Method for rescuing at least partially automated vehicle and vehicle control system

Abstract

The invention relates to a method (800) for rescuing an at least partially automated vehicle (300, 400) having a vehicle control system (100) and a corresponding vehicle control system (100, 200), the vehicle control system comprising at least one first subunit and one second subunit, the method comprises the following steps: a) detecting (810) a failure of at least one part of the first subunit, b) checking (820) whether the first subunit is in an emergency operating state, and if the first subunit is not in the emergency operating state, transferring the first subunit or the vehicle control system into the emergency operating state, c) on the basis of the emergency operating state, determining (820) the failure of at least one part of the first subunit. Emergency control (830) of the vehicle by means of the vehicle control system, d) receiving (840) a release signal (121) by means of the vehicle control system, and e) actuating (850) the first subunit or the second subunit on the basis of the release signal.

Description

Technical Field

[0001] The present invention relates to a method for rescuing at least partially automated vehicles and a corresponding vehicle control system. Background Art

[0002] Automated vehicles can be partially automated vehicles or fully automated vehicles. The method according to the present invention and the vehicle control system according to the present invention are advantageously particularly suitable for vehicles with an automation level according to SAE (Society of Automotive Engineers) levels 2 to 5, especially level 4 or 5. The higher the automation level of an automated vehicle, the wider its application fields, especially in areas inaccessible to humans, such as open-pit mines or underground mines. Here, it becomes increasingly important to have the possibility of rescuing such vehicles without endangering personnel during the rescue process. Especially when there is no driver (i.e., a fully automated vehicle), it is necessary to be able to rescue the fully automated vehicle efficiently.

[0003] It is known from DE 10 2017 118 537 A1 to receive an indication of a fault state in the vehicle and wirelessly transmit the indication of the fault state to a remote server. Furthermore, it is provided to receive a revised route to the destination (at least partially based on the fault state) and drive the vehicle along the revised route.

[0004] DE 10 2017 211 797 A1 discloses an autonomous vehicle that communicates with at least one other autonomous vehicle, especially in a public emergency situation, and the autonomous vehicle or an external server unit calculates a route to a safe location, whereupon the autonomous vehicle is subsequently driven to the safe location.

[0005] DE 10 2018 203 773 B3 discloses a parking lock system for an automatic transmission in a motor vehicle, wherein the parking lock system includes a parking lock for blocking or releasing the output of the transmission, a spring energy storage for engaging the parking lock, a pressure-controlled release device for disengaging the parking lock, a predetermined operating device, and an information system for indicating the "parking" and "neutral" operating states of the transmission. The parking lock system further includes an emergency unlocking device for the parking lock that can be triggered when the vehicle internal combustion engine is turned off, which operates an electric motor that can be connected to the pump action of the internal combustion engine and the transmission in the event of a defined event to disengage the parking lock in a pressure-controlled manner.

[0006] DE 10 2018 219 809 A1 relates to a method for avoiding locally induced potential hazards, in which an escape route for the vehicle is calculated in order to avoid potential hazards. Here, the vehicle receives messages about potential hazards. Subsequently, the vehicle performs a hazard potential assessment of the reported potential hazards. If the hazard potential assessment has a severe hazard potential, the vehicle automatically resumes the driving mode, in which it follows the escape route in order to avoid potential hazards.

[0007] US 2018 / 158255 A1 discloses an information display device having a display screen on a vehicle, wherein the display screen is configured to display visual information based on the vehicle mode (in which the vehicle is operating). The display screen can display instructions connected to a vehicle communication interface, wherein the vehicle operates based on the occurrence of one or more events belonging to the vehicle in the vehicle mode.

[0008] US 2020 / 247420 A1 discloses a system for controlling a vehicle based on driver intervention. The method for controlling the vehicle can include: determining a driver state estimate of the driver of the vehicle in the case of driver data using one or more driver sensors, determining one or more environmental anomalies within the vehicle environment in the case of environmental data using one or more environmental sensors, and determining an anomaly category for at least one of the one or more environmental anomalies. The method further includes selecting a failure mode based on the driver state estimate and one or more anomaly categories, and selecting at least one fail-safe action based on the failure mode and determining the operation of the vehicle according to the failure mode.

[0009] According to EP 3 644 295 A1, an operating terminal for presenting display information is known. Here, first information (including operating information) is exchanged via a first communication path, while second information is exchanged via a second communication path, wherein the second information includes display information about parking control. When a first evaluation value of the first communication path is less than a first threshold, at least a part of the first information is exchanged via one or more other communication paths different from the first communication path. When a second evaluation value of the second communication path is less than a second threshold, at least a part of the second information is exchanged via one or more other communication paths different from the second communication path, and the amount of information of the first information and / or the second information is reduced. The vehicle parks in a manner of moving along a parking path according to a control instruction, wherein the control instruction is based on operating information input to an external operating terminal.

[0010] None of the above publications stipulates the core concept of an operating mode for an at least partially automated vehicle with an automation system, wherein, in the event of a serious failure of the automation system, after detecting the failure and executing a fail-safe reaction, the vehicle is brought into a rescue mode in order to subsequently safely rescue the vehicle, for example from an inaccessible area.

[0011] There is therefore a need to be able to safely rescue an automated vehicle when it breaks down in an inaccessible area. Summary of the invention

[0012] The object of the invention is to define a concept for emergency rescue operations in order to be able to efficiently rescue, for example, an automated vehicle that has broken down in an area that is difficult or impossible to access for a human operator or a towing service. The causes of such a breakdown are mainly actuator failures or other internal fault states that partially or completely prevent normal or degraded execution of an internal or external planned route.

[0013] The focus is primarily on applications in open-pit mines and underground mines, where these vehicles are used, for example, in areas that are inaccessible to human workers due to external hazards. A stranded vehicle here results in permanent or long-term loss of the vehicle or requires a complex and expensive air rescue. In addition, the vehicle can hinder or block the automated operation of other vehicles. However, the invention can also facilitate the rescue of automated vehicles in the case of highway automation on motorways.

[0014] The object of the present invention is to provide a method for rescuing an at least partially automated vehicle, in particular a stranded vehicle, in particular from an area inaccessible to humans.

[0015] The present invention solves this task by means of a method of the aforementioned type having the features of claim 1, wherein the vehicle to be rescued comprises a vehicle control system having at least a first subunit and a second subunit, wherein the method comprises the following steps: a) detecting a failure of at least a portion of a first subunit of the vehicle control system, b) checking whether the first subunit is in an emergency operating state, and if the first subunit is not in an emergency operating state, switching the first subunit or the vehicle control system to an emergency operating state, c) based on the emergency operating state, emergency controlling the vehicle with the aid of the vehicle control system, d) receiving a release signal via the vehicle control system, and e) controlling the first subunit and / or the second subunit of the vehicle control system based on the release signal.

[0016] The vehicle may be a partially automated vehicle or a fully automated vehicle. Preferably, the vehicle is a fully automated vehicle.

[0017] The vehicle control system is suitable for at least partially, preferably fully automatically controlling the vehicle.

[0018] The vehicle control system of an at least partially automated vehicle includes sub-units. Preferably, the vehicle control system includes more than one first sub-unit and a second sub-unit. The vehicle control system can for example include a brake control unit, a transmission control unit, a steering control unit, an engine control unit, a monitoring unit, and / or an interface unit. Preferably, the vehicle control system includes at least one brake control unit having a service brake and a parking brake. The service brake is generally suitable for braking a moving vehicle. Preferably, the service brake acts on all wheels of the vehicle. The parking brake is generally suitable for preventing a non-moving vehicle from moving. Preferably, the parking brake continuously locks the wheels of the vehicle that are operatively connected to the parking brake in a locked state.

[0019] The first sub-unit is a sub-unit of the vehicle control system. Preferably, the first sub-unit is a brake control unit, a transmission control unit, a steering control unit, an engine control unit, a monitoring unit, and / or an interface unit. The second sub-unit is also a sub-unit of the vehicle control system. Preferably, the second sub-unit is a brake control unit, a transmission control unit, a steering control unit, an engine control unit, a monitoring unit, and / or an interface unit. The first sub-unit can for example correspond to the second sub-unit.

[0020] In a first step of the method according to the invention, at least a part of a sub-unit (i.e., the first sub-unit) of the vehicle control system is detected as having a fault. Preferably, the fault can be detected by the monitoring unit of the vehicle control system.

[0021] Preferably, the method according to the invention involves detecting a fault in at least one part of a sub-unit of the vehicle control system that is necessary for the driving of the vehicle, in particular for the safe and / or automated driving of the vehicle.

[0022] The fault can relate to a sub-unit of the vehicle control system of the vehicle, wherein in particular the fault can also only include a part of one of the sub-units of the vehicle control system, preferably a part of a brake control unit, a transmission control unit, a steering control unit, an engine control unit, a monitoring unit, and / or an interface unit.

[0023] Preferably, in the event of a fault, the control (i.e., driving) of the vehicle can be achieved in a restricted state compared to the normal state of the vehicle control system. Alternatively, in the event of a fault, the control of the vehicle can be carried out in the normal state of the vehicle control system for a restricted period of time, wherein the restricted period of time is limited by the fault. As a further alternative, in the event of a fault, the control of the vehicle can be prevented by the fault.

[0024] In a second step of the method according to the invention, it is checked whether the sub-unit (i.e., the first sub-unit) in which the fault is detected is in an emergency operation state. In particular, in the case of the first detection of a fault, the first sub-unit or the vehicle control system is transferred to the emergency operation state. The emergency operation state is a state in which the control of the vehicle is only realized in a restricted manner, where the restriction is based on the fault. The emergency operation state can also be referred to as the minimum risk operation mode or "MRM mode". Here, the restriction can be made functionally and / or temporally. The emergency operation state can either only relate to a part of the first sub-unit, the first sub-unit or the vehicle control system. If the entire vehicle control system is in the emergency operation state, then the first sub-unit, in particular this part of the first sub-unit, is also in the emergency operation state.

[0025] In a third step of the method according to the invention, based on the emergency operation state, the vehicle is emergently controlled by means of the vehicle control system. By means of the emergency control, preferably "minimum risk operation" is carried out. For example, the vehicle is controlled such that the safety of the vehicle and / or other road users is not endangered. Other road users also include other autonomously driving vehicles. Preferably, the vehicle is only emergently controlled until the vehicle can be parked safely, i.e., until the vehicle can be parked securely. "Safely" means that, after a risk assessment, the maximum safety of the vehicle and / or other road users is pursued. Thus, "safely" here means that the vehicle is parked at a location that provides the maximum safety for the vehicle and / or other road users compared to other locations. Safe parking is in particular defined by the fact that in no way will the vehicle to be rescued and other vehicles or road users be endangered.

[0026] In a fourth step of the method according to the invention, a release signal is received by means of the vehicle control system, where the release signal is sent to the vehicle to be rescued by a sending unit (such as a vehicle console, which is suitable for monitoring the functions of an automated vehicle), a near-field remote control or in some other way. Preferably, the release signal is received by an interface unit of the vehicle control system. By means of the release signal, the vehicle is transferred to a rescue state in the next step, in which certain functions are released in order to be able to rescue the vehicle.

[0027] The release signal is sent to the vehicle by the sending unit, for example. Here, the communication connection between the sending unit and the vehicle preferably protects against external attacks and faults.

[0028] The release signal includes signals for controlling one or more subunits of the vehicle control system. Preferably, the release signal includes signals for controlling one or more subunits that prevent the vehicle from continuing to move actively or passively. For example, the release signal includes signals for controlling a braking unit (particularly preferably a parking brake) to release the braking unit and / or the parking brake. Additionally or alternatively, the release signal may also include signals for controlling the drive train and / or the transmission to disengage the drive train and / or the transmission.

[0029] Steps 1 to 4 can be understood as prerequisites for transitioning the vehicle to a safe state (MRM mode).

[0030] In the fifth step of the method according to the invention, the first subunit and / or the second subunit is controlled based on the release signal. The release signal can, for example, include a release signal for an actuator of one of the subunits of the vehicle control system, such as the actuator of a parking brake that has been locked after the vehicle has been parked.

[0031] The method according to the invention allows for a specific rescue operation or rescue mode ("Rescue-Mode") for a stranded automated vehicle, wherein the rescue mode is requested from the outside (i.e., from outside the vehicle). Thus, it is possible to rescue an automated vehicle, especially in areas that are inaccessible to humans.

[0032] Preferably, when the MRM mode has been executed, the vehicle has stopped (especially has been locked), and the automated interface has been closed, the rescue of the stranded vehicle is carried out.

[0033] In a preferred embodiment, the fault detected in the first step of the method is a fault that prevents the vehicle from continuing to drive safely. The advantage of this is that the above method for rescuing the vehicle is only executed when the safe driving of the automated vehicle can no longer be ensured.

[0034] The fifth step of the method according to the invention can be understood as transitioning the vehicle into a rescue state or "rescue mode" based on the release signal.

[0035] In another preferred embodiment, the emergency control in the emergency operation state (i.e., MRM mode) and / or rescue mode of the vehicle includes stopping the vehicle, and more preferably, emergently stopping the vehicle. Thus, after detecting a fault and transitioning to the emergency operation state, the vehicle is first stopped within the scope of, for example, "minimum risk operation", where the stop takes into account not only the safety of the vehicle but also the safety of other road users. Then, after receiving a release signal, the vehicle can be rescued by operating the first sub-unit or the second sub-unit ("rescue mode"). This results in an improvement in the safety of the vehicle and / or other road users during the rescue of the vehicle. The emergency stop preferably includes engaging or maintaining the engagement of the parking brake and / or deactivating the automation interface, thereby preventing the autonomous operation of the vehicle. That is to say, the emergency stop can include engaging the parking brake and / or deactivating at least a part of the vehicle control system, where this part of the vehicle control system is designed to control the vehicle at least partially automatically.

[0036] Additionally or alternatively, operating the first sub-unit or the second sub-unit of the vehicle control system based on the release signal can include stopping, and more preferably, emergently stopping, that is, during the "rescue mode", as described above. Particularly preferably, the stop or emergency stop during the "rescue mode" is independent of the emergency operation state, especially the emergency stop during the emergency operation state ("MRM mode").

[0037] For example, the operation of the first sub-unit or the second sub-unit can include releasing or disengaging the parking brake. This can enable the automated vehicle to be towed, especially by another vehicle (preferably a fully automated vehicle), in the "rescue mode".

[0038] Additionally or alternatively to towing, after operating the first sub-unit or the second sub-unit, the vehicle can be controlled by the vehicle control system (in the "rescue mode"), where preferably the vehicle is controlled externally based on the control signals included in the release signal. Thus, the method according to the invention preferably has a step of controlling the vehicle based on the control signals after operating the first sub-unit and / or the second sub-unit. In other words, the method has a step of receiving the control signals, where the vehicle is controlled, especially remotely controlled, based on the control data after operating the first sub-unit or the second sub-unit. The remote control can be performed from outside the vehicle depending on the fault and / or depending on the release signal, that is, from a sending unit (which corresponds to, for example, the vehicle console).

[0039] In another preferred embodiment, the method has another step of monitoring the fault and / or monitoring the towing or control of the vehicle. More preferably, the monitoring step is performed by a sending unit outside the vehicle.

[0040] Further preferably, during the control after the manipulation of the first sub-unit or the second sub-unit, the vehicle is controlled in a restricted operating mode (which may also be referred to as "rescue mode", is part of this rescue mode, or includes this rescue mode) compared to the normal operating mode of the vehicle. Here, the restricted operating mode is preferably a dynamically restricted operating mode, i.e., it can be adapted to the respective situation. The dynamically restricted operating mode can enable further intervention in the control of the vehicle during the control of the vehicle, especially from outside the vehicle.

[0041] It is conceivable that due to a fault, at least a part of the first sub-unit fails to work properly, so that the vehicle cannot operate fully normally, thereby reducing the safety of the vehicle and / or other road users. By using the restricted operating mode of the vehicle (in which, for example, riskier driving operations cannot be achieved), the safety of the vehicle and / or other road users is further improved.

[0042] Preferably, during the time when the vehicle (i.e., the vehicle control system or at least the first sub-unit) is in the rescue mode ("Rescue-Mode"), the preferably wireless communication connection between the vehicle and the sending unit (such as the vehicle console) that sends the release signal is monitored, and in the case where the connection between the vehicle and the sending unit is interrupted, the rescue mode of the vehicle (i.e., the vehicle control system) is ended. In the case where the vehicle is controlled based on the control signal included in the release signal from the sending unit after the manipulation of the first sub-unit or the second sub-unit, ending the rescue mode preferably causes the vehicle to stop, where preferably a safe stop is achieved. This can ensure that the vehicle stops, preferably safely, when the vehicle no longer receives external control. Thereby, the safety of the vehicle can be further improved during the rescue.

[0043] In one embodiment (in which the towing or control of the vehicle has been monitored, i.e., preferably the control after the manipulation of the first sub-unit and / or the second sub-unit in the "rescue mode"), if a fault is detected during the monitoring during towing or control, the vehicle can be brought to a safe state, preferably stopped, based on the fault. For example, it is stipulated that the vehicle receives an emergency stop signal, such as from the sending unit, and stops based on this emergency stop signal. The emergency stop signal can also be provided manually by an operator through a switch on the vehicle, or provided remotely by remote control. If a serious fault occurs, the emergency stop signal can also be automatically regulated by the vehicle in the "rescue mode" of the vehicle.

[0044] Alternatively, for example, the control of the vehicle (in the "rescue mode") can be ended by a dedicated emergency stop signal of the sending unit based on the control signal of the sending unit.

[0045] In a preferred embodiment, operating the first sub-unit or the second sub-unit (in "rescue mode") includes operating at least one actuator of the first sub-unit or the second sub-unit. For example, targeted rescue of the vehicle can be achieved by operating a single, several, or all actuators of the first sub-unit and / or a single, several, or all actuators of the second sub-unit, such as by subsequently towing the vehicle or remotely controlling the vehicle.

[0046] When operating the actuators, it is particularly preferred to minimize the number of actuators being operated. In particular, "minimize" refers to the mathematical minimum, that is, the number of changes from one state of the actuator to (another) state (in which the vehicle can be rescued) is minimized. Since the operation of the actuators is based on release signals and the release signals are preferably sent from outside the vehicle, minimizing the number of actuators being operated can minimize the data payload of the release signals. In addition, by operating as few actuators as possible, the error-proneness of the rescue process is also reduced.

[0047] In a preferred embodiment, the release signal is received via V2X communication, where V2X communication enables data exchange between the vehicle to be rescued and any transmitting unit in the surrounding environment of the vehicle to be rescued. The transmitting unit can also be a vehicle, for example, so that V2X communication is V2V communication, where V2V communication enables data exchange between the vehicle to be rescued and one or more other vehicles in the surrounding environment of the vehicle. Preferably, V2X communication or V2V communication is wireless communication, particularly preferably 5G wireless communication.

[0048] In another preferred embodiment, the method according to the invention has the following steps: after detecting a failure of at least a part of the first sub-unit, providing and / or sending fault data, where the fault data is indicative of the failure. This enables the analysis of the failure of the automated vehicle from outside the automated vehicle. In addition, providing and / or sending the fault data can enable the transfer of the first sub-unit or the vehicle control system from the outside, such as a vehicle console, to an emergency operation state, such as the MRM mode.

[0049] In the above-described variant, the release signal transmitted by the transmitting unit is preferably based on the fault data previously received by the transmitting unit. That is to say, depending on the fault occurring in the vehicle control system, the fault can be relied upon to select the release signal to be transmitted to the vehicle control system. The release signal dependent on the fault can be received by the vehicle to be rescued and then the first sub-unit and / or the second sub-unit of the vehicle control system can be controlled accordingly (in the "rescue mode"). This can in particular enable the systematization / categorization of the fault and the subsequent release signal and / or control signal to be transmitted. Thereby, specific actions can be performed based on the specific fault, that is, specific actuators can be controlled (in the "rescue mode").

[0050] In a particularly preferred embodiment, the control of the first sub-unit and / or the second sub-unit (in the "rescue mode") can enable the towing of the vehicle. Thus, after the emergency control of the vehicle, those vehicle settings that prevent towing (in particular the locking of the braking unit, such as the locking of the parking brake, or the locking of the transmission unit) can be changed as follows, that is, the brake, such as the parking brake, is released or the transmission is put into neutral. In other words, the method according to the invention can have the step of towing the vehicle by controlling the first sub-unit or the second sub-unit.

[0051] Generally preferably, the control of the first sub-unit and / or the second sub-unit (in the "rescue mode") includes the control of the parking brake, which is transferred to the released state by the control based on the release signal.

[0052] Particularly preferably, the control of the parking brake includes the control of the anti-recompression port, the emergency release port, the high selector valve and / or the screw drive device. Additionally or alternatively, the control includes the control of the solenoid valve. Here, the control of the parking brake preferably includes the control of the monostable valve and the bistable valve.

[0053] Additionally alternative to the control of the parking brake, the control of the first sub-unit and / or the second sub-unit can include the control of the drive train and / or the transmission. In this case, the drive train and / or the transmission are transferred to the disengaged state by the control based on the release signal.

[0054] According to another aspect of the invention, a vehicle control system is described, which has a brake control unit, a transmission control unit, a steering control unit, an engine control unit, a monitoring unit and an interface unit, wherein the interface unit is suitable for performing the method according to one of the above-described embodiments, and wherein the first sub-unit and the second sub-unit respectively correspond to one of the brake control unit, the transmission control unit, the steering control unit, the engine control unit, the monitoring unit and the interface unit.

[0055] In a preferred embodiment, the interface unit includes an energy supply unit attached to the energy supply unit of the vehicle control system. This has the advantage that in the case of a fault involving the energy supply unit of the vehicle control system, the rescue process of the vehicle can still be ensured (in the "rescue mode").

[0056] In another preferred embodiment, the interface unit includes a rescue operation unit, wherein the rescue operation unit is adapted to control the first sub-unit and / or the second sub-unit of the vehicle control system based on a release signal. Preferably, the rescue operation unit also includes an energy supply unit attached to the energy supply unit of the vehicle control system. In the case where an energy supply unit attached to the energy supply unit of the vehicle control system is provided not only for the interface unit but also for the rescue operation unit, the energy supply unit of the interface unit and the energy supply unit of the rescue operation unit can be the same.

[0057] In a preferred embodiment, the second sub-unit includes an additional actuator emergency unit or an additional actuator, which is arranged to be attached to the actuator provided for the normal operation of the vehicle and is electrically independent of the actuator provided for the normal operation of the vehicle. Preferably, the additional actuator emergency unit or the additional actuator is not used for the normal operation of the vehicle.

[0058] Particularly preferably, the second sub-unit includes a parking brake, wherein the parking brake is transferred to the released state by control based on a release signal.

[0059] Here, particularly preferably, the parking brake includes a brake pressure supply unit attached to the brake pressure supply unit of the brake control unit. Thereby, even if the brake pressure supply unit of the brake control unit fails, it is still possible to ensure the release of the parking brake to rescue the automated vehicle.

[0060] Particularly preferably, the parking brake includes emergency release units, which are arranged in addition to the release unit of the parking brake. Preferably, these emergency release units are not used to release the parking brake during normal vehicle operation. The emergency release units can, for example, include solenoid valves, wherein the release of the parking brake (e.g., in the MRM mode or rescue mode) corresponds to the release of the solenoid valves.

[0061] Particularly preferably, the parking brake includes solenoid valves, wherein the release of the parking brake corresponds to the release of the solenoid valves. Here, the solenoid valves can include monostable valves or bistable valves. This enables particularly simple control of the parking brake to release the parking brake.

[0062] Now, the embodiments of the present invention will be described in conjunction with the accompanying drawings. These drawings do not necessarily show the embodiments to scale, but rather the drawings used for illustration are implemented in a schematic and / or slightly distorted form. In addition to the teachings directly visible from the drawings, reference has been made to the relevant prior art. It should be noted here that various modifications and changes can be made to the form and details of the embodiments without departing from the general concept of the present invention. The features of the present invention disclosed in the specification, drawings, and claims, whether individually or in any combination, are crucial to the improvement of the present invention. In addition, all combinations consisting of at least two features disclosed in the specification, drawings, and / or claims that fall within the scope of the present invention are also within the scope of the present invention. The general concept of the present invention is not limited to the exact form or details of the preferred embodiments shown and described below, nor is it limited to the subject matter restricted compared to the subject matter claimed in the claims. When specifying a dimension range, the values within the mentioned boundaries should also be disclosed as boundary values and can be used and protected arbitrarily. For simplicity, the same reference numerals will be used hereinafter for consistent or similar parts or parts with consistent or similar functions. Description of the Drawings

[0063] Other advantages, features, and details of the present invention will be obtained from the following description of the preferred embodiments and in conjunction with the drawings; in the figures:

[0064] Figure 1 A schematic diagram is shown to illustrate the first embodiment of the vehicle control system according to the present invention.

[0065] Figure 2 A schematic diagram is shown to illustrate the second embodiment of the vehicle control system according to the present invention.

[0066] Figure 3 A schematic diagram is shown to illustrate the braking system having a rescue operation unit according to the present invention.

[0067] Figure 4 A schematic diagram is shown to illustrate the second braking system having a rescue operation unit according to the present invention.

[0068] Figure 5 A schematic diagram is shown to illustrate a monostable valve applied to a vehicle having a vehicle control system according to the present invention.

[0069] Figure 6 A schematic diagram is shown to illustrate a bistable valve applied to a vehicle having a vehicle control system according to the present invention.

[0070] Figure 7 A schematic diagram is shown to illustrate a solenoid valve applied to a vehicle having a vehicle control system according to the present invention, and

[0071] Figure 8Schematic flowchart showing a first embodiment of a method according to the invention for rescuing at least partially automated vehicles.

[0072] In the drawings and in the description of these drawings, elements that correspond or are related to each other (if appropriate) are respectively identified by corresponding or similar reference numerals, even if they occur in different embodiments. Detailed Description

[0073] Figure 1 Schematic diagrams are shown to illustrate a first embodiment of a vehicle control system 100 according to the invention. The vehicle control system 100 can be installed in vehicles 300, 400. The vehicle control system 100 has a brake control unit 110, a transmission control unit 130, a steering control unit 140, an engine control unit 150, a monitoring unit 160, and an interface unit 120. The brake control unit 110 is adapted to control the brakes of the vehicles 300, 400 at least partially, preferably fully automatically. The transmission control unit 130 is adapted to control the transmissions of the vehicles 300, 400 at least partially, preferably fully automatically. The steering control unit 140 is adapted to control the steering of the vehicles 300, 400 at least partially, preferably fully automatically. The engine control unit 150 is adapted to control the engines of the vehicles 300, 400 at least partially, preferably fully automatically. The monitoring unit 160 is adapted to monitor the state of at least a part of the sub-units, the state of the sub-units, or the state of the vehicle control system 100. The interface unit 120 is adapted to send a signal 122 and receive signals, in particular a release signal 121 or a control signal 123.

[0074] In Figure 1 the example shown, the brake control unit 110 is the first sub-unit 111, and the transmission control unit 130 is the second sub-unit 112. Alternatively, any other sub-unit of the vehicle control system 100 can correspond to the first sub-unit 111, and any other sub-unit of the vehicle control system 100 can correspond to the second sub-unit 112.

[0075] The interface unit 120 is adapted to perform a method for rescuing at least partially automated vehicles 300, 400 having a vehicle control system 100 according to the invention, that is to say, the vehicle control system 100 is adapted to detect a fault in at least a part of a first sub-unit 111 of the vehicle control system 100, check whether the first sub-unit 111 is in an emergency operation state and, if the first sub-unit 111 is not in an emergency operation state, transfer the first sub-unit 111 or the vehicle control system 100 to an emergency operation state, emergency control the vehicles 300, 400 based on the emergency operation state by means of the vehicle control system 100 ("MRM mode"), receive a release signal 121 by means of the vehicle control system 100 and control a first sub-unit 111 or a second sub-unit 112 of the vehicle control system 100 based on the release signal 121 ("rescue mode").

[0076] In this embodiment, a monitoring unit 160 of the vehicle control system 100 is adapted to detect a fault in at least a part of the first sub-unit 111. Furthermore, the monitoring unit 160 is adapted to check whether the first sub-unit 111 is in an emergency operation state and, if the first sub-unit 111 is not in an emergency operation state, transfer the first sub-unit 111 or the vehicle control system 100 to an emergency operation state, for example the MRM mode. Additionally, a brake control unit 110, a transmission control unit 130, a steering control unit 140 and an engine control unit 150 are adapted to emergency control the vehicles 300, 400 based on the emergency operation state ("MRM mode"). Furthermore, the interface unit 120 of the vehicle control system 100 is adapted to receive the release signal 121. Here, the release signal 121 can be sent by a sending unit 170 (for example a vehicle console) external to the vehicles 300, 400. The vehicle control system 100 is adapted to control one of the sub-units of the vehicle control system 100, for example the sub-units 111, 112, based on the release signal 121 ("rescue mode").

[0077] In the vehicle control system 100, the first sub-unit 111 is a brake control unit 110 and the second sub-unit 112 is a transmission control unit 130. However, it is also conceivable that, in addition to or alternatively to the brake control unit 110, the first sub-unit 111 includes the transmission control unit 130, the steering control unit 140, the engine control unit 150 and / or the monitoring unit 160. Furthermore, in the vehicle control system 100, the second sub-unit 112 is a transmission control unit 130, wherein, in addition to or alternatively to the transmission control unit 130, the second sub-unit 112 can include the brake control unit 110, the steering control unit 140, the engine control unit 150 and / or the monitoring unit 160. In another example according to the invention, the first sub-unit 111 can correspond to the second sub-unit 112.

[0078] Preferably, at least a part of the first sub-unit 111 fails, which causes the vehicles 300, 400 to be prevented from continuing to drive safely. Further preferably, the vehicle control system 100, in particular the brake control unit 110, the transmission control unit 130, the steering control unit 140 and / or the engine control unit 150, is suitable for stopping the vehicles 300, 400 based on an emergency operation state. Additionally or alternatively preferably, after operating the first sub-unit 111 or the second sub-unit 112, the vehicle control system 100 controls the vehicles 300, 400 in a restricted operation mode (in particular a dynamically restricted operation mode) compared to the normal operation mode of the vehicles 300, 400.

[0079] In one example, the interface unit 120 can be suitable for monitoring the connection between the vehicles 300, 400 and the sending unit 170 (which sends the release signal 121), wherein the connection is a wireless communication connection. For example, the vehicle control system 100 can be suitable for ending the control of the vehicles 300, 400 when the connection between the vehicles 300, 400 and the sending unit 170 is aborted.

[0080] The interface unit 120 can be suitable for receiving the release signal 121 via V2X communication (in particular wireless communication).

[0081] Furthermore, the interface unit 120 can be suitable for providing and / or sending fault data 122 indicative of the fault after detecting that at least a part of the first sub-unit 111 has failed by means of the monitoring unit 160, in particular for sending to the sending unit 170. Preferably, the release signal 121 is generated based on the fault data 122 (that is to say, the release signal 121 is generated on the basis of the fault data 122) and is sent to the interface unit 120.

[0082] Preferably, the vehicle control system 100 is suitable for enabling the towing of the vehicles 300, 400 after operating the first sub-unit 111 or the second sub-unit 112. Particularly preferably, the brake control system 110 includes parking brakes 380, 480, as shown in Figure 3 and Figure 4 in connection with the brake systems 310 and 410, wherein, when operating the first sub-unit 111 or the second sub-unit 112, the parking brakes 380, 480 are operated, and wherein the parking brakes 380, 480 are transferred to the released state by means of an operation based on the release signal 121.

[0083] In an example where the vehicle control system 100 is adapted to operate the parking brakes 380, 480 and transfer them to a released state after detecting a fault, it is preferred to operate the anti-recompense port, the emergency release port, the height selection valve and / or the screw drive. Additionally or alternatively, when operating the parking brakes 380, 480, a monostable valve or a bistable valve can be operated, such as Figure 5 and Figure 6 shown.

[0084] Additionally or alternatively to operating the parking brakes 380, 480, the vehicle control system 100 can be adapted to operate the drive train and / or the transmission, which are respectively provided in the transmission control unit 130 and the engine control unit 150. When operating, the drive train and / or the transmission are transferred to a disengaged state based on the release signal 121 respectively.

[0085] Figure 2 A schematic diagram is shown to illustrate a second embodiment of the vehicle control system 200 according to the present invention. The vehicle control system 200 can be installed, for example, in a vehicle 300 or 400. In particular, Figure 2 an interface unit 220 is shown. The interface unit 220 is adapted to receive a release signal 221 and a control signal 223. Additionally, the interface unit 220 is adapted to send an emergency rescue request 222, that is, after detecting a fault, send the emergency rescue request 222 to the sending unit 270, then the sending unit 270 sends the release signal 221 and / or the control signal 223, and the interface unit 220 receives the release signal 221 and / or the control signal 223.

[0086] Figure 2The interface unit 220 shown is connected via an emergency path to further sub-units, which preferably have actuators. In this example, the interface unit 220 is connected to a monitoring unit 230, an emergency unit 240 for automatic control, an emergency emergency release parking brake 250, an emergency drive and engine control unit 260, an emergency steering unit 270, and an emergency brake unit 280. Additionally, in this embodiment, the monitoring unit 230, the emergency unit 240 for automatic control, the emergency emergency release parking brake 250, the emergency drive and engine control unit 260, the emergency steering unit 270, and the emergency brake unit 280 are also connected to each other. The vehicle control system 200 is adapted to detect a fault in one of the monitoring unit 230, the emergency unit 240 for automatic control, the emergency emergency release parking brake 250, the emergency drive and engine control unit 260, the emergency steering unit 270, and / or the emergency brake unit 280 of the vehicle control system 200, and to check whether the faulty unit is in an emergency operation state. In the case where the faulty unit is not in an emergency operation state, the faulty unit or the entire vehicle control system 200 is adapted to switch to an emergency operation state. In particular, the vehicle control system 200 is adapted to emergency control the vehicles 300, 400 based on the emergency operation state. Additionally, the vehicle control system 200 is adapted to receive a release signal 221 via the interface unit 220, and to control one or more of the monitoring unit 230, the emergency unit 240 for automatic control, the emergency emergency release parking brake 250, the emergency drive and engine control unit 260, the emergency steering unit 270, and the emergency brake unit 280 based on the release signal 221, in particular to control one or more actuators assigned to the respective sub-units. Preferably, the emergency emergency release parking brake 250 is controlled, and particularly preferably, at least one of the actuators of the emergency emergency release parking brake 250 is controlled.

[0087] The following are further considerations regarding an embodiment of a vehicle control system according to the present invention.

[0088] A vehicle control system for controlling and rescuing at least partially automated vehicles according to the present invention, for example, includes a first sub-unit and a second sub-unit. Among them, the vehicle control system is suitable for at least partially automatically controlling the vehicle by using at least the first sub-unit, and the vehicle control system is further suitable for transferring the vehicle control system or at least one of the first and second sub-units into an emergency operation state when at least a part of one of the sub-units fails, and for emergently controlling the vehicle based on the emergency operation state ("MRM mode"). In addition, the vehicle control system includes an interface unit, which is suitable for receiving a release signal and for controlling at least the second sub-unit of the vehicle control unit based on the release signal ("rescue mode"). Preferably, the interface unit is also suitable for controlling the automated vehicle based on the release signal. Particularly preferably, the interface unit is also suitable for controlling the automated vehicle in an operation mode restricted compared to the normal operation mode of the vehicle (especially in a dynamically restricted operation mode) based on the release signal.

[0089] The second sub-unit, for example, includes vehicle actuators. Among them, the interface unit is suitable for at least controlling the vehicle actuators of the second sub-unit. In the case where the second sub-unit includes a plurality of vehicle actuators, the interface unit is preferably suitable for minimizing the number of controlled vehicle actuators.

[0090] Preferably, the interface unit provides V2X communication, especially wireless communication, and the release signal is communicated through V2X, especially wireless communication.

[0091] In a preferred embodiment, the interface unit includes a rescue operation unit, where the rescue operation unit is suitable for receiving the release signal and for at least controlling the second sub-unit based on the release signal. The rescue operation unit, for example, includes an additional power supply unit in addition to the power supply unit of the vehicle control system.

[0092] In another preferred embodiment, the vehicle control system includes a status monitoring unit, which is suitable for monitoring the status of at least the first sub-unit, for detecting that at least a part of the first sub-unit fails, and for providing fault data, where the fault data is indicative of the fault. In addition, the interface unit can be suitable for sending the fault data to an external sending unit. The release signal is, for example, based on these fault data.

[0093] In addition, the interface unit can include a connection monitoring unit, where the connection monitoring unit is suitable for monitoring the connection between the interface unit and the sending unit of the release signal. Among them, the interface unit is also suitable for ending the control of the second sub-unit in the case where the connection between the interface unit and the sending unit is interrupted.

[0094] Preferably, the control based on the release signal can enable the towing of the vehicle.

[0095] In a preferred embodiment, the second sub-unit includes a parking brake, wherein the parking brake is transferred to a released state by being manipulated based on a release signal. The parking brake is released, for example, by an emergency release unit, which includes an emergency release port, a height selection valve, and / or a screw drive. Particularly preferably, the parking brake includes an additional brake pressure supply unit in addition to the brake pressure supply unit of the braking system. Additionally or alternatively, the emergency release unit includes a monostable valve or a bistable valve.

[0096] In another preferred embodiment, additionally or alternatively to the parking brake, the second sub-unit includes a drive train and / or a transmission, wherein the drive train and / or the transmission are transferred to a disengaged state by being manipulated based on a release signal.

[0097] The invention also relates to an electro-pneumatic braking system for a partially automated vehicle having a parking brake unit, which includes an emergency release unit, wherein the parking brake unit is adapted to transfer to an emergency operation state depending on a failure of at least a part of the vehicle control unit of the vehicle, and wherein the braking system includes an interface unit, which is adapted to receive a release signal and to manipulate the emergency release unit based on the release signal ("rescue mode").

[0098] Figure 3 A schematic diagram is shown to illustrate a braking system 310 according to the invention having an interface unit 320 (which can be understood as a rescue operation unit), wherein the braking system 310 is installed in a vehicle 300 having a central control unit 389. The braking system 310 is an electro-pneumatic braking system. Figure 3 and Figure 4 The boxes shown (which are not individually labeled with reference numerals) relate to standard components of the braking system 310, such as an overload protection valve, a parking release safety valve, an axle modulator, a wheel speed sensor, a brake actuator, etc.

[0099] The braking system 310 has a service braking system 311 and a parking braking system 312. The parking braking system 312 has a parking brake 380 in the form of a valve unit, which has at least one spring energy storage interface for supplying parking brake pressure to an actuator 382, and these actuators correspond to spring energy storage brake cylinders. Here, the vehicle 300 has four spring energy storage brake cylinders, which are respectively assigned to the rear wheels 394. Additionally, the service braking system 311 also has two service brake cylinders 383, which are respectively assigned to the front wheels 384.

[0100] The spring energy storage brake cylinders are designed as combined brake cylinders 385 here, that is, they each have a service brake chamber 386, which can be actuated by the parking pressure from the brake supply unit 399.

[0101] A central control unit 389, which is designed as a service brake control unit for controlling a service brake system 311, is connected to an axle modulator 388. The axle modulator forms a rear brake circuit as part of the service brake system 311.

[0102] The parking brake 380 includes a parking brake control unit for controlling a parking brake system 312. The parking brake 380 also has a parking brake valve unit that is designed to regulate a parking brake pressure. In order to supply the parking brake pressure to an actuator 382, that is, a spring energy storage brake cylinder, the parking brake valve unit has at least one spring energy storage interface that is pneumatically connected to the actuator 382, that is, the spring energy storage brake cylinder. The parking brake 380 also has a parking control unit that is connected to the parking brake valve unit in a signal transmission manner for control purposes to provide an electronic parking brake signal.

[0103] The spring energy storage brake cylinder is filled with air by regulating the parking brake pressure at the spring energy storage interface depending on the electronic parking brake signal, and the wheel brakes (not further shown here) are released. Conversely, if the spring energy storage brake cylinder is deflated, that is, when the parking brake pressure drops below a minimum value, the spring energy storage brake cylinder compresses, and the wheels (here the rear wheels 394) are braked by the wheel brakes (not further shown).

[0104] This deflation of the spring energy storage brake cylinder can be carried out especially during a fault brake or an emergency brake. This situation occurs, for example, in case of a fault. In this case, the vehicle 300 can no longer move without problems because the spring energy storage brake cylinder is compressed and the filling of the parking brake valve unit is not possible due to the fault.

[0105] Here, the parking brake 380 is electrically connected to an energy supply unit 395 for supplying electrical energy. Here, the central control unit 389 is also electrically connected to the energy supply unit 395 for supplying electrical energy.

[0106] The brake system 310 has an emergency release unit 381, that is, an emergency release valve unit. The emergency release unit 381 is designed to supply an emergency release pressure to the parking brake 380, preferably to the parking brake valve unit.

[0107] The emergency release unit 381 is pneumatically connected to an additional brake pressure interface through a main interface 396 at which the emergency release pressure is regulated for supplying the emergency release pressure. The emergency release unit 381 is pneumatically connected to a brake supply unit 399 through a supply interface 398.

[0108] The parking brake valve unit and the first control unit, as shown here, are structurally integrated into the parking brake 380, in this case the parking brake module.

[0109] The braking system 310 further includes an interface unit 320. In the present embodiment, the interface unit 320 is supplied with electric energy by the energy supply unit 371. Alternatively, the interface unit 320 can also be supplied with electric energy by the energy supply unit 395. The interface unit 320 is connected to the emergency release unit 381 in a signal transmission manner.

[0110] The interface unit 320 (which can also be understood as a control unit or a wireless transmission unit) is connected to the active control unit 372 (for example, through a bus connection unit), and can at least control the vehicle after operating the actuator. In addition, the interface unit 320 is connected to the monitoring unit 330 (which preferably includes a virtual driver) in a signal transmission manner.

[0111] Figure 4 A schematic diagram is shown to illustrate the second braking system 410 in the vehicle 400 having a rescue operation unit 481 according to the present invention. Figure 4 The illustrated braking system 410 basically corresponds to Figure 3 the illustrated braking system. The braking system 410 particularly includes an interface unit 420, a central control unit 489, an axle modulator 488, a parking brake 480, an emergency release unit 481, and an actuator 482. In addition, the braking system has braking supply units 483, 484, and 485.

[0112] Different from the electro-pneumatic braking system 310, the electro-pneumatic braking system 410 includes an additional braking pressure supply unit 486 for supplying the rescue operation unit 481.

[0113] In addition, the emergency release unit 481 is designed to supply an emergency release pressure to the switching valve 487 (i.e., a height selection valve). The switching valve 487 is pre-tightened to the left in the illustrated figure. Through the switching valve 487, the spring energy storage brake cylinder can be directly filled with air by means of the emergency release unit 481 and thus released.

[0114] The interface unit 420 is connected to the emergency release unit 481 in a signal transmission manner.

[0115] Figure 5 A monostable valve 500 applied in a vehicle having a vehicle control system according to the present invention is shown. The valve 500 can be installed as an emergency release unit in the braking control system, for example Figure 3 or Figure 4 as shown.

[0116] Here, the monostable valve 500 has a two-way three-way changeover valve 510 in the form of a two-way three-way solenoid changeover valve. The two-way three-way changeover valve 510 has a first emergency release valve connection 511, which is pneumatically connected to the main connection 396 to provide emergency release pressure. The two-way three-way changeover valve 510 has a second emergency release valve connection 512, which is pneumatically connected to the supply connection 398 to receive supply pressure or pressure provided by an additional braking pressure supply unit. The two-way three-way changeover valve 510 has a third emergency release vent connection 513, which vents to the environment.

[0117] In the first emergency release valve position of the two-way three-way changeover valve 510, the first emergency release valve connection 511 is pneumatically connected to the second emergency release valve connection 512 so as to provide the braking pressure provided at the supply connection 398 as emergency release pressure to the main connection 396. In the second emergency release valve position, the first emergency release valve connection 511 is pneumatically connected to the emergency release vent connection 513, in particular in order to vent the main connection 396 and the connections pneumatically connected thereto.

[0118] By means of a valve control unit 530 (which can be assigned to a service braking system not shown here, for example the service braking system 311), an electronic emergency release signal can be provided at the electronic control connection 516 of the two-way three-way changeover valve 510 in order to switch the two-way three-way changeover valve 510 into the first emergency release valve position. In the unactuated state, that is to say when no electronic emergency release signal is present at the control connection 516, the two-way three-way changeover valve 510 is in the second emergency release valve position.

[0119] Figure 6 A bistable valve 600 is shown which is applied in a vehicle having a vehicle control system according to the invention. The valve 600 can be installed as an emergency release unit in a braking control system, for example Figure 3 or Figure 4 as shown.

[0120] Compared with Figure 5 the valve 500 shown, the bistable valve 600 has an emergency release pressure sensor 640, which is pneumatically connected to the main connection 396. It should be understood, however, that the emergency release pressure sensor 640 can also be used in Figure 5 embodiments. The emergency release pressure sensor 640 is designed to detect the emergency release pressure adjusted at the first emergency release valve connection 611 and to provide a corresponding electronic emergency release pressure signal depending on the detected emergency release pressure. Here, the emergency release pressure sensor 640 is connected in a signal-transmitting manner to another control unit 630 in order to provide the electronic emergency release pressure signal to the other control unit 630.

[0121] Furthermore, the valve 600 also has an emergency release pilot mechanism 650 and an emergency release main valve mechanism 660. The emergency release main valve mechanism has a main valve 610, which is exemplarily designed as a two-position three-way directional control valve here. The emergency release pilot mechanism 650 includes a pilot valve 670, which is arranged in the emergency release pilot path 651 and is designed as a two-position two-way directional control valve in the form of a two-position two-way solenoid-operated directional control valve here. The pilot valve 670 can be controlled by an electronic emergency release signal. The pneumatically switchable main valve 610 has a main valve control port 662, which is pneumatically connected to the emergency release pilot path 651 for receiving the emergency release pilot pressure. The pilot valve 670 is arranged between the supply port 398 and the main valve control port 662 in the emergency release pilot path 651.

[0122] In the first valve position of the pilot valve 670, a second pilot valve port 664, which is connected to the supply port 398 through another pilot valve 680 (which will be described later), is pneumatically connected to a first pilot valve port 665 connected to the main valve control port 662, so as to provide a supply pressure as the emergency release pilot pressure at the main valve control port 662. In the second valve position of the pilot valve 670, the supply port 398 is pneumatically separated from the main valve control port 662. The pilot valve 670 is designed to switch to the first valve position depending on the electronic emergency release signal.

[0123] The valve 600 additionally has a supply port 667, at which a reserve pressure pV is provided. The emergency release main valve mechanism 660 has a main path 668, which pneumatically connects the supply port 667 to the main port 396 and the main valve 610 is arranged in this main path. A first main valve port 612 is pneumatically connected to the main port 396 to provide the emergency release pressure. A second main valve port 612 is pneumatically connected to the supply port 667 to receive the reserve pressure pV. The main valve 610 includes a third main valve vent port 669, which vents to the environment.

[0124] In the first main valve position of the main valve 610, the first main valve port 611 is pneumatically connected to the second main valve port 612, and preferably, the main valve vent port 669 is shut off. Thus, in the first main valve position, the reserve pressure pV is provided as the emergency release pressure pN at the main port 396. In the second main valve position of the main valve 610, the first main valve port 611 is pneumatically connected to the main valve vent port 669, and preferably, the second main valve port 612 is shut off. Therefore, in the second main valve position, the supply port 667 is pneumatically separated from the main port 396.

[0125] The main valve 610 can be pneumatically controlled by the pilot valve 650 in such a way that when the emergency release pilot pressure pSN is regulated at the main valve control port 662 due to the pilot valve 650 being in its first valve position, the main valve 610 switches to the first main valve switching position.

[0126] The valve 600 also has a pneumatic self-holding path 672, which pneumatically connects the first main valve interface 611 with the main valve control interface 662. By means of the pneumatic self-holding path 672, it is advantageously possible to provide, at the main valve control interface 662, the emergency release pressure pN regulated at the first main valve interface 611 by the main valve 610 as the emergency release pilot pressure pSN, specifically, advantageously independently of the supply pressure provided at the supply interface 398. By means of the pneumatic self-holding path 672, it is advantageously possible to achieve that, when the reserve pressure pV is provided once, especially briefly, at the main valve control interface 662, the emergency release pressure pN is then continuously regulated at the main interface 396, even if the reserve pressure pV is no longer provided.

[0127] Furthermore, the valve 600 includes another pilot valve 680 in the form of a two-way three-way directional control valve (especially a two-way three-way solenoid directional control valve). The other pilot valve 680 and the pilot valve 670 are pneumatically arranged in series in the emergency release pilot path 651. The other pilot valve 680 is designed here in the form of a two-way three-way solenoid directional control valve and can be controlled by a first electronic emergency release signal. Different from the pilot valve 670, the other pilot valve 680 additionally has a bleed-off interface 674, which is pneumatically connected to the first pilot valve interface 665 in the first valve position.

[0128] The other pilot valve 680 has a first valve position, in which the other pilot valve 680 is pneumatically open, that is to say, pneumatically connects the main valve control interface 662 with the pilot valve 670. The other pilot valve 680 has a second valve position, in which the other pilot valve 680 pneumatically separates the main valve control interface 662 from the pilot valve 670.

[0129] By means of the emergency release pilot mechanism 650 shown here (which has the pilot valve 670 designed as a two-way two-way directional control valve and the other pilot valve 680), it is advantageously possible to bleed off the emergency release pilot pressure pSN present at the main valve control interface 662 in a controllable manner in order to end the regulation of the emergency release pressure pN at the main interface 396. For this purpose, the other pilot valve 680 is advantageously switched to the first valve position and the pilot valve 670 is switched to the second valve position, so that the main valve control interface 662 is bled off through the bleed-off interface 674.

[0130] The valve 600 supplied by means of the reserve pressure pV can advantageously achieve continuous regulation of the emergency release pressure pN, specifically, especially even if the reserve pressure pV is not present or no longer present at the supply interface 667.

[0131] Figure 7There is shown a system 700 having a solenoid valve 710 for application in vehicles 300, 400 having a vehicle control system 100, 200 according to the present invention.

[0132] The solenoid valve 710 is connected in a signal transmission manner to an interface unit 720, which can correspond, for example, to one of the interface units 120, 220, 320 or 420. In addition, the solenoid valve 710 is pneumatically connected to an actuator 730, which can correspond, for example, to the spring energy storage brake cylinder 382 or 482. By actuating the solenoid valve 710, the spring energy storage brake cylinder 382 or 482 is filled with air, and thereby the parking brake is released.

[0133] Figure 8 There is shown a schematic flow chart of a first embodiment of a method 800 for rescuing at least partially automated vehicles 300, 400 according to the present invention.

[0134] In a first step 810, at least a part of a first sub-unit of the vehicle control systems 100, 200 is detected as being faulty.

[0135] In a second step 820, it is checked whether the first sub-unit is in an emergency operation state. If the first sub-unit is in an emergency operation state, then step 830 follows step 820 as the next step. If the first sub-unit is not in an emergency operation state, then in step 821 the first sub-unit or the vehicle control systems 100, 200 are transferred to the emergency operation state.

[0136] In the next step 830, the vehicles 300, 400 are emergently controlled (MRM mode) by means of the vehicle control systems 100, 200 based on the emergency operation state.

[0137] In the next step 840, a release signal is received by means of the vehicle control systems 100, 200, and in the last step 850, based on the release signal, that is to say in the rescue mode or Rescue-Mode, the first sub-unit and / or the second sub-unit of the vehicle control systems 100, 200 are actuated.

[0138] The following are further considerations regarding the present invention.

[0139] The core of the invention is a specific rescue operation for an automated vehicle that has run aground, and this rescue operation is requested externally via a wireless interface (V2X, 5G, etc.). Here, the wireless interface should be protected accordingly against abuse and malfunctions (cybersecurity encryption and functional safety mechanism). The safety concept stipulates that, according to the invention, at least the malfunctioning / faulty functions or the safety rescue are monitored manually from the outside, and an emergency stop is executed in case of a fault. According to the invention, when the wireless connection is interrupted or a dedicated emergency stop signal is received, the rescue operation ends immediately. However, preferably, the emergency stop signal for the rescue operation can be an additional emergency stop signal and thus independent of the emergency stop signal of the primary automation. Thus, vehicle rescue can be ensured even when the emergency stop of the primary automation is defective.

[0140] Preferably, the control in the vehicle can be achieved directly via the wireless unit or via a rescue operation unit connected to the wireless unit.

[0141] According to the invention, in the above-mentioned rescue operation, at least one actuator on the vehicle is brought into the rescue operation state and thus vehicle rescue can be achieved. However, depending on the automation application, the fault situation and the rescue strategy, multiple actuators or actuator systems can also be switched to the corresponding rescue operation state.

[0142] In principle, two scenarios need to be distinguished:

[0143] In the first scenario, there is a rescue operation in which the automated vehicle is brought into an operating state in which it can be automatically towed by another rescue vehicle. Here, at least the parking brake is released, and if necessary, the drive train and / or the powertrain are disengaged. Additionally, other rescue operation states in other actuator subsystems are also conceivable.

[0144] In the second scenario, there is a rescue operation in which the automated vehicle is brought into an operating state in which the vehicle is operated into a safe area from the outside in emergency mode using the remaining residual availability and, if necessary, additional dynamic restrictions.

[0145] Preferably, the wireless connection and the control of the rescue operation state can be carried out via a separate power supply unit, and thus it is also fault-tolerant to the failure of the voltage supply in the vehicle. Examples of the corresponding emergency control of the parking brake are in Figure 3 and Figure 4This is shown in [reference]. Here, the parking brake is released by an emergency control unit. Here, the emergency control unit can either control a dedicated pneumatic port of the parking brake (such as an anti-recompression port or an emergency release port), or alternatively act directly on the spring accumulator via a height selection valve.

[0146] Depending on the required robustness / fail-safety, the emergency control unit can preferably be supplied by the pneumatic supply circuit of the parking brake or an independent supply circuit. In addition, the implementation of the monostable or bistable state of the emergency control unit is different (as shown in [references]). (At least in scenario 2), a monostable implementation is preferably selected because this can ensure re-emergency braking in case of a fault. Figure 5 and Figure 6 shown). Depending on the manifestation, one or more valves for controlling the emergency release pressure can be used. Another technical implementation for the emergency release of the parking brake is also shown in [reference]. Here, the spring of the spring accumulator is relaxed, for example, by a screw drive device, and the parking brake is released for the towing process.

[0147] Depending on the manifestation, one or more valves for controlling the emergency release pressure can be used. Another technical implementation for the emergency release of the parking brake is also shown in [reference]. Here, the spring of the spring accumulator is relaxed, for example, by a screw drive device, and the parking brake is released for the towing process. Figure 7 shown). Here, the spring of the spring accumulator is relaxed, for example, by a screw drive device, and the parking brake is released for the towing process.

[0148] Other examples of the rescue operation state for other actuator systems may be the rescue operation in an automatic control system, for example, which can implement the remote control of the actuator with dynamically limited operation when necessary (for example, when a single actuator system is defective, a safety mechanism is triggered, or the system state is untrustworthy). Additionally or alternatively, in the rescue operation of the engine control unit, the transmission can be switched to neutral, the drive train can be disengaged in the transmission, the driven train can be disengaged, and / or the power transmission can be interrupted at another location, for example, at the differential, etc.

[0149] Additionally or alternatively, in the rescue operation, the steering unit can include a torque-free steering system, a steering system locked in a determined position, and / or an electronic rescue operation of the steering device.

[0150] Additionally or alternatively, in the rescue operation, the brake unit can include a triggered safety mechanism.

[0151] Furthermore, preferably, the wireless unit or the rescue operation unit connected to the wireless unit includes a monitoring unit that detects and wirelessly transmits the remaining availability of the vehicle to the outside, for example, to the vehicle console, via a wireless interface.

[0152] Reference Signs (Part of the Specification)

[0153] 100, 200 Vehicle Control System

[0154] 110 Brake Control Unit

[0155] 111 First Sub-Unit

[0156] 112 Second sub-unit

[0157] 120, 220, 320, 420 Interface units

[0158] 121, 221 Release signals

[0159] 122, 222 Fault data

[0160] 123, 223 Control signals

[0161] 130 Transmission control unit

[0162] 140 Steering control unit

[0163] 150 Engine control unit

[0164] 160, 230, 330 Monitoring units

[0165] 170, 290 Sending units

[0166] 240 Emergency unit for automatic control

[0167] 250 Emergency emergency release type parking brake

[0168] 260 Emergency drive and engine control unit

[0169] 270 Emergency steering unit

[0170] 280 Emergency braking unit

[0171] 300, 400 Vehicles

[0172] 310, 410 Brake systems

[0173] 311 Service brake system

[0174] 312 Parking brake system

[0175] 320 Interface unit

[0176] 330 Monitoring unit

[0177] 371, 395 Energy supply department

[0178] 372 Active control department

[0179] 373, 399 Brake supply unit

[0180] 380, 480 Parking brakes

[0181] 381, 481 Emergency release units

[0182] 382 and 482 Actuators

[0183] 383 Service Brake Cylinder

[0184] 384 Front Wheels

[0185] 385 Combined Brake Cylinder

[0186] 386 Service Brake Chamber

[0187] 388 and 488 Axle Modulators

[0188] 389 and 489 Central Control Units

[0189] 394 Rear Wheels

[0190] 396 Main Interface

[0191] 398 Supply Interface

[0192] 483, 484, and 485 Brake Supply Units

[0193] 486 Additional Brake Pressure Supply Unit

[0194] 487 Change-Over Valve

[0195] 500 and 600 Valves

[0196] 510 and 610 Two-Way Three-Port Directional Control Valves

[0197] 511 First Emergency Release Valve Interface

[0198] 512 Second Emergency Release Valve Interface

[0199] 513 Third Emergency Release Bleed Interface

[0200] 516 Electronic Control Interface

[0201] 530 Valve Control Unit

[0202] 610 Main Valve

[0203] 611 First Main Valve Interface

[0204] 612 Second Main Valve Interface

[0205] 630 Another Control Unit

[0206] 640 Emergency Release Pressure Sensor

[0207] 650 Emergency Release Pilot Mechanism

[0208] 651 Emergency Release Pilot Path

[0209] 660 Emergency release main valve mechanism

[0210] 662 Main valve control interface

[0211] 664 Second pilot valve interface

[0212] 665 First pilot valve interface

[0213] 667 Supply interface

[0214] 668 Main path

[0215] 669 Main valve bleed interface

[0216] 670 Pilot valve

[0217] 672 Self-holding path

[0218] 674 Bleed interface

[0219] 680 Another pilot valve

[0220] 700 Solenoid valve system

[0221] 710 Solenoid valve

[0222] 720 Interface unit

[0223] 730 Actuator

[0224] 800 Method

[0225] 810 Detection step

[0226] 820 Inspection step

[0227] 821 Transfer step

[0228] 830 Emergency control step

[0229] 840 Receiving step

[0230] 850 Manipulation step

[0231] pN Emergency release pressure

[0232] pSN Emergency release pilot pressure

[0233] pV Reserve pressure

Claims

1. A method (800) for a vehicle (300, 400) that is at least partially automated for rescue, especially for a stranded vehicle, the vehicle having a vehicle control system (100, 200), wherein, The vehicle control system (100, 200) includes at least one first subunit (111) and a second subunit (112), wherein the method (800) has the following steps: Detect (810) that at least a part of the first subunit (111) of the vehicle control system (100, 200) has failed, Check (820) whether the first subunit (111) is in an emergency operation state, and if the first subunit (111) is not in an emergency operation state, transfer the first subunit (111) or the vehicle control system (100, 200) to an emergency operation state (821), Based on the emergency operation state, urgently control (830) the vehicle (300, 400) by means of the vehicle control system (100, 200), Receive (840) a release signal (121) through the vehicle control system (100, 200), and Based on the release signal (121), control (850) the first subunit (111) or the second subunit (112) of the vehicle control system (100, 200).

2. The method (800) according to claim 1, wherein, The failure prevents the vehicle (300, 400) from continuing to drive safely.

3. The method (800) according to claim 1 or 2, wherein, Based on the emergency operation state, urgently controlling (830) the vehicle (300, 400) includes stopping the vehicle (300, 400), especially an emergency stop.

4. The method (800) according to claim 3, wherein, The emergency stop includes engaging the parking brake and / or deactivating at least one part of the vehicle control system that is designed to at least partially automatically control the vehicle.

5. The method (800) according to any one of the preceding claims, wherein, Based on the release signal (121), controlling (850) the first subunit (111) or the second subunit (112) of the vehicle control system (100, 200) includes stopping, especially an emergency stop.

6. The method (800) according to any one of the preceding claims, wherein, The method (800) also has the following steps: After controlling (850) the first subunit (111) or the second subunit (121), based on the release signal (121), control the vehicle (300, 400) in a restricted operation mode, especially a dynamically restricted operation mode, compared to the normal operation mode of the vehicle (300, 400).

7. The method (800) according to claim 6, wherein, The method (800) also has the following steps: Monitor the communication connection between the vehicle (300, 400) and the sending unit that sends the release signal (121), and In the case where the connection between the vehicle (300, 400) and the sending unit is interrupted, end the control of the vehicle (300, 400).

8. The method (800) according to any one of the preceding claims, wherein, Controlling (850) the first subunit (111) or the second subunit (112) includes controlling at least one actuator (382, 482) of the respective first subunit (111) or second subunit (112).

9. The method (800) according to claim 7, wherein, Minimize the number of actuators (382, 482) being controlled.

10. The method (800) according to any one of the preceding claims, wherein, Receive the release signal (121) through V2X communication, especially wireless communication.

11. The method (800) according to any one of the preceding claims, wherein, The method (800) also has the following steps: After detecting (810) that at least a part of the first subunit (111) has failed, failure data (122) is provided and / or transmitted, where the failure data (122) is indicative of the failure.

12. The method (800) according to claim 11, wherein, The release signal (121) is based on the failure data (122).

13. The method (800) according to any one of the preceding claims, wherein, The method (800) further has the following steps: After controlling (850) the first subunit (111) or the second subunit (112), the vehicle (300, 400) is towed.

14. The method (800) according to any one of the preceding claims, wherein, Controlling (850) the first subunit (111) or the second subunit (112) includes controlling the parking brake (380, 480), where the parking brake (380, 480) is transferred to the released state by controlling based on the release signal (121).

15. The method (800) according to claim 12, wherein, Controlling the parking brake (380, 480) includes controlling the anti-recompense port, the emergency release port, the lift selector valve, and / or the screw drive device.

16. The method (800) according to claim 14 or 15, wherein, Controlling the parking brake (380, 480) includes controlling a monostable valve or a bistable valve.

17. The method according to any one of the preceding claims, wherein, Controlling the first subunit (111) or the second subunit (112) includes controlling the drive train and / or the transmission, where the drive train and / or the transmission are transferred to the disengaged state by controlling based on the release signal (121).

18. A vehicle control system (100, 200), the vehicle control system having - a brake control unit, - a transmission control unit, - a steering control unit, - an engine control unit, - a monitoring unit, and - an interface unit (120, 220, 320), wherein, The interface unit (120, 220, 320) is adapted to perform the method (800) according to any one of claims 1 to 17, and where the first subunit (111) and the second subunit (112) respectively correspond to one of the brake control unit, the transmission control unit, the steering control unit, the engine control unit, and the monitoring unit.

19. The vehicle control system (100, 200) according to claim 18, wherein, The interface unit (120, 220, 320) includes a power supply unit (390) additional to the power supply unit of the vehicle control system (100, 200).

20. The vehicle control system (100, 200) according to claim 18 or 19, wherein, The interface unit (120, 220, 320) further includes a rescue operation unit (481), where the rescue operation unit (481) is adapted to control the first subunit (111) or the second subunit (112) of the vehicle control system (100, 200) based on the release signal (121).

21. The vehicle control system (100, 200) according to any one of claims 18 to 20, wherein, The second subunit (112) includes an additional actuator emergency unit or an additional actuator, where the additional actuator emergency unit or the additional actuator is arranged to be additional to the actuator of the vehicle provided for the normal operation of the vehicle and is electrically independent of the actuator of the vehicle provided for the normal operation of the vehicle.

22. The vehicle control system (100, 200) according to any one of claims 18 to 20, wherein, The second subunit (112) includes a parking brake (380, 480), where the parking brake (380, 480) is transferred to the released state by controlling based on the release signal (121).

23. The vehicle control system (100, 200) according to claim 22, wherein, The parking brake (380, 480) includes a brake pressure supply unit (486) additional to the brake pressure supply units (483, 484, 485) of the brake control unit.

24. The vehicle control system (100, 200) according to claim 22 or 23, wherein, The parking brake (380, 480) includes an emergency release unit configured to be attached to a release unit of the parking brake.

25. The vehicle control system (100, 200) according to claim 24, wherein, The emergency release unit includes a solenoid valve, wherein the release of the parking brake corresponds to the release of the solenoid valve.

Images