having a computer program including instructions that, when the computer program is executed by a vehicle computer (112) according to any one of claims 6 to 8, cause the vehicle computer (112) to perform the method according to any one of claims 1 to 5.

11. A computer-readable medium having a computer program product according to claim 10 stored thereon.

Images