Apparatus and methods for generating and transmitting control commands for autonomous vehicles

Abstract

This invention relates to an apparatus for generating and transmitting control commands for an autonomous motor vehicle, which receives at least environmental data and vehicle state data, thereby calculating a trajectory, calculating control commands required to achieve the trajectory, and transmitting them to at least one actuator. The apparatus includes at least one first subsystem, a second subsystem, a third subsystem, and a fourth subsystem, wherein the first and third subsystems operate as master controllers and the second and fourth subsystems operate as slave controllers. The first and second subsystems are connected via at least one data connection, and the third and fourth subsystems are connected via another data connection. Additionally, the first and third subsystems are connected via at least one data connection, and the second and fourth subsystems are connected via a data connection. The first and second subsystems respectively receive at least environmental data and vehicle state data, and the third and fourth subsystems transmit at least control commands to at least one actuator. At least the first and third subsystems are silently configured to handle errors. At least one control command is generated and transmitted in a single error of the subsystem to bring the motor vehicle to a safe state. The invention also relates to a method.

Description

Technical Field

[0001] This invention provides an apparatus and method for generating and transmitting control commands for autonomous vehicles. Background Technology

[0002] Such a device must be fault-tolerant relative to a single error, meaning it must be able to, for example, bring the vehicle to a safe stop or otherwise continue safe driving. This type of maneuver is also known as "residual homing," "residual homing," or "lane interruption." One possible approach is full redundancy, where two systems operate in parallel. Summary of the Invention

[0003] The present invention addresses the following technical problem by creating an improved apparatus for generating control commands for autonomous vehicles and providing a suitable method for use.

[0004] The technical problem is solved by an apparatus having the features of claim 1 and a method having the features of claim 9. Further advantageous embodiments of the invention are derived from the dependent claims.

[0005] A device for generating and transmitting control commands for an autonomous vehicle is configured to receive at least environmental data and vehicle state data, thereby calculating at least one trajectory, calculating control commands for at least one actuator required to achieve the trajectory, and transmitting them to at least one actuator. The device includes at least one first subsystem, a second subsystem, a third subsystem, and a fourth subsystem, wherein the first and third subsystems operate as master controllers and the second and fourth subsystems operate as slave controllers. The first and second subsystems are connected via at least one data connection, and the third and fourth subsystems are connected to each other via another data connection. Additionally, the first and third subsystems are connected to each other via at least one data connection, and the second and fourth subsystems are connected to each other via a data connection. The first and second subsystems respectively receive at least environmental data and vehicle state data, and the third and fourth subsystems transmit at least control commands to at least one actuator. At least the first and third subsystems are configured to silently handle errors. The device is further configured to generate and transmit at least one control command in the event of a single error in a subsystem, in order to bring the vehicle to a safe state.

[0006] The first through fourth subsystems can also be considered nodes in the network. Environmental data can originate from vehicle-side environmental sensing devices, such as cameras and / or radar sensors and / or lidar sensors and / or ultrasonic sensors. Alternatively or additionally, environmental data can originate from external sensors of traffic infrastructure and / or other motor vehicles. Vehicle state data, particularly the position, speed, and direction of the autonomous vehicle, is also included. Here, the first and second subsystems may receive the same environmental data and / or vehicle state data, or data from different data sources. The first and third subsystems are error-silent, meaning they remain "silent" in error situations and no longer notify the communication device. Preferably, the first and third subsystems are associated with a first voltage supply device, and the second and fourth subsystems are associated with a second voltage supply device, wherein the first and second voltage supply devices are independent of each other. However, it is also possible that each subsystem is associated with its own independent voltage supply device.

[0007] Through a master-slave configuration, the third and fourth subsystems can operate the same actuators without conflict, with a ring structure ensuring that control commands can always be calculated and transmitted. A reliable state also includes the possibility of further autonomous driving (either for restricted road sections or with limited performance or speed).

[0008] Preferably, the first and second subsystems each calculate at least one trajectory and, more preferably, also calculate control commands, wherein the third and fourth subsystems are then only responsible for transmission to the actuators. Thus, they can then be designed very simply and robustly.

[0009] In one implementation, the second and / or fourth subsystems are also configured to silently handle errors, thereby enabling the cancellation of monitoring by the master controller. Different implementation schemes for error silencing are possible. Different implementation schemes can also be implemented within the subsystems. Thus, for example, a watchdog circuit with hardwired and gated connections (aka shutdown paths) can be used, where the watchdog can also be placed in a sub-controller monitoring the master controller.

[0010] In another embodiment, the device is configured such that, in the event of a double error, where at least the third or fourth subsystem is not involved, the control command for emergency stop is generated by the third or fourth subsystem.

[0011] In another embodiment, the device is constructed such that control commands for the actuator are calculated and transmitted via a second or fourth subsystem during error-free operation. Here, the second and fourth subsystems can be designed to have higher computational capabilities than the first and third subsystems. The first and third subsystems can then be designed with simpler structures, thereby correspondingly improving their reliability and fault tolerance.

[0012] In another embodiment, the first subsystem is additionally connected to the fourth subsystem and / or the second subsystem is connected to the third subsystem. This, on the one hand, accelerates data transmission in error conditions.

[0013] In another embodiment, the third and fourth subsystems each consist of at least two separate secondary systems. These secondary systems are, for example, control units for steering, braking, drive, or transmission systems.

[0014] In view of the design scheme of the method of the present invention, the foregoing embodiments are fully referenced. Attached Figure Description

[0015] The present invention will then be described in more detail with reference to preferred embodiments. Wherein:

[0016] Figure 1 A schematic diagram of a device for generating control commands for an autonomous motor vehicle is shown in a first embodiment.

[0017] Figure 2 A schematic diagram of the device in the second embodiment is shown, and

[0018] Figure 3 A schematic diagram of the device in the third embodiment is shown. Detailed Implementation

[0019] exist Figure 1 The diagram schematically illustrates a device 1 for generating control commands for an autonomous vehicle. Device 1 includes a first subsystem CM (Commander Master), a second subsystem CS (Commander Slave), a third subsystem EM (Executor Master), and a fourth subsystem ES (Executor Slave). The first subsystem CM and the second subsystem CS are interconnected via a data connection IC (Inter Commander). Similarly, the third subsystem EM and the fourth subsystem ES are interconnected via a data connection IE (Inter Executor Connection). Furthermore, the first subsystem CM and the third subsystem EM are interconnected via a data connection CEM (Commander-Executor Connection Master). Finally, the second subsystem CS and the fourth subsystem ES are interconnected via a data connection CES (Commander-Executor Connection Slave). All four subsystems CM, CS, EM, and ES are configured to be error-silent.

[0020] The first subsystem CM and the second subsystem CS acquire environmental data and vehicle state data, and thereby calculate trajectories respectively. Here, the two subsystems CM and CS may acquire the same data or they may acquire data from different sensor systems or data sources. The sensor systems or data sources may be vehicle-side and / or external. The first subsystem CM transmits its trajectory to the third subsystem EM via a data connection CEM, and the second subsystem CS transmits its trajectory to the fourth subsystem ES. The third and fourth subsystems EM and ES then calculate control commands for the actuators respectively. Preferably, in error-free operation, only the control commands from the fourth subsystem ES are used to operate the actuators. Alternatively, the first subsystem CM and the second subsystem CS may additionally calculate control commands and then transmit these commands to the third subsystem (EM) or the fourth subsystem (ES), which in turn transmits the control commands to the actuators.

[0021] There are essentially three types of control commands: the SB command for error-free operation, the SSS (System Safe State) command for transferring the vehicle to a safe state in a single error situation, and the ESS (Executor Safe State) command for emergency stop, which is generated only by the third or fourth subsystem EM,ES. During error-free normal operation, data from the second and fourth subsystems CS,ES are used to guide the vehicle. In a single error situation, the SSS command can always be initiated and executed, as illustrated in the diagram below.

[0022]

[0023]

[0024]

[0025] Based on the diagram, the functions of each subsystem and their connections become even clearer and can be summarized as follows:

[0026] First subsystem CM: Checks the second subsystem CS and the third subsystem EM, transmits instructions to the third subsystem EM and generates instructions for the control instruction SSS (when needed);

[0027] Second subsystem CS: Checks first subsystem CM and fourth subsystem ES, and generates control commands or control commands SSS (when needed) for normal operation;

[0028] The third subsystem EM: checks the first subsystem CM and the fourth subsystem ES, determines which control path to use, and executes the control command ESS (when needed);

[0029] The fourth subsystem ES checks the third subsystem EM and the second subsystem CS, transmits subordinate instructions to the third subsystem and executes the instructions by the third subsystem, executes the control instructions of the second subsystem CS during normal operation and executes the control instructions ESS independently (when there is no master controller EM).

[0030] Connection IC: CM→CS: Transmit the status of the first subsystem CM and the third subsystem EM to the second subsystem CS;

[0031] CS→CM: Transmit the status of the second subsystem CS and the fourth subsystem ES to the first subsystem, and transmit the instructions and status information for the control instructions SSS to the first subsystem;

[0032] Connecting IE: EM→ES: Transmits the status of the third subsystem, determining the implementation of control commands for the third or fourth subsystem;

[0033] ES→EM: Transmits the status of the fourth and second subsystems, the status of the control instructions SSS of the second subsystem, and the instructions of the second subsystem;

[0034] Connecting to CEM: CM→EM: Status of the first subsystem, status of control commands SSS, control commands;

[0035] EM→CM: The states of the third and fourth subsystems;

[0036] Connecting to CES: CS→ES: The status of the second subsystem, control commands; The status of SSS, control commands;

[0037] ES→CS: The states of the third and fourth subsystems;

[0038] exist Figure 2 The paper presents an alternative implementation with two additional data connections: the CEMS data connection between the first subsystem CM and the fourth subsystem ES, and the CESM data connection between the second subsystem CS and the third subsystem EM. This allows for direct exchange of status signals and control commands between these subsystems, accelerating the process.

[0039] exist Figure 3Another alternative embodiment of device 1 is presented. Here, the third and fourth subsystems are each composed of separate secondary systems EM1-EM4 or ES1-ES4. For example, the two secondary systems EM1 and ES1 are used to control the steering actuator or steering system, and the secondary systems EM2 and ES2 are used to control the brake actuator or braking system, etc. Here, the data connection IE can also be divided into data connections IE1-IE4 as shown. The advantage then is the simpler scalability of device 1.

Claims

1. An apparatus (1) for generating and transmitting control commands for an automated motor vehicle, wherein the apparatus (1) is configured to receive at least environmental data and vehicle state data, thereby calculating at least one trajectory, calculating control commands for at least one actuator required to achieve the trajectory, and transmitting them to at least one actuator, wherein the apparatus (1) comprises at least one first subsystem (CM), a second subsystem (CS), a third subsystem (EM), and a fourth subsystem (ES), wherein the first subsystem (CM) and the third subsystem (EM) operate as master controllers and the second subsystem (CS) and the fourth subsystem (ES) operate as slave controllers, wherein the first subsystem (CM) and the second subsystem (CS) are connected via at least one data connection (IC) and the third subsystem (EM) and the fourth subsystem (ES) are connected to each other via another data connection (IE), wherein additionally the first subsystem (CM) and the third subsystem (EM) are connected to each other via at least one data connection (CEM) and the second subsystem (CS) and the fourth subsystem (ES) are connected via A data connection (CES) is established between the first subsystem (CM) and the second subsystem (CS), which respectively receive at least environmental data and vehicle state data, and the third subsystem (EM) and the fourth subsystem (ES) transmit at least the control commands to the at least one actuator, wherein at least the first subsystem (CM) and the third subsystem (EM) are silently configured to handle errors, wherein the device (1) is further configured to generate and transmit at least one control command (SSS) in the event of a single error in the subsystems (CM, CS, EM, ES) to bring the vehicle to a safe state, wherein the first subsystem (CM) and the second subsystem (CS) are configured to calculate at least one trajectory, and wherein the device (1) is configured such that, in error-free operation, control commands (SB) for the actuators are calculated and output by the second subsystem (CS) or the fourth subsystem (ES), wherein the second subsystem (CS) and the fourth subsystem (ES) are designed to have higher computing power than the first subsystem (CM) and the third subsystem (EM).

2. The apparatus according to claim 1, characterized in that, The first subsystem (CM) and the second subsystem (CS) are configured such that they respectively compute control instructions for at least one actuator.

3. The apparatus according to claim 1 or 2, characterized in that, The second subsystem (CS) and / or the fourth subsystem (ES) silently construct errors.

4. The apparatus according to claim 1 or 2, characterized in that, The device (1) is configured such that, in the event of a double error, where at least the third subsystem (EM) or the fourth subsystem (ES) is not involved, the control command (ESS) for emergency stop is generated by the third subsystem (EM) or the fourth subsystem (ES).

5. The apparatus according to claim 1 or 2, characterized in that, Additionally, the first subsystem (CM) and the fourth subsystem (ES) are connected via a data connection (CEMS) and / or the second subsystem (CS) and the third subsystem (EM) are connected via a data connection (CESM).

6. The apparatus according to claim 1 or 2, characterized in that, The third subsystem (EM) and the fourth subsystem (ES) each consist of at least two separate secondary systems (EM1-EM4, ES1-ES4).

7. A method for generating and transmitting control commands for an automated motor vehicle, wherein at least environmental data and vehicle state data are received by means of at least a first subsystem (CM), a second subsystem (CS), a third subsystem (EM), and a fourth subsystem (ES), thereby calculating at least one trajectory, calculating control commands for at least one actuator required to achieve said trajectory, and transmitting them to at least one actuator, wherein the subsystems (CM, CS, ES, EM) are connected via a ring structure, the first subsystem (CM) and the third subsystem (EM) are error-silent and operate as masters, and the second subsystem (CS) and the fourth subsystem (ES) operate as slaves, wherein the first subsystem (CM) and the second subsystem (CS) respectively receive at least environmental data and vehicle state data. The data and vehicle status data, and the third subsystem (EM) and the fourth subsystem (ES) transmit at least the control commands to the at least one actuator, wherein at least one control command (SSS) is generated in the event of a single error in the subsystem (CM, CS, EM, ES) to bring the vehicle to a safe state, wherein the first subsystem (CM) and the second subsystem (CS) are configured such that they each calculate at least one trajectory, wherein in error-free operation, control commands (SB) for the actuator are calculated and output by the second subsystem (CS) or the fourth subsystem (ES), wherein the second subsystem (CS) and the fourth subsystem (ES) are designed to have higher computing power than the first subsystem (CM) and the third subsystem (EM).

Images