Classified system architecture for controlling automated vehicle

Abstract

The invention relates to a hierarchical system architecture for controlling an automated vehicle, comprising an implementation layer, a protective layer, a hardware layer, the protective layer being arranged between the implementation layer and the hardware layer, the implementation layer being designed to generate a first control signal and to transmit the first control signal to the protective layer, the protective layer is further designed to detect whether a safety-critical driving situation is present for the vehicle and whether a first system response should be carried out in order to bring the vehicle into a safe state in that a corresponding second control signal rather than the first control signal is transmitted to the hardware layer, and the protective layer further has at least one detector module, the device is designed to detect, on the basis of an evaluation by means of at least one evaluation criterion, whether a special situation is present in a safety-critical driving situation of the vehicle, said special situation making it necessary for a second system reaction, rather than a first system reaction, associated therewith, in order to achieve a safe state of the vehicle. A corresponding third control signal instead of the second control signal is transmitted to the hardware layer.

Description

Technical Field

[0001] The invention relates to a hierarchical system architecture for controlling an automated vehicle. Background Art

[0002] Automated vehicles require a system architecture that enables safe degradation of the behavior in the event of an error or a performance path that no longer finds a valid solution. Different approaches already exist for errors in the sense of ISO 26262 functional safety, however, most existing system architectures do not consider errors in the sense of ISO 21448 intended functional safety. Summary of the invention

[0003] It is therefore an object of the present invention to provide a solution for improving the system architecture for automated vehicles.

[0004] This object is achieved by a hierarchical system architecture according to the invention for controlling an automated vehicle.

[0005] According to a first aspect, the present disclosure relates to a hierarchical system architecture for controlling an automated vehicle, having:

[0006] - Implementation layer,

[0007] - Protective layer,

[0008] - a hardware layer, wherein the protection layer is arranged between the implementation layer and the hardware layer,

[0009] wherein the implementation layer is designed to generate a first control signal and to transmit it to the protection layer,

[0010] wherein the protection layer is further designed to detect whether a safety-critical driving situation exists for the vehicle and whether a first system reaction should be implemented in order to bring the vehicle into a safe state by transmitting a corresponding second control signal instead of the first control signal to the hardware layer, and

[0011] -Wherein, the protection layer further comprises at least one detector module, which is designed to identify, based on an evaluation with the aid of at least one evaluation criterion, whether a special situation exists in a safety-critical driving situation of the vehicle: the special situation makes a second system reaction associated therewith necessary instead of a first system reaction in order to achieve a safe state of the vehicle, by transmitting a corresponding third control signal instead of the second control signal to the hardware layer.

[0012] A basic idea of ​​the present invention is to provide a hierarchical system architecture for automated vehicles which, on the one hand, ensures a high degree of robustness and safety within the meaning of ISO 26262 and ISO 21448, but on the other hand also enables a strongly emphasized, protected main path for high-performance driving. This is achieved by a hierarchical system architecture with a certain number of layers which, on the one hand, provides a conventional top-down safety (i.e., a cascade of fallback behaviors) for the main signal processing path and, on the other hand, implements a so-called bottom-up safety mechanism which provides and ensures special solutions for special situations or special driving scenarios or driving situations of the vehicle, which is essential for the invention.

[0013] On the one hand, the top-down safety path provides a backup behavior in the case where the lower layer of the hierarchical system architecture cannot implement an action preferred by the layer above it (such as, for example, behavior, driving channel (Fahrschlauch), trajectory, control signal, etc.). On the other hand, unsafe behaviors are rejected at the individual layers, so that only safe behaviors are implemented. Here, the hierarchical system architecture is designed in such a way that unsafe behaviors cannot persist, for example by optimizing to a scenario without false negatives. Therefore, during the processing, it may happen that it is determined at one layer that no action candidate can be implemented, in which case only fail-safe behaviors such as emergency braking can still be executed, when avoidance would be a better solution, which is not always the best reaction (for example, in the case of an imminent collision with a pedestrian). The present invention is addressed here.

[0014] In the case of a bottom-up safety mechanism, so-called detection modules, detector modules or detector and reaction modules are arranged in parallel with the main signal path in all layers in the layer architecture.

[0015] In this case, the detector has the task of detecting special driving situations or special cases of driving situations for the vehicle, for which specific system reactions are set, which can no longer be processed safely from top to bottom in the main signal path at the corresponding level of the system architecture.

[0016] Therefore, within the meaning of the invention, the detector is protected separately from the main signal path and is triggered only when special situations occur that are highly restricted for the vehicle. That is, the detector is typically designed to avoid false positives and not to avoid false negatives as is common in top-down signal paths or in other situations.

[0017] Each detector is assigned exactly one reaction module, which is activated by the detector in the case of a detected special situation of the driving situation of the vehicle or in a detected special case thereof. A reaction module is always assigned to exactly one level of the hierarchical system architecture, but can be activated by multiple detectors in different levels.

[0018] That is, the corresponding system reactions are each likewise embedded in the layer architecture as reaction modules, so that likewise the system reactions are protected separately and independently of the main signal path.

[0019] The hierarchical system architecture of the present invention achieves the following advantages:

[0020] The existing hierarchical layer architecture for efficient and safely activated control of vehicles is efficiently expanded and improved, since complex functionalities with high safety loads can be combined or integrated in a simple manner for restricted special situations or driving situations of the vehicle via bottom-up safety mechanisms.

[0021] The hierarchical system architecture of the present invention is designed in such a way that the safety guarantee increases gradually in the top-down signal flow, while in the bottom-up signal flow, on the other hand, it is no longer necessary to ensure complete coverage of the complete ODD (Operational Design Domain). This simplifies the realization and implementation of the hierarchical system architecture.

[0022] Here, the hierarchical system architecture of the present invention enables a clear separation of the main signal processing path and the processing of special situations of the vehicle or special driving situations. In this way, tasks with different complexity can be processed efficiently.

[0023] Furthermore, the hierarchical system architecture according to the invention also provides advantages for developing and implementing, for example, vehicle-related controllable systems which also implement partially autonomously controlled functions which are located on the software architecture:

[0024] - Compact detectors can be developed and tested in a short time, and their functionality can be scaled up step by step.

[0025] In the event of special situations or unusual driving scenarios occurring on site, safety mechanisms in the form of one or more detector-reaction module pairs that are application-specific can also be supplemented quickly, for example by a corresponding system update.

[0026] Furthermore, the basic structure of the hierarchical layer architecture for the system can be expanded quickly and easily by adding different detectors specifically to different ODDs, such as, for example, highways, cities, warehouses, etc. Furthermore, due to the strong restrictions on activation by the detectors, negative side effects can be clearly excluded in terms of authorization technology.

[0027] - In addition, the detector module and reaction module pair can be taken over as a function in the main signal path or in a subsequent version of the main signal path, or be used to train ML components used in the main signal path, so that the detected special situation is actively avoided in the subsequent system and the detected special situation occurs less frequently or no longer occurs at all.

[0028] The invention with the bottom-up triggered safety mechanism is not dependent on a specific layer architecture or hierarchical system architecture for the vehicle or other technical systems to be controlled. Thus, for example, the known NASREM system architecture can be used as a corresponding architecture.

[0029] One possible embodiment of the hierarchical system architecture provides that the first system reaction is triggered based on the result of the validity check of the received first control signal. This achieves the advantage that the reaction of the system architecture is carried out efficiently and application-oriented.

[0030] One possible embodiment of the hierarchical system architecture is that at least one evaluation criterion specifies whether a first system reaction is sufficient to bring the vehicle to a safe state. This achieves the advantage that an adapted safety level can be achieved for a detected driving situation of the vehicle.

[0031] One possible embodiment of the hierarchical system architecture provides that the detector module is designed to access at least one implementation level in order to acquire information and use this information in evaluating a safety-critical driving situation of the vehicle. This achieves the advantage that the driving situation of the vehicle can be precisely specified in order to be able to efficiently decide which reaction of the system is appropriate.

[0032] One possible embodiment of the hierarchical system architecture provides that the second system reaction is performed by a reaction module which is connected to the detector module in terms of signaling. This achieves the advantage that an efficient allocation of detector modules and reaction modules is achieved.

[0033] One possible embodiment of a hierarchical system architecture provides that the reaction modules corresponding to the detector modules are arranged on a different layer of the system architecture than the detector modules themselves. This achieves the advantage that the detector modules reflect and redirect the signal flow back to a higher layer and enable efficient separation or subdivision into specific special cases for the driving situation of the vehicle, for which there are specific, protected system reactions with a complexity appropriate for this reaction.

[0034] One possible embodiment of the hierarchical system architecture provides that the reaction module is located at a layer of the system architecture which is arranged above the layer on which the detector module is located. This achieves the advantage that the detector module reflects and redirects the signal flow back to a higher layer and enables efficient separation or subdivision into specific special cases for the driving situation of the vehicle, for which there is a specific, protected system reaction with a complexity appropriate for this reaction.

[0035] According to a second aspect, the present disclosure relates to a computer program comprising machine-readable instructions which, when executed on one or more computers and / or computer instances, cause the one or more computers or computer instances to implement or regulate a system architecture according to the present invention.

[0036] According to a third aspect, the disclosure relates to a machine-readable data carrier and / or a download product having a computer program.

[0037] According to a fourth aspect, the disclosure relates to one or more computers and / or computing instances with a computer program and / or with a machine-readable data carrier and / or a download product. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Further measures that improve the invention are presented in more detail below together with the description of preferred exemplary embodiments of the invention based on the drawings.

[0039] The accompanying drawings show:

[0040] Figure 1 A schematic diagram of a hierarchical system according to one embodiment of the present invention is shown. DETAILED DESCRIPTION

[0041] Figure 1 A schematic diagram of a hierarchical system 100 according to one embodiment of the present invention is shown.

[0042] The hierarchical system architecture 100 for controlling an (automated) vehicle 80 has an implementation layer 30 (=performance layer), a protection layer 50 and a hardware layer 40. The present invention is not limited to a specific layer model or layer architecture. In this case, the vehicle or (generally) the technical system 80 can have automated functionality, but does not necessarily have to do so.

[0043] The protection layer 50 is arranged between the implementation layer 30 and the hardware layer 40 .

[0044] Implementation layer 30 is designed to generate a first control signal 60 and to transmit it to protective layer 50. Implementation layer 30 may, for its part, include a plurality of layers or sublayers.

[0045] Furthermore, the protection layer 50 is designed to detect whether a safety-critical driving situation 52 exists for the vehicle 80 and whether a first system reaction 54 is to be implemented in order to bring the vehicle 80 to a safe state. For this purpose, a corresponding second control signal 62 is transmitted to the hardware layer 40 instead of the first control signal 60.

[0046] In addition, according to Figure 1 The protective layer 50 has a detector module 70 which is designed to detect, based on an evaluation using at least one evaluation criterion 72, whether a special situation 53 exists in a safety-critical driving situation 52 of the vehicle 80 which necessitates a second system reaction 56 associated therewith instead of a first system reaction 54 in order to achieve a safe state of the vehicle 8. For this purpose, a corresponding third control signal 64 is then transmitted to the hardware layer 40 instead of the second control signal 62.

[0047] Optionally, the triggering of the first system reaction 54 may be performed based on the result of the validity check of the received first control signal 60. In other words, it is checked whether the first control signal 60 is valid.

[0048] Optionally, it may be provided that at least one evaluation criterion 72 specifies or draws a conclusion as to whether the provided first system reaction 54 is sufficient to bring the vehicle 80 into a safe state or to bring the vehicle into a safe state corresponding to the detected driving situation.

[0049] Optionally, detector module 70 may be designed to access at least one implementation layer 30 in order to obtain corresponding information 75 that is used in evaluating safety-critical driving situation 52 of vehicle 80 . This may be access to a surroundings model stored in implementation layer 30 , for example.

[0050] Optionally, the second system reaction 56 can be performed by a reaction module 74, which is connected to the detector module 70 by means of signal technology. In addition, the present invention can include a large number of detector modules 70 and reaction modules 74.

[0051] Optionally, the reaction modules 74 corresponding to the detector modules 70 are arranged on a different layer of the system architecture 100 than the detector modules 70 themselves.

[0052] Optionally, the reaction module 74 is located on a layer of the system architecture (100) that is arranged above the layer on which the detector module 70 is located. Figure 1 In the embodiment, the reaction module 74 corresponding to the detector module is located on the implementation layer 30, which is arranged above the protective layer 50, and the detector module 70 is located on the protective layer.

[0053] The solution approach according to the invention therefore differs from the normal top-down security structure in known system layer architectures, in which problems are always eliminated in the same layer.

[0054] Schematically, the detector module 70 reflects the signal flow back to a higher layer and implements separate safety-related processing of very specific special cases of the vehicle situation, for which there is a specific, protected system reaction with a complexity appropriate for the reaction. Here, the reaction module 74 is always assigned to exactly one layer of the architecture, but it can be activated by multiple detector modules in different layers of the system architecture 100.

[0055] In addition, the following aspects are important with regard to the safety load in the hierarchical system architecture according to the invention:

[0056] The safety load increases in the main signal processing path along the layers from top (implementation layer 30) to bottom (hardware layer 40). This also applies to the detector module 70. In contrast, the reaction modules 74 have individual safety loads, which are respectively dependent on which system reactions they execute.

[0057] On the other hand, the complexity of the functionality decreases increasingly from the top (implementation layer 30) to the bottom (hardware layer 40), so that the protection of the system technology is increasingly simplified by the reduced complexity. It is thus possible to protect layers with very high safety loads accordingly.

[0058] Detector module 70 checks, based on clearly defined evaluation criteria 72 , which can be derived in safety demonstrations and can be verified and proven reliable in corresponding test cases, whether first system reaction 54 is sufficient to bring vehicle 80 into a safe state appropriate to the driving situation.

[0059] The protection of the detector or detector module 70 is therefore comparable to the protection of driver assistance functions in which safety-critical erroneous triggering (false alarms) cannot provably occur. Verification and plausibility verification methods for this are known, so that a correspondingly high level of safety can be achieved for the detector module 70.

[0060] If the detector module 70 is not located on the lowest layer, the second system reaction 56 triggered thereby can either cover the layer located therebelow or the result of the second system reaction 56 can be fed into the layer located therebelow.

[0061] The first variant allows for greater flexibility, but on the other hand also increases the requirements for protection.

[0062] The second variant benefits from the protection of the non-bridging underlying layer, thereby simplifying the safety argument for the second system reaction 56. In this case, however, the second system reaction 56 must be drawn up and tested taking the underlying layer into account.

[0063] Below, we explain in more detail the Figure 1 The hierarchical system architecture 100 of the embodiment of the present invention is provided to deepen the understanding of the bottom-up security mechanism implemented therein. Figure 1 A possible signal flow plan or signal connection path between the individual components of the hierarchical system architecture 100 is illustrated intuitively.

[0064] The present invention is independent of a specific layer architecture and differs in terms of detectors and traditional authentication checks as they are common in a top-down security path from top (implementation layer 30 ) to bottom (hardware layer 40 ) of a hierarchical system architecture 100 .

[0065] Here, the Figure 1An extreme layer architecture is shown, which has at least the necessary layers. Therein, the system layer architecture 100 consists of only three layers: a hardware layer 40, a protection layer 50 and an implementation / performance layer 30. The hardware layer 40 is protected according to ISO 26262 and can provide sensor raw data. In addition, the hardware layer 40 can receive and implement instructions from the layers above it (e.g., layers 30 or 50). The protection layer 50 carries the complete safety load and is therefore limited to a protectable level in terms of its complexity. In contrast, the performance layer 30 does not carry any safety load at all and can therefore be arbitrarily complex and can be implemented, for example, by an end-to-end learning method.

[0066] Furthermore, the protection layer 50 is constructed as follows. It contains a check module (Prüf- / Check-Module) 92, which checks the input of the performance layer 30 or the generated and transmitted first control signal 60 for validity. Here, two case scenarios are distinguished:

[0067] If the input of the performance layer 30 is valid in the first case scenario, it is used as a reference for the planning module 94 of the protection layer 50, so that the planning module 94 outputs the corresponding control signals 62, 64 to the hardware layer 40 located below it, which follows the planning of the performance layer 30.

[0068] Conversely, if the input from the performance layer 30 is invalid in the second case scenario, the protection layer 50 must provide a fallback solution for all such possible cases. Under the fallback solution, the input may be invalid. Furthermore, the protection layer 50 must ensure that, in any case, invalid inputs are not unknown. Accordingly, it must be optimized by avoiding false negatives at the expense of an increased false positive rate. Therefore, for verification and for planning, the protection layer 50 requires its own protected perception in the form of a perception module 90 and can only trust information from this protected perception.

[0069] The detector module 70 is part of the protection layer 50. However, unlike the check module 92, it can also access the environment model that may be available in the performance layer 30 in order to check certain characteristics thereof. The check module 92 focuses on the verification of the validity of the input or the first control signal 60, while the detector module 70 recognizes the existence of a special case of the identified driving condition of the vehicle 80, for which a specific system reaction is set. Typically, this special case is characterized in that the proposed backup solution of the protection layer 50 is not satisfactory. However, this is only one of the many possible evaluation criteria that can describe special cases. Through additional criteria, the ODD of special cases is limited and clearly defined. Therefore, the specific second system reaction 56 no longer has to provide a solution to the so-called open world problem, as the protection layer 50 of the hierarchical system architecture 100 must do.

[0070] Accordingly, complex system reactions can also be ensured. A further difference from the checking module 92 of the protective layer 50 is that the detector 70 is designed to avoid false alarms. Therefore, the corresponding second system reaction 56 is only triggered when it is sufficiently ensured that the second system reaction 56 is a better solution than the fallback solution of the first system reaction 54 with the protective layer 50.

[0071] Due to the restricted ODD, the complexity of the second system reaction 56 may be significantly more complex than the proposed first system reaction 54 of the planning module 94 of the protection layer 50, since the latter must be protected for an open world scenario. Accordingly, the second system reaction 56 is located in the performance layer 30 outside the protection layer 50. However, unlike the output of the performance layer 30, the output of the specific second system reaction 56 is ensured to be on its restricted ODD.

[0072] Refer to the signal flow change curve (such as the signal flow change curve in Figure 1 As exemplarily indicated by corresponding reference numerals in the system architecture 100 of FIG. 1 ), the following can also be said:

[0073] First, the performance layer 30 is calculated, wherein the perception 90 of the protection layer 50 can be calculated in parallel therewith. The input of the performance layer 30 by means of the first control signal 60 is fed into the checking module 92 of the protection layer 50, whereupon the planning module 94 of the protection layer 50 either determines the regression behavior or determines the planning (Ausplanning) of a predefined reference. After this, the detector 70 triggers the corresponding second system reaction 56 for the detected special case (see the signal connection 75 from the detector 70 to the reaction module 74), which is determined in the reaction module 74 of the performance / implementation layer 30. In this case, the reaction module 74 is protected in its limited ODD.

[0074] Depending on the result of the detector 70, or directly using the output of the planning 94 of the protection layer 50, that is, in the form of the first system reaction 54 (normal situation) originally proposed. If, on the other hand, the detector 70 detects a special situation for the vehicle 80, the planning of the main signal path is overwritten by the special second system reaction 56, and the corresponding third control signal 64 is transmitted to the implementation module 98 of the hardware layer 40 instead of the second control signal 62 for the first system reaction 54 to be implemented.

[0075] As briefly explained at the beginning, Figure 1 In the embodiment of the present invention, the protection layer 50 of the system architecture 100 - however, instead of the hardware layer 40 (the hardware layer provides sensor data in the form of sensor modules 96 to the layers above it when necessary) - consists of a perception module 90, a check module 92 and a planning module 94 for planning corresponding control commands. Alternatively, the implementation layer 30 can also have the same structure as the protection layer 50.

[0076] The hardware layer 40 includes hardware components (such as sensors, actuators, computing units) and their low-level control software (such as firmware, device drivers, low-level regulators). The hardware layer 40 is mainly protected according to the principles of ISO 26262 and corresponding redundancy is set.

[0077] The perception module 90 processes the sensor data and prepares them for processing decisions. The checking module 92 verifies the output of the perception module 90 and the input from the planning module 94 of the next higher implementation layer 30. In particular, the checking module 92 verifies the credibility and consistency of the data. Whenever possible, the checking module 92 corrects corrupted input data. However, in any case, the checking module 92 of the protection layer 50 evaluates the input data or the incoming control signal and forwards the evaluation together with the input data to the planning module 94 of the protection layer 94.

[0078] In the simplest case, such an evaluation is a binary decision: which part of the input data can be used for planning. Furthermore, in more complex embodiments of the checking module, probability measures or scores from neural networks can be used. The planning module then plans the behavior of the automated vehicle based on the input data and its evaluation. Depending on the layer and the embodiment, such a behavior can be expressed in the form of specific instructions (e.g., "stop at the stop line", "cross the intersection"), a certain amount of edge conditions, or a set trajectory (that is, a sequence of set states of the host vehicle 80 changing over time).

[0079] The hierarchical system architecture 100 according to the present invention can be used in a variety of use fields or application fields.

[0080] In the first example, the system reaction for the zebra crossing scenario is implemented in the bottom-up safety path. The top-down path first sets the performance behavior of "stopping in front of the zebra crossing". If this is not possible, the behavior of the vehicle will be degraded to: although on the zebra crossing, it stops in front of the pedestrian by forced braking. This backup behavior is implemented by a less complex functionality compared to the performance path, which predetermines the behavior with the best comfort. However, if stopping in front of the pedestrian is no longer achievable by full braking, a more complex avoidance behavior is necessary. This requires, for example, the functional complexity of the motion layer. This situation is identified by the detection mechanism, which now just identifies this specific situation for the vehicle. Its functionality must be carefully protected. The more complex functionality is in turn limited to a clearly defined and strictly limited operational design domain, so that its safety can be ensured despite the complexity of the functionality.

[0081] In the second example, the safety mechanism with the corresponding bottom-up safety path as explained in detail above can realize the corresponding system reaction for the so-called crash alignment. In the top-down main signal path, the optimal parking in front of other traffic participants is first checked automatically. If this is no longer possible, the emergency braking before this is calculated. The detector recognizes when such an emergency braking is no longer sufficient to prevent an accident. In addition, the bottom-up safety mechanism checks whether other requirements are met: under the other requirements, the complex crash alignment module can ensure that its function is correctly completed. For this reason, the detector must be carefully protected. If the detector recognizes this special situation, the crash alignment is triggered, so that the consequences of the accident are minimized.

[0082] In a third example, a system reaction for an intersection scenario with a traffic light system is implemented in a bottom-up safety path, in which the own vehicle enters the intersection when the light is green, but then has to stop unexpectedly at the intersection because, for example, the vehicle driving ahead remains stationary behind the intersection contrary to expectation, so that the own vehicle can no longer pass the intersection. Since the vehicle crossing the intersection will only receive a green light signal when the own vehicle has stopped, this situation is not as critical as, for example, in a zebra crossing scenario, in which a wrong decision can lead to a serious accident. For this scenario, a layer architecture is assumed, which includes the layers of context layer, intention layer, motion layer, reflection layer, and hardware layer, wherein the context layer is the highest layer arranged in the architecture and the hardware layer is the lowest layer arranged in the architecture.

[0083] Accordingly, the safety load is reduced so that the detectors in the motion layer can already intercept such a situation, although the top-down path will always find an effective solution in the reflection layer located below (for example, direct forced braking to a standstill). The specific situation is detected by the detector, which triggers the reaction module in the context layer. The reaction module determines the optimal parking point so that the own vehicle hinders the crossing vehicle as little as possible. The solution is then checked again by the reflection layer, so that if the trajectory of the reaction module cannot withstand the collision check of the reflection layer, the reflection layer will still trigger emergency braking. In contrast, the check for compliance with traffic regulations located in the intention layer and the motion layer is covered.

[0084] Below, further advantages of the bottom-up security approach described above are clearly shown in the summary overview:

[0085]

[0086]

Claims

1. A hierarchical system architecture (100) for controlling an automated vehicle (80), comprising: - implementation layer (30), - a protective layer (50), - Hardware layer (40), wherein The protection layer (50) is arranged between the implementation layer (30) and the hardware layer (40), wherein the execution layer (30) is designed to generate a first control signal (60) and transmit it to the protection layer (50), wherein the protection layer (50) is further designed to detect whether a safety-critical driving situation (52) exists for the vehicle (80) and whether a first system reaction (54) should be implemented in order to bring the vehicle (80) into a safe state by transmitting a corresponding second control signal (62) instead of the first control signal (60) to the hardware layer (40), and - wherein the protective layer (50) further comprises at least one detector module (70) which is designed to detect, based on an evaluation using at least one evaluation criterion (72), whether a special situation (53) exists in a safety-critical driving situation (52) of the vehicle (80) which makes a second system reaction (56) associated therewith necessary instead of the first system reaction (54) in order to achieve a safe state of the vehicle (80) by transmitting a corresponding third control signal (64) instead of the second control signal (62) to the hardware layer (40).

2. The hierarchical system architecture (100) according to claim 1, wherein: The first system reaction (54) is triggered based on the result of a validity check of a received first control signal (60).

3. The hierarchical system architecture (100) according to any one of the preceding claims, wherein: The at least one evaluation criterion (72) specifies whether the first system reaction (54) is sufficient to bring the vehicle (80) into the safe state.

4. The hierarchical system architecture (100) according to any one of the preceding claims, wherein: The detector module (70) is designed to access at least one execution layer (30) in order to obtain information (75), and to use the information in evaluating a safety-critical driving situation (52) of the vehicle (80).

5. The hierarchical system architecture (100) according to any one of the preceding claims, wherein: The second system reaction (56) is performed by a reaction module (74) which is connected to the detector module (70) in terms of signal technology.

6. The hierarchical system architecture (100) according to claim 5, wherein: A reaction module (74) corresponding to the detector module (70) is arranged on a different layer of the system architecture (100) than the detector module (70) itself.

7. The hierarchical system architecture (100) according to claim 6, wherein: The reaction module (74) is located on a layer of the system architecture layer (100) which is arranged above a layer on which the detector module (70) is located.

8. A computer program comprising machine-readable instructions which, when executed on one or more computers and / or computing instances, cause the one or more computers or computing instances to implement the hierarchical system architecture (100) according to any one of claims 1 to 7.

9. Machine-readable data carrier and / or download product having a computer program according to claim 8.

10. One or more computers and / or computing instances having a computer program according to claim 8 and / or having a machine-readable data carrier and / or a download product according to claim 9.

Images