Method for processing pose information in an at least partially automated vehicle and / or robot

Abstract

The invention relates to a method (100) for processing vehicle and / or robot position information in an at least partially automated vehicle (50), a driving assistance system (60) of the vehicle (50) and / or a robot (70), the method comprises the following steps: determining (110) a pose (2) of the vehicle (50) and / or the robot (70) and at least a maximum expected error (2a) of the pose (2) based at least in part on measurement data (1) acquired by at least one sensor carried by the vehicle (50) and / or the robot (70); querying (120) an alarm limit service (3) for a position-dependent and optionally also orientation-dependent maximum allowable error (4) based at least in part on a position included in the determined pose (2); determining (130) whether the maximum expected error (2a) is within the maximum allowable error (4); and initiating (160) at least one remedial action in the event that the maximum expected error (2a) exceeds the maximum allowable error (4).

Description

[0001] The present invention relates to at least partially automated vehicles, driver assistance systems for vehicles and / or monitoring and / or control of robots. Background Art

[0002] A vehicle or robot moving in an at least partially automated manner needs to know its own current position and orientation accurately in order to plan its next actions. Furthermore, the correct functioning of many driver assistance systems relies on the knowledge of position and orientation. The combination of position and orientation is called "pose". Pose is calculated from measurement data collected by sensors carried by the vehicle and / or robot.

[0003] Together with the pose itself, a pose uncertainty is determined. This pose uncertainty is checked against an alarm limit. In the event that the alarm limit is exceeded, safe autonomous operation is no longer possible and the autonomous operation is therefore deactivated.

[0004] Setting alert limits requires a balance between catching all potentially unsafe situations on the one hand, and avoiding too high a false alarm rate on the other hand. This is explained in detail in (TGR Reid et al., "Localization Requirements for Autonomous Vehicles", arXiv:1906.0106v1 (2019)). Summary of the invention

[0005] The present invention provides a method for processing vehicle and / or robot pose information in an at least partially automated vehicle, a driver assistance system of a vehicle and / or a robot.

[0006] The method starts with determining a pose of the vehicle and / or robot and at least a maximum expected error of the pose based at least in part on measurement data collected by at least one sensor carried by the vehicle and / or robot. For example, the maximum expected error may include a pose uncertainty. But in addition to this, the maximum expected error may also involve other quantities.

[0007] Based at least in part on the position comprised in the determined pose, an alert limit service is queried for position-related and optionally also orientation-related maximum allowed errors. For example, these maximum allowed errors may involve the same quantities as the maximum expected errors. But the maximum allowed errors may also, for example, involve a set of quantities to which the maximum expected errors relate. For example, the maximum allowed errors may specify that the sum of the lateral pose uncertainty in three Cartesian directions in meters and the angular pose uncertainty in degrees is at most a certain amount. In the field of at least partially automated driving, the maximum allowed errors are often referred to as "alert limits" and the maximum expected errors are often referred to as "protection levels".

[0008] As will be discussed below, the result of making the maximum allowed errors position dependent is that they vary more accurately with the dependence of the actual risk of the vehicle and / or robot on the maximum expected error. In this way, in the event that the maximum expected error exceeds the maximum allowed error, this is associated with risk and remedial action needs to be taken.

[0009] Therefore, the method proceeds to determine whether the maximum expected error is within the maximum allowed error.

[0010] In the case where the maximum expected error is within the maximum permissible error, an actuation signal may be calculated based at least in part on the determined posture. The vehicle, the driver assistance system and / or the robot may then actuate using the actuation signal. However, in the case where the maximum expected error exceeds the maximum permissible error, at least one remedial action is initiated. In particular, the remedial action may include disabling the autonomous operation of the vehicle, the robot and / or the driver assistance system. The system then enters a "system unavailable" state. For example, a human driver may be prompted to take over control of the vehicle. But the remedial action may also, for example, include activating more sensors or advanced signal processing in order to improve the accuracy of its posture.

[0011] The inventors have found that the same maximum expected error has very different effects on the safety of the vehicle and / or robot, depending on the specific traffic situation. Driving scenarios are unique; they correspond to widely varying road geometries and pose-based risks. For example, in the case where a vehicle has a longitudinal uncertainty of 10m along a long, straight highway, this is largely unimportant. However, in the case where a vehicle has a longitudinal uncertainty of 10m on a two-way curve, it is very dangerous. Similarly, on a wide highway lane, a small heading error will have minimal consequences. However, the same heading error can be dangerous in the case where it causes the vehicle to incorrectly associate a green traffic light with the traffic light for its own lane.

[0012] Therefore, the risk arising from a given maximum expected error is position-dependent due to the road geometry and due to the presence of traffic lights, traffic signs and other objects. This information is more or less static, so that in a good approximation the risk given a certain uncertainty is only a function of position, not of time.

[0013] In a particularly advantageous embodiment, the alarm limit service comprises at least one map and / or database in which the maximum permissible error and / or a precursor for calculating the maximum permissible error are stored. For example, a standard map also used for navigation of a vehicle and / or robot may be given an additional layer with the maximum permissible error and / or a precursor. In this way, the maximum permissible error can be obtained much faster than by calculating the maximum permissible error on demand, because the calculation is quite complex. This calculation is time-critical, because at least partially automated vehicles and / or robots may have a maximum fault tolerance time of up to 500ms in some applications, but only a maximum fault tolerance time of about 1ms to 10ms in other applications. This is the time during which a fault can exist in the system before a safe state may become unsafe. On a vehicle, computing power is very precious, especially in cases where the hardware is required to have a high safety integrity level SIL.

[0014] In this case, "precursor" means an intermediate result in the process of calculating the maximum allowable error from a position, from which the sought maximum allowable error can be calculated faster than from that position. For example, a precursor may be useful to resolve the dependence of the maximum allowable error on a variable that is calculated quickly on the fly, but will result in very high memory usage if stored in a map and / or database. In a simple example, where the calculation of the maximum allowable error involves division by the friction coefficient of the road as the last step, and where this friction coefficient can take 100 different values, it is more efficient to save in the map and / or database a precursor that includes all calculation steps except this last division and calculate the last division on the fly. Storing the complete and readily available maximum allowable errors for all 100 possible values ​​of the friction coefficient would take up 100 times as much memory.

[0015] The maximum allowed error and / or the precursor may additionally be obtained from other sources. For example, in addition to the first map and / or database on the vehicle and / or robot, there may be a second map and / or database in the cloud, which may be more up-to-date. There are then different possible ways to combine the different sources of maximum allowed error and / or precursor.

[0016] In a particularly advantageous embodiment, at least one map and / or database is located on board the vehicle and / or the robot. The map and / or database is then always available, even if a network connection to a more up-to-date source is not available.

[0017] In an exemplary embodiment, the maximum allowable error and / or precursor stored in at least one map and / or database may represent the strictest possible maximum allowable error, which may be made more relaxed by the maximum allowable error and / or precursor from other sources. In this way, in the case where other sources other than the first map and / or database are not available, a "worst case estimate" of the maximum allowable error is used to obtain the maximum safety level. In the case where other sources are available, their more up-to-date information may indicate that the maximum allowable error can be relaxed. For example, the maximum allowable error in the map and / or database in the cloud can be continuously updated to take into account the current traffic density, road conditions, or weather conditions. For example, on a dry road in the summer, the maximum allowable error may be more relaxed than on an icy road in the winter. In addition, the risk arising from a given maximum expected error may also depend on the traffic density around the vehicle and / or robot.

[0018] In another exemplary embodiment, the maximum allowable error and / or precursor stored in at least one map and / or database may represent the loosest possible maximum allowable error, which may be made more stringent by the maximum allowable error and / or precursor from other sources. This embodiment is easier to review for regulatory approval. For example, a map and / or database on a vehicle and / or robot may be approved, and further changes may then be locked. Even if the user of the vehicle subsequently augments the map and / or database with other sources to obtain the maximum allowable error, the behavior of the vehicle will never become worse than according to the map and / or database approved the first time.

[0019] In particular, the alert limit service may include a cloud service that delivers the maximum allowable error and / or precursors based at least in part on location. Such a cloud service may, for example, include one or more additional maps and / or databases. But alternatively or in combination therewith, it may also perform the calculation of the maximum allowable error on the fly. For example, a car can operate in its basic form based on a local map and / or database that imposes very strict maximum allowable errors. Then, the instant calculation in the cloud (which takes up a lot of computing power but significantly improves the driving experience) can be rented by the hour as an additional payment.

[0020] In another advantageous embodiment, a plausibility check is performed as to whether the information obtained from the map and / or the database on the vehicle and / or the robot is still accurate, at least in part based on measurement data collected by at least one sensor carried by the vehicle and / or the robot. The information checked in this way does not have to be limited to the maximum allowed errors and / or precursors. Instead, geographical features (such as road geometry) may also be included in the plausibility check. Since the risk arising from a given maximum expected error may depend on such geometric features, in the event that the geometric features are no longer accurate, the maximum allowed errors and / or precursors in the map may also no longer be accurate.

[0021] In the event that the checked information is still found to be accurate, the information is used to determine the maximum permissible error sought. However, in the event that the information is no longer found to be accurate, the cloud service is queried for the latest maximum permissible error and / or precursor.

[0022] Preferably, querying the onboard map and / or database in this way will save the data connection fee for querying the cloud service. In addition, the cloud service itself can be a pay-per-use service, so preferably using local sources at this time will also save unnecessary usage fees.

[0023] In an alternative embodiment, the cloud service is queried first, and in the event that the cloud service is unavailable, the map and / or database on the vehicle and / or robot is queried. In this embodiment, it is assumed that the cloud service provides more up-to-date and / or more accurate information, and the local source is used only as a backup.

[0024] In another advantageous embodiment, the maximum permissible error may be modified based at least in part on

[0025] The mass and / or mass distribution of the vehicle and / or robot, and / or

[0026] ● Extends beyond the dimensions of the vehicle and / or robot's payload.

[0027] For example, a larger vehicle mass will slow down the vehicle's response to any steering or braking action. Also, in situations where the vehicle is made heavier by adding a load to the roof, excessively cluttered steering actions may cause the vehicle to tip over.

[0028] Excess load on the vehicle may reduce the safety margin between the vehicle and any areas that the vehicle should not enter, such as a lane for oncoming traffic.

[0029] The present invention also provides a positioning module for an at least partially automated vehicle, a driver assistance system for a vehicle and / or a robot. The positioning module comprises an interface configured to read in measurement data collected by at least one sensor carried by the vehicle and / or the robot. The processing means of the positioning module are configured to determine the posture of the vehicle and / or the robot and at least the maximum expected error of the posture based at least in part on the measurement data.

[0030] In addition, an integrity monitoring submodule is provided. The integrity monitoring submodule is configured to:

[0031] • determining the maximum allowable error by querying the maximum allowable error and / or a precursor for the calculation of the maximum allowable error from a local map and / or database and / or from a cloud service;

[0032] ● Compare the maximum expected error to the maximum allowable error; and

[0033] • In response to determining that the maximum expected error exceeds the maximum allowable error, deactivating autonomous operation of the vehicle, robot and / or driver assistance system.

[0034] The positioning module may replace a previously used positioning module. This has the advantage that the situation in which autonomous operation is released corresponds more accurately to the situation in which the maximum expected error is indeed too high, taking into account the specific traffic situation and the acceptable risk level. An existing positioning module may be upgraded to become a positioning module according to the invention by inserting the integrity monitoring submodule or replacing the old integrity monitoring submodule with a new integrity monitoring submodule that can query a local map and / or database and / or a cloud service.

[0035] The invention further relates to a method for determining a maximum permissible error of at least a pose of a vehicle and / or a robot which is to be moved in an at least partially automated manner and / or is to be assisted by a driver assistance system.

[0036] The method starts with providing a map of the area in which the vehicle and / or robot is to operate, wherein the map comprises at least the geometry of roads and / or paths on which the vehicle and / or robot is to travel. For each possible position of a set of possible positions reachable by the vehicle and / or robot, a correlation between, on the one hand, the risk of the vehicle and / or robot being involved in at least one undesirable event and, on the other hand, a maximum expected error of at least a pose of the vehicle and / or robot, assuming that the vehicle and / or robot is at that position, is determined, at least in part based on features from the map.

[0037] Based at least in part on the correlation and a predetermined maximum tolerable risk level of an undesirable event, a sought maximum allowable error and / or a precursor for calculation of the maximum allowable error is determined.

[0038] That is, the characteristics of the map reveal how the risk increases with the increase of the maximum expected error. With the help of this dependence, a given predetermined maximum allowed risk level is converted into a maximum permissible error.

[0039] In a particularly advantageous embodiment, the correlation is based at least in part on the distance of at least a part of the vehicle and / or the robot to an area where the presence of the part of the vehicle and / or the robot may lead to at least one undesired event. For example, the road geometry determines how likely it is that the uncertainty of which type may cause a risk of collision with other traffic due to the vehicle leaving its lane. For example, on a long straight road, longitudinal pose uncertainty may be less likely to cause the vehicle to leave its lane than in a curve.

[0040] One possible factor for relevance is the distance available to stop the vehicle, for example at a red traffic light or at a stop sign. The further the vehicle is from the point where it must stop, the more likely it is to correct for any errors due to pose uncertainty, and therefore the more pose uncertainty is allowed. But in cases where the vehicle is very close to the point where it must stop, even a small uncertainty can cause it to exceed that point.

[0041] Along with this come vehicle deceleration limits. These vehicle deceleration limits determine when a vehicle must actually start to slow down before the point where it cannot pass.

[0042] Thus, one undesirable event to be avoided could be a vehicle and / or robot entering an area where other traffic participants have priority, such as an intersection where other traffic has the right of way or even a green traffic light. Unauthorized entry into such an area carries a high risk of collision where other traffic relies on its right of way. However, running a stop light or red traffic light can be penalized even if there is no collision.

[0043] A collision of the vehicle and / or robot with at least one other traffic participant or other object is an undesirable event that should be avoided regardless of how it was caused, i.e. even if the root cause is some error by another driver.

[0044] Another undesirable event is the incorrect association of traffic signs and / or traffic lights that are valid for another traffic lane with the traffic lane in which the vehicle and / or robot is traveling. Although largely ignored in the research literature, localization pose estimation is critical for establishing the association between sensed features and map features. This is particularly important in the case where the sensed features have real-time signals (such as traffic lights). Therefore, it is safety-critical that the localization pose estimate is within its error / uncertainty bounds. For example, a slight heading error may cause an adjacent green traffic light to be associated with the traffic light of the vehicle's current lane. This can be extremely dangerous in the case where the vehicle's lane actually has a red traffic light; the vehicle will continue to enter the intersection when it should have stopped. Therefore, when the vehicle approaches an intersection, the risk of incorrectly associating traffic lights should limit the maximum allowed error of the vehicle.

[0045] Likewise, the incorrect association of a traffic participant traveling in another traffic lane with the traffic lane in which the vehicle and / or robot is traveling is another undesirable event. For example, if an oncoming vehicle is incorrectly detected as being headed in front of the own vehicle and / or robot, this may incorrectly lead to emergency braking or evasive maneuvers.

[0046] Likewise, incorrectly associating a traffic participant with the wrong traffic lane is another undesirable event. Correct pose estimation is crucial for associating surrounding traffic participants with traffic lanes within the map. The reference lines of the traffic participant's lane provide a strong prior for predicting the participant's future. Therefore, incorrect association may undermine the prediction and subsequent collision avoidance. For example, it may hinder evasive maneuvers or trigger unnecessary emergency braking.

[0047] These methods may be implemented in whole or in part by a computer. Therefore, the present invention also relates to a computer program having machine-readable instructions, which, when executed by one or more computers and / or computing instances, cause one or more computers and / or computing instances to perform one of the above methods. Examples of computing instances include virtual machines, containers, or serverless execution environments in the cloud. The present invention also relates to a machine-readable data carrier and / or a download product having a computer program. A download product is a digital product having a computer program that can be sold, for example, in an online store to be immediately completed and downloaded to one or more computers. The present invention also relates to one or more computing instances having a computer program and / or having a machine-readable data carrier and / or a download product. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In the following, the present invention is described using the accompanying drawings, but it is not intended to limit the scope of the present invention. The accompanying drawings show:

[0049] Figure 1: An exemplary embodiment of a method 100 for processing vehicle and / or robot pose information in an at least partially automated vehicle 50, a driver assistance system 60 of a vehicle 50, and / or a robot 70;

[0050] Figure 2: An exemplary illustration of how the maximum permissible error changes under different circumstances;

[0051] Figure 3 : An exemplary implementation of a positioning module;

[0052] Figure 4 : An exemplary implementation of a method 200 for determining a maximum allowable error.

[0053] Figure 1 is a schematic flow chart of an exemplary embodiment of a method 100 for processing vehicle and / or robot pose information in an at least partially automated vehicle 50 , a driver assistance system 60 of a vehicle 50 , and / or a robot 70 .

[0054] In step 110 , a pose 2 of the vehicle 50 and / or the robot 70 and at least a maximum expected error 2 a of the pose 2 are determined at least partially based on measurement data 1 acquired by at least one sensor carried by the vehicle 50 and / or the robot 70 .

[0055] In step 120, at least partly based on the position included in the determined pose 2, an alert limit service 3 is queried for a position-related and optionally also orientation-related maximum permissible error 4. In particular, the alert limit service 3 may include at least one map 30 and / or a database in which the maximum permissible error 4 and / or precursors for calculating the maximum permissible error 4 are stored. It may also include at least one cloud service 31.

[0056] According to box 121, based at least in part on the measurement data 1 acquired by at least one sensor carried by the vehicle 50 and / or the robot 70, a plausibility check may be performed as to whether the information obtained from the map 30 and / or the database on board the vehicle 50 and / or the robot 70 is still accurate. In the event that the information is found to be still accurate, according to box 122, the information may be used to determine the sought maximum permissible error 4. Conversely, in the event that the information is found to be no longer accurate, according to box 123, the cloud service 31 may be queried for the latest maximum permissible error 4 and / or a precursor for the calculation of the maximum permissible error.

[0057] According to box 124, the cloud service 31 may be queried first. In the event that the cloud service 31 is not available, according to box 125, the map 30 and / or database on the vehicle 50 and / or robot 70 may be queried.

[0058] Regardless of how exactly the sought maximum permissible errors 4 are obtained, they may be modified according to block 126 based at least in part on:

[0059] The mass and / or mass distribution of the vehicle 50 and / or robot 70, and / or

[0060] • Extends beyond the dimensions of the vehicle 50 and / or robot 70's payload.

[0061] A modified version of the maximum permissible error is marked with reference numeral 4*.

[0062] In step 130, it is determined whether the maximum expected error 2a is within the maximum allowed error 4. In this case (true value 1), in step 140, an actuation signal 5 is calculated based at least in part on the determined pose 2. Then, in step 150, the vehicle 50, the driver assistance system 60 and / or the robot 70 actuates using the actuation signal 5. However, in the event that the maximum expected error 2a is not within the maximum allowed error 4 (true value 0 at diamond 130), in step 160, a remedial action is taken. For example, the remedial action may include disabling autonomous operation and entering a "system unavailable" mode.

[0063] FIG. 2 illustrates, using three examples, how the determined maximum permissible errors 4 , 4 ′, 4 ″ vary in different traffic situations.

[0064] Figure 2a A first example is shown. In this example, a vehicle 50 is travelling on a road 52. The road 52 is a two-way road; there is another oncoming vehicle 51 in the oncoming lane outside the central divider of the road 52. This first example illustrates the dependence of the maximum allowed error 4 on the road geometry.

[0065] When the vehicle 50 is in the position 2 on a long straight section of the road 52, the longitudinal uncertainty in the direction of travel is largely insignificant. Therefore, the maximum permissible error 4 of the longitudinal component of the position 2 is quite high. The maximum permissible error 4 of the lateral component of the position 2 perpendicular to the direction of travel is much lower, because it is important that the vehicle 50 stays in the lane.

[0066] When the vehicle 50 is in a position 2' in a curve of the road 52, the maximum permissible error 4 of the lateral component of the position 2' does not change. The maximum permissible error 4' of the longitudinal component of the position 2' needs to be much lower, because such uncertainty may cause the vehicle 50 to go over the center divider of the road 52.

[0067] When the vehicle 50 is in the posture 2″ on a shorter straight section of the road 52 before the curve, the maximum permissible error 4″ of the longitudinal component of the posture 2″ is higher than the corresponding maximum permissible error 4′ in the posture 2′ in the curve. However, it is much lower than the maximum permissible error 4 in the posture 2 on a much longer straight section of the road 52.

[0068] Figure 2b A second example is shown. In this example, a road 52 leads to an intersection 53 which is protected by a stop sign 54. This second example illustrates the dependence of the maximum allowed error 4 on the distance available for stopping.

[0069] When the vehicle 50 is in the position 2 just before the intersection, the maximum permissible error 4 of the longitudinal component of the position 2 is low, since such an uncertainty could lead to the vehicle crossing the stop line of the stop sign 54. In the positions 2' and 2", the maximum permissible errors 4', 4" of the longitudinal component of the positions 2', 2" increase with the distance still available for stopping before the intersection 53. The maximum permissible errors 4, 4', 4" of the transverse components of the positions 2, 2', 2" perpendicular to the direction of travel are always the same in order to ensure that the vehicle 50 remains in the lane.

[0070] Figure 2c A third example is shown. In this example, a road 52 with two lanes 52a and 52b again leads to an intersection 53, but now the intersection 53 is protected by traffic lights 54a and 54b associated with lanes 52a and 52b, respectively. This third example illustrates how the maximum permissible error in orientation may change when approaching the intersection 53.

[0071] When the vehicle 50 is in the posture 2, it is critical that it cannot misinterpret the green traffic light 54b valid for another vehicle 51 as valid for the vehicle 50, thereby causing the vehicle 50 to run a red light 54a. Therefore, the maximum permissible error 4 of the orientation is very low. When the vehicle 50 is in the posture 2', the further away from the intersection 53, the maximum permissible error 4' of the orientation can be significantly relaxed.

[0072] Figure 3 is a schematic diagram of an embodiment of the localization module 40. The localization module 40 receives the measurement data 1 and outputs the pose 2 of the vehicle 50 and / or the robot 70, including at least the maximum expected error 2a of the pose 2.

[0073] The interface 41 of the positioning module 40 is configured to read in measurement data 1 acquired by at least one sensor carried by the vehicle 50 and / or the robot 70. The processing device 42 of the positioning module 40 is configured to determine a position 2 of the vehicle 50 and / or the robot 70 and at least a maximum expected error 2a of the position 2 based at least partially on the measurement data.

[0074] The integrity monitoring submodule 43 of the positioning module 40 is configured to determine the maximum permissible error 4 by querying the maximum permissible error 4 and / or a precursor for the calculation of the maximum permissible error from the local map 30 and / or the database and / or from the cloud service 31. The determined maximum expected error 2a is compared with the maximum permissible error 4. In the event that the maximum permissible error 4 is exceeded, the autonomous operation of the vehicle 50, the robot 70 and / or the driver assistance system 60 is released. This means that, in this case, the pose 2 and the maximum expected error 2a will no longer be provided to the downstream systems of the vehicle 50, the robot 70 and / or the driver assistance system 60 for use.

[0075] Figure 4 is a schematic flow chart of an implementation of a method 200 for determining a maximum permissible error 4 of at least a pose 2 of a vehicle 50 and / or a robot 70 that is to be moved in an at least partially automated manner and / or is to be assisted by a driver assistance system 60 .

[0076] In step 210, a map 30 of the area in which the vehicle 50 and / or robot 70 will operate is provided. The map 30 includes at least the geometry of the roads and / or paths on which the vehicle 50 and / or robot 70 will travel.

[0077] For each possible position in a set of possible positions reachable by the vehicle 50 and / or the robot 70, in step 220, a correlation 6 is determined between, on the one hand, the risk that the vehicle 50 and / or the robot 70 is involved in at least one undesired event and, on the other hand, a maximum expected error 2a of at least the position 2 of the vehicle 50 and / or the robot 70.

[0078] According to block 221 , the correlation 6 may be based at least in part on a distance of at least a portion of the vehicle 50 and / or robot 70 to an area where the presence of the portion of the vehicle 50 and / or robot 70 may result in at least one undesirable event.

[0079] According to block 222, the undesirable event may include one or more of the following:

[0080] The vehicle 50 and / or robot 70 enters an area where other traffic participants have priority;

[0081] The vehicle 50 and / or the robot 70 collides with at least one other traffic participant or other object;

[0082] • erroneously associating a traffic sign and / or traffic light valid for another lane of traffic with the lane of traffic in which the vehicle 50 and / or robot 70 is traveling; and

[0083] • Incorrectly associating a traffic participant traveling in another traffic lane with the traffic lane in which the vehicle 50 and / or the robot 70 is traveling.

[0084] In step 230 , the sought maximum permissible error 4 and / or a precursor to the calculation of the maximum permissible error is determined, at least in part based on this correlation 6 and a predetermined maximum permissible risk level 7 of an undesirable event.

[0085] Reference numerals list

[0086] 1 Measurement data

[0087] 2, 2', 2" Position of vehicle 50 and / or robot 70

[0088] 2a Maximum expected error

[0089] 3 Alarm Limit Service

[0090] 30 Alarm Extreme Service 3 Map

[0091] 31 Alarm Extreme Service 3 Cloud Service

[0092] 4, 4', 4" maximum allowable error

[0093] 4* Modified version

[0094] 5 Actuation signal

[0095] 6 Correlation between risk and maximum expected error 2a

[0096] 7 Maximum Tolerable Risk Level

[0097] 40 Positioning module

[0098] 41 Interface of positioning module 40

[0099] 42 Processing device of positioning module 40

[0100] 43 Integrity monitoring submodule of positioning module 40

[0101] 50 Vehicles

[0102] 51 Other vehicles

[0103] 52 Road

[0104] 52a, 52b Lanes of road 52

[0105] 53 Crossroads

[0106] 54 Stop Sign

[0107] Traffic lights 54a, 54b

[0108] 60 Driver Assistance Systems

[0109] 70 Robot

[0110] 100 Method for controlling vehicle 50, system 60, robot 70

[0111] 110 Determine pose 2 and maximum expected error 2a

[0112] 120 Query alarm limit service 3

[0113] 121 Perform plausibility check

[0114] 122 Use reliable information to determine the maximum allowable error4

[0115] 123 Query Cloud Service 31

[0116] 124 First query cloud service 31

[0117] 125 When cloud service 31 is unavailable, query map 30

[0118] 126 Modify alarm limit 4

[0119] 130 Determine whether the expected error 2a is within the allowable error 4

[0120] 140 Calculate actuation signal 5

[0121] 150 Controlling the system 50, 60, 70 using the actuation signal 5

[0122] 160 Initiate remedial action

[0123] 200 Method for determining the maximum permissible error4

[0124] 210 Provide map30

[0125] 220 Determine relevance6

[0126] 221 Specific ways to determine relevance 6

[0127] 222 Specific Unexpected Events

[0128] 230 Determine the maximum allowable error 4

Claims

1. A method (100) for processing vehicle and / or robot pose information in an at least partially automated vehicle (50), a driver assistance system (60) of the vehicle (50), and / or a robot (70), the method comprising the following steps: Determining (110) a position (2) of the vehicle (50) and / or the robot (70) and at least a maximum expected error (2a) of the position (2) based at least in part on measurement data (1) collected by at least one sensor carried by the vehicle (50) and / or the robot (70); • querying (120) an alert limit service (3) for a position-related and optionally also orientation-related maximum allowed error (4) based at least in part on the position comprised in the determined pose (2); ● determining (130) whether the maximum expected error (2a) is within the maximum allowed error (4); as well as In case the maximum expected error (2a) exceeds the maximum allowed error (4), initiating (160) at least one remedial action.

2. The method according to claim 1, further comprising the steps of: When the maximum expected error (2a) is within the maximum allowed error (4), an actuation signal (5) is calculated (140) at least partly based on the determined posture (2), and the vehicle (50), the driver assistance system (60) and / or the robot (70) are actuated (150) using the actuation signal (5).

3. A method (100) according to claim 1 or 2, wherein the alarm limit service (3) comprises at least one map (30) and / or a database, in which the maximum allowable error (4) and / or a precursor for calculating the maximum allowable error (4) are stored.

4. The method (100) according to claim 3, wherein at least one map (30) and / or database is located on board the vehicle (50) and / or the robot (70).

5. The method (100) according to any one of claims 3 or 4, wherein the maximum permissible error (4) and / or the precursor representation stored in the at least one map (30) and / or database is the strictest possible maximum permissible error (4), which can be made more relaxed by maximum permissible errors (4) and / or precursors from other sources, or - The loosest possible maximum allowed error (4), which can be made tighter by maximum allowed errors (4) and / or precursors from other sources.

6. The method (100) according to any one of claims 1 to 5, wherein the alarm limit service (3) comprises a cloud service (31) which delivers a maximum allowable error (4) and / or a precursor based at least in part on the position.

7. The method (100) according to claims 4 and 6 and optionally also according to claim 5, further comprising: ● performing (121) a plausibility check as to whether the information obtained from the map (30) and / or the database on the vehicle (50) and / or the robot (70) is still accurate, based at least in part on measurement data (1) collected by at least one sensor carried by the vehicle (50) and / or the robot (70); as well as • in the event that the information is found to still be accurate, using the information (122) to determine the maximum permissible error sought (4); as well as • In the event that the information is found to be no longer accurate, query (123) the cloud service (31) for the latest maximum permissible error (4) and / or precursors.

8. A method (100) according to claims 4 and 6 and optionally also according to claim 5, wherein the cloud service (31) is first queried (124) and, if the cloud service (31) is not available, the map (30) and / or the database on the vehicle (50) and / or the robot (70) is queried (125).

9. The method (100) according to any one of claims 1 to 8, further comprising: The maximum allowable error (4) is modified (126) based at least in part on: the mass and / or mass distribution of the vehicle (50) and / or the robot (70), and / or • A dimension that extends beyond the payload of the vehicle (50) and / or the robot (70).

10. A positioning module (40) for an at least partially automated vehicle (50), a driver assistance system (60) of the vehicle and / or a robot (70), the positioning module comprising: an interface (41) configured to read in measurement data (1) acquired by at least one sensor carried by the vehicle (50) and / or the robot (70), a processing device (42) configured to determine a pose (2) of the vehicle (50) and / or the robot (70) and at least a maximum expected error (2a) of the pose (2) based at least in part on the measurement data, and An integrity monitoring submodule (43), the integrity monitoring submodule being configured to: o determining the maximum allowed error (4) by querying the maximum allowed error (4) and / or a precursor for the calculation of the maximum allowed error from a local map (30) and / or a database and / or from a cloud service (31); ○ Compare the determined maximum expected error (2a) with the maximum allowable error (4) Make comparisons; as well as o In response to determining that the maximum expected error (2a) exceeds the maximum allowable error (4), causing the vehicle (50), the robot (70) and / or the driver The autonomous operation of the driving assistance system (60) is released.

11. A method (200) for determining a maximum permissible error (4) of at least a position (2) of a vehicle (50) and / or a robot (70), the vehicle and / or the robot being moved in an at least partially automated manner and / or being assisted by a driver assistance system (60), the method (200) comprising the following steps: providing (210) a map (30) of an area in which the vehicle (50) and / or the robot (70) is to operate, wherein the map (30) comprises at least the geometry of roads and / or paths on which the vehicle (50) and / or the robot (70) is to travel; and for each possible position in a set of possible positions that the vehicle (50) and / or the robot (70) is capable of reaching: Determining (220) a correlation (6) between, on the one hand, a risk of the vehicle (50) and / or the robot (70) being involved in at least one undesired event and, on the other hand, a maximum expected error (2a) of at least the position (2) of the vehicle (50) and / or the robot (70); and - Determining (230) the sought maximum permissible error (4) and / or a precursor for the calculation of said maximum permissible error based at least in part on said correlation (6) and a predetermined maximum tolerable risk level (7) of said undesirable event.

12. A method (200) according to claim 11, wherein the correlation (6) is at least partially based on (221) the distance of at least a portion of the vehicle (50) and / or the robot (70) to an area where the presence of the portion of the vehicle (50) and / or the robot (70) can cause the at least one undesirable event.

13. The method (200) according to any one of claims 11 to 12, wherein the undesirable event comprises (222) one or more of the following: The vehicle (50) and / or the robot (70) enters an area in which other traffic participants have priority; The vehicle (50) and / or the robot (70) collides with at least one other traffic participant or other object; ● incorrectly associating a traffic sign and / or traffic light valid for another traffic lane with the traffic lane in which the vehicle (50) and / or the robot (70) is traveling; and • Falsely associating a traffic participant traveling in another traffic lane with the traffic lane in which the vehicle (50) and / or the robot (70) is traveling.

14. A computer program comprising machine-readable instructions which, when executed by one or more computers and / or computing instances, upgrade the one or more computers and / or computing instances to the integrity monitoring submodule (43) in the positioning module (40) according to claim 9, and / or cause the one or more computers and / or computing instances to perform the method (100, 200) according to any one of claims 1 to 9 or 11 to 13.

15. A machine-readable data carrier and / or a download product having a computer program according to claim 14.

16. One or more computers and / or computing instances having a computer program according to claim 14 and / or having a machine-readable data carrier and / or a download product according to claim 15.

Images