Method for remotely controlling a motor vehicle

Abstract

Method for remotely controlling a motor vehicle, comprising the following steps: Receiving (101) motor vehicle setting signals representing a motor vehicle setting of a motor vehicle which wishes to enter a limited geographical area; Receiving (103) entry condition signals representing an entry condition which must be met in order for a motor vehicle to be allowed to enter the area.Checking (105) based on the vehicle setting whether the entry condition for the vehicle is met, generating (107) remote control signals for remotely controlling the vehicle based on a result of checking whether the entry condition is met, and outputting (109) the generated remote control signals, characterized in that the remote control signals include control signals for controlling a lateral and / or longitudinal guidance of the vehicle, in order to remotely control the lateral and / or longitudinal guidance of the vehicle when remotely controlling the vehicle based on the remote control signals, wherein, if the result indicates that the entry condition is not met, the control signals are generated such that, when remotely controlling the lateral and / or longitudinal guidance of the vehicle based on the generated remote control signals, the vehicle either does not enter the area or enters the area and stops in a predetermined area within the area.

Description

The invention relates to a method for remotely controlling a motor vehicle. The invention further relates to a device, a computer program, and a machine-readable storage medium. State of the art The patent application DE 10 2016 104 996 A1 discloses a device and a method for influencing an operating characteristic of a motor vehicle drive. Patent DE 10 2017 200 842 B4 discloses a method for operating a traffic control infrastructure. The subsequently published patent application DE 10 2018 130 757 A1 discloses a method for handling one or more vehicles that are produced or delivered with manipulated software of a drive system. The patent application DE 10 2015 014 150 A1 discloses a method for optimizing the operating behavior of a motor vehicle with an internal combustion engine. German patent application DE 10 2012 011 501 A1 discloses a method for operating a motor vehicle in which an access-controlled zone is detected, the entry to which depends on parameters of the motor vehicle. Parameters of the motor vehicle relevant for access to the zone are determined and transmitted to an authorization authority. The patent application DE 10 2009 002 385 A1 discloses a method for operating a motor vehicle, wherein the current location of the motor vehicle is determined and the motor vehicle is switched from a first operating mode to a second operating mode, provided that, based on the determined location, it is determined that the motor vehicle is entering an area for which an operating mode of the motor vehicle is specified. Publication GB 2390438 A1 describes a vehicle control system in which the location of a vehicle and associated restrictions are determined. The vehicle is controlled according to these restrictions. Currently, there are legal regulations that may prohibit motor vehicles from entering a city or a specific area within a city. One reason for this is, for example, emissions regulations. Such a ban is implemented, for example, by signs indicating that entry into a specific area or into the city is prohibited for motor vehicles. Police checks may be carried out to monitor compliance with the ban. Patent DE 10 2007 053 406 B3 discloses a method and a device for carrying out an adaptation and a diagnosis of emission-relevant control devices in a vehicle. The patent application DE 10 2010 003 502 A1 discloses a method for operating a vehicle that can be operated without emissions. The patent application DE 10 2014 006 319 A1 discloses a system for assessing and / or optimizing the operating behavior of a vehicle. Disclosure of the invention The object underlying the invention is to provide an efficient concept that makes it possible to efficiently control or steer whether a motor vehicle can enter a limited geographical area for which an entry condition applies. This problem is solved by means of the respective subject matter of the independent claims. Advantageous embodiments of the invention are the subject matter of dependent claims. Following a first aspect, a method for remotely controlling a motor vehicle is provided, comprising the following steps: Receiving vehicle setting signals, which represent the vehicle setting of a motor vehicle that intends to enter a limited geographical area; Receiving entry condition signals, which represent an entry condition that must be met for a motor vehicle to be allowed to enter the area; Checking, based on the vehicle setting, whether the entry condition for the motor vehicle is met; Generating remote control signals for remotely controlling the motor vehicle based on the result of checking whether the entry condition is met; and Outputting the generated remote control signals. According to a second aspect, a device is provided which is set up to carry out all steps of the procedure according to the first aspect. According to a third aspect, a computer program is provided which includes instructions that, when the computer program is executed by a computer, for example by the device according to the second aspect, cause it to execute a procedure according to the first aspect. According to a fourth aspect, a machine-readable storage medium is provided on which the computer program is stored according to the third aspect. The invention is based on the understanding and includes the fact that the above problem can be solved by assuming remote control of the vehicle when a vehicle setting results in the vehicle's entry condition not being met – particularly even while the vehicle is in motion. This means, in particular, that the vehicle is remotely controlled or steered when the vehicle's entry condition is not met. This provides the technical advantage, for example, of efficiently controlling whether or not a vehicle enters the area. In particular, it allows for the efficient prevention of a vehicle entering the area. Thus, the particular technical advantage is achieved by providing a concept that efficiently enables the remote exercise of control over the entry of motor vehicles into a limited geographical area for which an entry condition applies. According to the invention, the remote control signals include control signals for controlling the lateral and / or longitudinal guidance of the motor vehicle, in order to remotely control the lateral and / or longitudinal guidance of the motor vehicle based on the remote control signals. This results, for example, in the technical advantage that the vehicle can be efficiently remotely controlled. In particular, this results in the technical advantage that the vehicle can be efficiently controlled remotely. In the event that the remote control signals include control signals for controlling the lateral or longitudinal guidance of the motor vehicle, one embodiment provides that the corresponding other guidance, i.e., the longitudinal guidance or the lateral guidance, is either manually controlled by the driver (which can then be referred to in particular as assisted guidance) or is at least partially automated in order to guide the motor vehicle at least partially automatically. Assisted driving means that the driver of the vehicle is permanently responsible for either the lateral or longitudinal control of the vehicle. The other driving task (i.e., controlling the longitudinal or lateral movement of the vehicle) is performed automatically and remotely. In other words, with assisted driving, either the lateral or longitudinal control of the vehicle is handled automatically and remotely. The phrase "at least partially automated management" includes one or more of the following cases: partially automated management, highly automated management, fully automated management. Partially automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings) and / or for a certain period of time, the longitudinal and lateral control of the vehicle is automatically controlled remotely. The driver does not need to manually control the longitudinal and lateral control of the vehicle. However, the driver must continuously monitor the automatic remote control of the longitudinal and lateral control in order to be able to intervene manually if necessary. The driver must be ready to take over full control of the vehicle at any time. Highly automated driving means that, for a certain period of time in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automatically controlled remotely. The driver does not need to manually control the vehicle's longitudinal and lateral control. The driver does not need to constantly monitor the automated remote control of longitudinal and lateral control in order to intervene manually if necessary. If required, a takeover request is automatically issued to the driver to assume control of longitudinal and lateral control, specifically with a sufficient time buffer. Therefore, the driver must be potentially capable of taking over control of longitudinal and lateral control.The limits of automatic remote control of lateral and longitudinal guidance are automatically detected. With highly automated guidance, it is not possible to automatically create a risk-minimizing state in every initial situation. Fully automated driving means that in a specific situation (for example: driving on a highway, driving within a parking lot, overtaking an object, driving within a lane defined by lane markings), the longitudinal and lateral control of the vehicle is automatically controlled remotely. The driver does not need to manually control the vehicle's longitudinal and lateral stability. The driver does not need to monitor the automatic remote control of longitudinal and lateral stability in order to intervene manually if necessary. Before the automatic remote control of longitudinal and lateral stability ends, the driver is automatically prompted to take over the driving task (controlling the vehicle's longitudinal and lateral stability), with sufficient time to do so. If the driver does not take over the driving task, the system automatically returns to a low-risk state.The limits of automatic control of lateral and longitudinal guidance are automatically detected. In all situations, it is possible to automatically return to a system state with minimal risk. According to the invention, if the result indicates that the entry condition is not met, the control signals are generated in such a way that, when the lateral and / or longitudinal guidance of the motor vehicle is remotely controlled based on the generated remote control signals, the motor vehicle either does not enter the area or enters the area and stops in a predetermined area within the area. This provides, for example, the technical advantage of efficiently preventing vehicles from entering the area. In particular, it provides the technical advantage of efficiently ensuring that vehicles only travel up to the predetermined area within the zone. According to one embodiment, if the result indicates that the break-in condition is not met, an adapted vehicle setting is determined based on the break-in condition and the vehicle setting such that a check based on the adapted vehicle setting to see if the break-in condition is met shows that the break-in condition is met, wherein the remote control signals include adaptation signals representing the adapted vehicle setting in order to remotely adjust the vehicle setting based on the adapted vehicle setting. This results in the technical advantage, for example, that the vehicle settings can be efficiently adjusted remotely. In particular, this results in the technical advantage that the vehicle is placed in a state where it meets the entry requirements based on the adjusted vehicle settings. Thus, the vehicle can then, for example, enter the area. This means, in particular, that after adjusting the vehicle settings based on the adjusted vehicle settings, entry into the area is permitted for the vehicle. In one embodiment, it is provided that if the adjustment of the vehicle setting is prevented or if there is an unauthorized re-adjustment (i.e., an unauthorized reversal) of the adjusted vehicle setting, then the remote control signals include the control signals for controlling the lateral and / or longitudinal guidance of the vehicle. According to one embodiment, it is provided that environmental signals are received which represent an environment of the motor vehicle, wherein the remote control signals, in particular the control signals, are generated based on the environment. This results, for example, in the technical advantage that the remote control signals, especially the control signals, can be generated efficiently. In particular, this results in the technical advantage that the vehicle's environment can be efficiently taken into account when generating the remote control signals, especially the control signals. According to one embodiment, it is provided that, based on the vehicle's surroundings, a check is performed to determine whether the current traffic situation permits remote control of the vehicle. In particular, it is provided that the control signals are generated or output based on the result of this check. For example, remote control of the motor vehicle will be avoided if the current traffic situation does not permit remote control. This can, for example, achieve the technical advantage that other road users in the vicinity of the motor vehicle are not endangered or injured. According to one embodiment, it is provided that safety condition signals are received, which represent at least one safety condition that must be fulfilled in order for the motor vehicle to be remotely controlled, whereby it is checked whether the at least one safety condition is fulfilled, wherein the remote control signals are generated based on a result of checking whether the at least one safety condition is fulfilled. This results, for example, in the technical advantage that remote control signals can be generated efficiently. In particular, it provides the technical advantage of efficiently ensuring that certain prerequisites, in this case the safety condition, are met for remote control of the vehicle. Thus, the specific technical advantage is that, if the safety condition is met, then remote control of the vehicle is safely possible. According to one embodiment, the at least one safety condition is selected from the following groups of safety conditions: the presence of a predetermined Safety Integrity Level (SIL or Automotive Safety Integrity Level ASIL) of at least the motor vehicle and infrastructure, in particular including a communication link and / or communication components (e.g., communication interface), for remotely controlling a motor vehicle (especially with regard to the overall systems in the motor vehicle and infrastructure, and in particular parts; e.g., components, algorithms, interfaces, etc.); the presence of a maximum latency of communication between the motor vehicle and a remote control device for remotely controlling the motor vehicle based on the remote control signals.The existence of a predetermined level of computer protection for a device to perform the steps of the procedure according to the first aspect; the existence of predetermined components and / or algorithms and / or communication capabilities used to perform the steps of the procedure according to the first aspect; the existence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication capabilities used to perform the steps of the procedure according to the first aspect; the existence of predetermined availability information indicating the availability of predetermined components and / or algorithms and / or communication capabilities; the existence of predetermined quality criteria for the predetermined components and / or algorithms and / or communication capabilities; and the existence of a plan.which includes measures to reduce errors and / or measures in case of failure of predetermined components and / or algorithms and / or communication options and / or measures for misanalysis and / or measures in case of misinterpretations, the existence of one or more fallback scenarios, the existence of a predetermined function, the existence of a predetermined traffic situation, the existence of predetermined weather, the maximum possible time for each execution of one or more steps of the procedure according to the first aspect, and the existence of a test result that elements or functions used to execute the procedure according to the first aspect are currently functioning without errors. A communication link is, for example, a communication link between the device described in the second aspect and the motor vehicle. A communication link comprises, for example, one or more communication channels. In one embodiment, a component used to carry out the method according to the first aspect is an element selected from the following group of components: environment sensor, motor vehicle, infrastructure, remote control device, device according to the second aspect, motor vehicle system, in particular drive system, clutch system, brake system, driver assistance system, communication interface of the motor vehicle or the infrastructure, processor, input, output of the device according to the second aspect. In one embodiment, a function used to execute the method according to the first aspect is an element selected from the following group of functions: remote control function, communication function between the motor vehicle and the infrastructure or the remote control device, evaluation function of environmental sensor data from an environmental sensor, planning function, in particular journey planning function, traffic analysis function, emission analysis function. A computer protection level is defined in particular as follows: an activated firewall and / or a valid encryption certificate for encrypting communication between the motor vehicle and the infrastructure or the remote control device and / or an activated virus program with current virus signatures and / or the presence of protection, in particular mechanical protection, in particular burglary protection, of the computer, in particular the device according to the second aspect, or the remote control device and / or the presence of a means of verification that signals, in particular remote control signals or environmental signals, were transmitted correctly, i.e., without errors. An algorithm, for example, includes the computer program according to the third aspect. By specifically checking that redundancy and / or diversity exists in predetermined components and / or algorithms and / or communication options, the technical advantage is achieved, for example, that if the corresponding component, such as a computer, or the corresponding algorithm or communication option fails, a safe function can still be executed. To ensure the accuracy of results, one embodiment allows, for example, the calculation to be performed multiple times and the corresponding results to be compared. Only if the results match is it determined that the results are correct. If an odd number occurs multiple times, it can be stipulated, for example, that the result with the highest number of identical results is considered correct. Remote control signals, for example, are only generated if it can be determined that the result is correct. In one embodiment, it is provided that the remote control signals are only generated if at least one safety condition is met. In one embodiment, it is provided that the check to see whether at least one safety condition is met is carried out before and / or after and / or during one or more predetermined process steps. In particular, this provides the technical advantage of efficiently ensuring that certain prerequisites, namely the safety condition, for remote control of the motor vehicle are met before, after, and / or during the execution of the relevant procedural steps. Thus, the specific technical advantage is that, if the safety condition is met, remote control of the motor vehicle is then safely possible. In one embodiment, it is provided that after the remote control signals are issued, remote control of the motor vehicle is checked based on the issued remote control signals in order to detect a fault, wherein, if a fault is detected, the remote control is aborted or emergency remote control signals are generated and issued for remote control of the motor vehicle in an emergency. According to one embodiment, the emergency remote control signals include emergency control signals for remotely controlling the lateral and / or longitudinal guidance of the motor vehicle. The emergency control signals are such that, for example, when the lateral and / or longitudinal guidance of the motor vehicle is remotely controlled based on the emergency control signals, the motor vehicle is brought to a safe state, in particular, it is stopped. Statements made in connection with remote control signals, in particular with control signals, apply analogously to emergency remote control signals, in particular emergency control signals, and vice versa. According to one embodiment, the entry condition specifies a maximum pollutant emission limit value which a motor vehicle's pollutant emission must not exceed in order for the motor vehicle to be allowed to enter the area, wherein checking whether the entry condition is met includes checking whether a pollutant emission from the motor vehicle exceeds the maximum pollutant emission limit value. This results, for example, in the technical advantage that only motor vehicles whose pollutant emissions do not exceed the maximum pollutant emission limit can enter the area. For example, according to one embodiment, the pollutant emissions of the motor vehicle are determined based on the vehicle settings and / or from a database. Determining the pollutant emissions may, in particular, include estimating the pollutant emissions. The maximum pollutant emission limit can, for example, be zero. This means, in particular, that motor vehicles within the area must have zero pollutant emissions. This can generally only be achieved by motor vehicles with an electric drive, whereby the vehicle is powered exclusively by its electric drive. Specifically, this requires that the vehicle's internal combustion engine be switched off, or in this case, remotely switched off, before the vehicle enters the area. According to one embodiment, the vehicle setting includes one or more elements selected from the following group of vehicle setting parameters: internal combustion engine setting, in particular injection parameters, of an internal combustion engine of the vehicle, operating state of an electric motor of the vehicle. This results, for example, in the technical advantage of using particularly suitable vehicle setting parameters. The operating state of an electric motor indicates, for example, whether the electric motor is switched on or off. The operating state of a motor vehicle's electric motor indicates, for example, whether the electric motor is powering the vehicle or not. According to one embodiment, if the result indicates that the entry condition is not met, an operating restriction is determined based on the entry condition, such that a check based on the operating restriction to see if the entry condition is met shows that the entry condition is met, wherein the remote control signals include restriction signals representing the operating restriction in order to remotely restrict the operation of the vehicle based on the operating restriction. This results, for example, in the technical advantage that the operation of the motor vehicle can be efficiently restricted remotely. In particular, this provides the technical advantage that, after the operating restriction, the motor vehicle fulfills the entry condition, so that entry into the area can subsequently be permitted for the motor vehicle. According to one embodiment, the operating restriction specifies a maximum vehicle speed and / or a maximum vehicle acceleration. This results, for example, in the technical advantage of efficiently limiting vehicle emissions. Lower vehicle speed and lower vehicle acceleration generally lead to lower vehicle emissions. According to one embodiment, it is provided that one or more process steps, with the exception of the steps of generating and outputting the remote control signals, are carried out internally within the vehicle and / or wherein one or more process steps are carried out externally within the vehicle, in particular in an infrastructure, preferably in a cloud infrastructure. This results, for example, in the technical advantage that the relevant process steps can be carried out efficiently and redundantly. This can be particularly advantageous in further increasing safety. According to one embodiment, it is provided that one or more process steps are documented, in particular documented in a blockchain. This results, for example, in the technical advantage that the process can be analyzed retrospectively after it has been carried out or executed, due to the documentation. Documenting in a blockchain offers the particular technical advantage that the documentation is tamper-proof and forgery-proof. A blockchain (also called a block chain) is, in particular, a continuously expanding list of data records, called "blocks," that are linked together using one or more cryptographic methods. Each block contains, in particular, a cryptographically secure hash (value) of the previous block, a timestamp, and transaction data. According to one embodiment, the method according to the first aspect is a computer-implemented method. According to one embodiment, the method according to the first aspect is carried out or performed by means of the device according to the second aspect. Device features are derived analogously from corresponding process features, and vice versa. This means, in particular, that the technical functions of the device according to the second aspect are derived analogously from corresponding technical functionalities of the process according to the first aspect, and vice versa. The phrase “at least one” specifically means “one or more”. The abbreviation "bzw." stands for "beziehungsweise", which in particular stands for "respective". The phrase “respective” stands in particular for “and / or”. Exemplary embodiments of the invention are shown in the drawings and explained in more detail in the following description. Figure 1 shows a flowchart of a method for remotely controlling a motor vehicle, Figure 2 shows a device, and Figure 3 shows a machine-readable storage medium. Fig. 1 shows a flowchart of a method for remotely controlling a motor vehicle, comprising the following steps: Receiving 101 vehicle setting signals, which represent a vehicle setting of a motor vehicle that intends to enter a limited geographical area; Receiving 103 entry condition signals, which represent an entry condition that must be met for a motor vehicle to be allowed to enter the area; Checking 105, based on the vehicle setting, whether the entry condition for the motor vehicle is met; Generating 107 remote control signals for remotely controlling the motor vehicle based on the result of checking whether the entry condition is met; and Outputting 109 the generated remote control signals. The result of test 105 indicates, for example, whether the entry condition is met or not met. In one embodiment, it is provided that the remote control signals are only generated if the result indicates that the entry condition is not met. In one embodiment, it is provided that the remote control signals are only generated if the result indicates that the entry condition is not met, and if at least one safety condition is met. According to one embodiment, it is provided that when the motor vehicle arrives at a boundary of the geographical area, the step of checking, based on the motor vehicle settings, whether the entry condition for the motor vehicle is met is carried out. This means, in particular, that the step of checking is carried out in response to an arrival at the area boundary or the boundary of the territory. If the test result indicates that the vehicle's entry requirements are not met, one or more actions are executed, in particular, the vehicle's operation is intervened. Generally, the vehicle is remotely controlled. According to one embodiment, boundary environment signals are received, which represent a boundary environment of a boundary of the geographical area. According to one embodiment, the boundary environment signals are processed to detect an approaching motor vehicle that intends to enter the geographical area. According to one embodiment, upon detection of an approaching motor vehicle, the step of checking whether the entry condition for the motor vehicle is met is executed. Another embodiment provides that upon detection of an approaching motor vehicle intending to enter the geographical area, the step(s) of receiving motor vehicle setting signals or entry condition signals are executed. According to one embodiment, it is provided that position signals are received which represent the position of a motor vehicle that wants to enter the geographical area. According to one embodiment, it is provided that upon detection of an approaching motor vehicle intending to enter the geographical area, the step(s) of receiving motor vehicle setting signals or entry condition signals are executed. According to one embodiment, it is provided that position signals are received which represent the position of a motor vehicle which intends to enter the geographical area. For example, the vehicle transmits position signals. This allows the vehicle to be detected efficiently and advantageously. Fig. 2 shows a device 201. The device 201 is set up to perform all steps of the procedure according to the first aspect. The device 201 includes an input 203, which is configured to receive the vehicle setting signals and the entry condition signals. The device 201 further comprises a processor 205, which is configured to check, based on the vehicle settings, whether the entry condition for the vehicle is met. The processor 205 is further configured to generate remote control signals for remotely controlling the vehicle based on the result of checking whether the entry condition is met. The device 201 further includes an output 207, which is configured to output the generated remote control signals. For example, according to one embodiment, outputting the generated remote control signals includes sending the remote control signals to the motor vehicle via a communication network, in particular via a wireless communication network. According to one embodiment, the method according to the first aspect comprises remote control of the motor vehicle based on the generated remote control signals. Generally, signals are received via input 203. Input 203 is therefore specifically configured to receive the corresponding signals. Generally, signals that are output are output via output 207. Output 207 is therefore specifically configured to output the corresponding signals. According to one embodiment, several processors are provided instead of the single processor 205. According to one embodiment, the processor 205 is configured to perform the generation and testing steps described above and / or below. In one embodiment, it is provided that one or more process steps, with the exception of the steps of generating and outputting the remote control signals, are carried out internally within the vehicle and / or wherein one or more process steps are carried out externally within the vehicle, in particular in an infrastructure, preferably in a cloud infrastructure. Device 201 is, for example, part of an infrastructure, in particular cloud infrastructure, or of a motor vehicle. For a redundant execution of the corresponding process steps, it can be provided according to one embodiment that several devices 201 are provided, so that, for example, both the motor vehicle and the infrastructure, in particular the cloud infrastructure, comprise a device 201. Fig. 3 shows a machine-readable storage medium 301. A computer program 303 is stored on the machine-readable storage medium 301, which includes instructions that, when the computer program 303 is executed by a computer, cause it to perform a procedure according to the first aspect. According to one embodiment, the device 201 comprises a remote control device which is configured to remotely control the motor vehicle based on the generated remote control signals. According to one embodiment, an infrastructure or infrastructure system is provided, which, for example, includes the device according to the second aspect. For example, the infrastructure is designed to monitor the geographical area, and in particular to monitor motor vehicles attempting to enter it. According to one embodiment, this monitoring is achieved using one or more environmental sensors, which are spatially distributed around the boundary of the geographical area. An environmental sensor is, for example, one of the following environmental sensors: radar sensor, lidar sensor, video sensor, ultrasonic sensor, magnetic field sensor and infrared sensor. According to one embodiment, the infrastructure system is an emissions infrastructure system. Such a system monitors, in particular, compliance with emission limits within the geographical area. The following is an exemplary scenario in which the concept described here is used: According to one embodiment, a motor vehicle approaches the boundary of a limited geographical area for which an entry condition exists. This means that, in order for a motor vehicle to be allowed to enter the area, the entry condition must be met. According to one embodiment, the motor vehicle is connected to the infrastructure, in particular to the emission infrastructure system, via communication technology, or is automatically connected to the system or infrastructure in front of the area, in particular automatically via communication technology. According to one embodiment, the motor vehicle emits a signal, in particular a position signal, and can thereby be detected. According to one embodiment, the motor vehicle is detected, in particular by the infrastructure, for example by visual methods such as license plate recognition. According to one embodiment, the infrastructure, the specifications (entry conditions) and the motor vehicle or a motor vehicle setting of the motor vehicle are analyzed. For this purpose, for example, the vehicle settings can be sent from the vehicle and / or retrieved from the vehicle. This means, in particular, that request signals are generated and output, which represent a request to the vehicle after the vehicle setting has been changed. In one embodiment, the vehicle settings are compared with data from a cloud system to prevent misuse. Data from the cloud system, which can also be referred to as a cloud infrastructure, includes, for example, vehicle data and / or those vehicle settings that can be changed or adjusted. According to one embodiment, it is provided that it is checked whether the entry condition for the motor vehicle is met, whereby the check is carried out or performed based on the motor vehicle setting. If a test result indicates that the break-in condition is not met, one or more of the following actions are performed according to one embodiment: According to one embodiment, the vehicle settings are changed to match the break-in condition. In other words, according to one embodiment, the vehicle settings are adjusted so that checking whether the break-in condition is met, based on the adjusted vehicle settings, shows that the break-in condition is met. Adjusting or changing the vehicle settings includes, for example, switching a hybrid vehicle to pure electric drive. According to one embodiment, the adjustment or modification involves setting or adapting the internal combustion engine of a motor vehicle so that it only permits certain pollutant emissions that comply with specifications, i.e., fulfill the break-in conditions. For example, injection parameters are adjusted. For example, a maximum speed is specified for the motor vehicle. For example, a maximum acceleration is specified for the motor vehicle. According to one embodiment, such an action includes preventing the motor vehicle from entering the area. This is achieved in particular by generating and outputting appropriate control signals for at least partially automated control of the motor vehicle's lateral and longitudinal guidance. For example, the vehicle will only be permitted to drive to a parking space or side area within the zone. This is achieved in particular by generating and outputting appropriate control signals for at least partially automated control of the vehicle's lateral and / or longitudinal steering. According to one embodiment, it is checked whether a current traffic situation allows intervention, in particular remote control, to prevent, for example, other road users in the vicinity of the motor vehicle from being injured. According to one embodiment, the process, i.e., the procedure, in other words the process steps, is documented in a tamper-proof and traceable manner, for example, in a blockchain. According to one embodiment, it is provided that a driver of the motor vehicle is informed that an intervention in the driving operation of the motor vehicle has taken place or is taking place, i.e. that the motor vehicle has been or is being remotely controlled. This means, in particular, that communication signals are generated and output, representing a corresponding message. For example, these communication signals are output to a human-machine interface of the vehicle, so that the driver is informed about the intervention or remote control based on these signals. According to one embodiment, it is provided that the intervention or remote control of the motor vehicle is reported to an authority so that it can, for example, initiate further steps. According to one embodiment, a prerequisite for remote control, or rather for intervention, is that the remote control is secure. In this context, "secure" means specifically "safe" and "secure." While these two English terms are usually translated into German as "sicher," they have somewhat different meanings in English. The term "safe" refers specifically to the topic of accidents and accident prevention. Remote control, which defines "safe," ensures that the probability of an accident or collision is less than or equal to a predetermined probability threshold. The term "secure" is specifically directed towards the topic of computer protection or hacker protection, i.e., how secure a (computer) infrastructure and / or a communication infrastructure, in particular a communication link between a motor vehicle and a remote control device for remotely controlling a motor vehicle, is against unauthorized access or data manipulation by third parties ("hackers"). Remote control, which is therefore "secure", is based in particular on adequate and sufficient computer protection or hacker protection. For example, according to one embodiment, it is verified whether the entirety of the motor vehicle and the infrastructure involved in the procedure according to the first aspect, including communication between the infrastructure and the motor vehicle, is currently secure for the concept of "intervention in the motor vehicle for critical actions" described here. This means, in particular, that the motor vehicle and / or a local and / or global infrastructure and / or communication are checked accordingly. The remote control signals are generated, in particular, based on the result of this check. This means, in particular, that the components used in the execution of the procedure according to the first aspect are checked for safety, i.e., whether they meet certain safety conditions, before the intervention in the driving operation is carried out, i.e., before the motor vehicle is remotely controlled. Important or dependent criteria include, for example, one or more of the safety conditions described above. According to one embodiment, it is provided that, firstly, the entire system (motor vehicle, infrastructure, communication link, cloud ...) is checked with regard to the safety condition. According to one embodiment, it is provided that the individual parts are also checked to ensure they meet the safety requirements. This is done in particular before the motor vehicle is remotely controlled. The verification step(s) are carried out in one embodiment inside the motor vehicle and / or outside the motor vehicle, in particular in an infrastructure. In one embodiment, the verification step(s) are subsequently checked, i.e., at a later time, for example, regularly. For instance, the verification step(s) are subsequently checked at a predetermined frequency, for example, every 100 ms. For example, according to one embodiment, this verification, i.e., checking whether at least one safety condition is met, takes place before and / or after and / or during one or more predetermined process steps. According to one embodiment, the checking process is carried out or performed in case of problems.

Claims

Method for remotely controlling a motor vehicle, comprising the following steps: Receiving (101) motor vehicle setting signals representing a motor vehicle setting of a motor vehicle which wishes to enter a limited geographical area; Receiving (103) entry condition signals representing an entry condition which must be met in order for a motor vehicle to be allowed to enter the area.Checking (105) based on the vehicle setting whether the entry condition for the vehicle is met, generating (107) remote control signals for remotely controlling the vehicle based on a result of checking whether the entry condition is met, and outputting (109) the generated remote control signals, characterized in that the remote control signals include control signals for controlling a lateral and / or longitudinal guidance of the vehicle in order to remotely control the lateral and / or longitudinal guidance of the vehicle when remotely controlling the vehicle based on the remote control signals, wherein, if the result indicates that the entry condition is not met, the control signals are generated such that, when remotely controlling the lateral and / or longitudinal guidance of the vehicle based on the generated remote control signals, the vehicle either does not enter the area or enters the area and stops in a predetermined area within the area. Method according to one of the preceding claims, wherein, if the result indicates that the break-in condition is not met, an adapted vehicle setting is determined based on the break-in condition and the vehicle setting such that a check based on the adapted vehicle setting to see if the break-in condition is met shows that the break-in condition is met, wherein the remote control signals include adaptation signals representing the adapted vehicle setting in order to remotely adjust the vehicle setting of the vehicle based on the adapted vehicle setting. Method according to one of the preceding claims, wherein environmental signals are received which represent an environment of the motor vehicle, wherein the remote control signals are generated based on the environment. Method according to one of the preceding claims, wherein safety condition signals are received which represent at least one safety condition which must be fulfilled in order for the motor vehicle to be remotely controlled, wherein it is checked whether the at least one safety condition is fulfilled, wherein the remote control signals are generated based on a result of checking whether the at least one safety condition is fulfilled. The method of claim 4, wherein the at least one safety condition is selected from the following groups of safety conditions: the presence of a predetermined Safety Integrity Level (SIL) or Automotive Safety Integrity Level (ASIL) of at least the motor vehicle and an infrastructure, in particular including a communication link and / or communication components, for remotely controlling a motor vehicle (particularly with respect to the overall systems in the motor vehicle and infrastructure, and in particular parts; e.g., components, algorithms, interfaces, etc.); the presence of a maximum latency of communication between the motor vehicle and a remote control device for remotely controlling the motor vehicle based on the remote control signals; the presence of a predetermined computer protection level of a device for performing the steps of the method according to any of the preceding claims.The existence of predetermined components and / or algorithms and / or communication capabilities used to execute the steps of the method according to one of the preceding claims; the existence of redundancy and / or diversity in predetermined components and / or algorithms and / or communication capabilities used to execute the steps of the method according to one of the preceding claims; the existence of predetermined availability information indicating the availability of predetermined components and / or algorithms and / or communication capabilities; the existence of predetermined quality criteria for the predetermined components and / or algorithms and / or communication capabilities; and the existence of a plan.which includes measures for reducing errors and / or measures in case of failure of predetermined components and / or algorithms and / or communication possibilities and / or measures for misanalysis and / or measures in case of misinterpretation, the existence of one or more fallback scenarios, the existence of a predetermined function, the existence of a predetermined traffic situation, the existence of predetermined weather, the maximum possible time for a respective execution of one or more steps of the method according to one of the preceding claims, and the existence of a test result that elements or functions used to execute the method according to one of the preceding claims are currently functioning without errors. Method according to claim 4 or 5, wherein the remote control signals are only generated if at least one safety condition is met. Method according to one of claims 4 to 6, wherein the checking to see if at least one safety condition is met is carried out before and / or after and / or during one or more predetermined method steps. Method according to one of the preceding claims, wherein, after outputting the remote control signals, remote control of the motor vehicle is checked based on the output remote control signals in order to detect a fault, wherein, upon detection of a fault, the remote control is aborted or emergency remote control signals are generated and output for remote control of the motor vehicle in an emergency. Method according to one of the preceding claims, wherein boundary environment signals are received which represent a boundary environment of a boundary of the geographical area, wherein the boundary environment signals are processed to detect an approaching motor vehicle which intends to enter the geographical area, wherein upon detection of an approaching motor vehicle, the step of checking whether the entry condition for the motor vehicle is met is performed, and / or the step(s) of receiving motor vehicle setting signals or entry condition signals are performed. A method according to any of the preceding claims, wherein it is verified whether an assembly consisting of a motor vehicle and infrastructure involved in the method according to any of the preceding claims, including communication between infrastructure and motor vehicle, is secure, such that the motor vehicle and / or a local and / or a global infrastructure and / or communication between motor vehicle and infrastructure are checked accordingly. Method according to one of the preceding claims, wherein the entry condition specifies a maximum pollutant emission limit value which a pollutant emission of a motor vehicle may not exceed in order for the motor vehicle to be allowed to enter the area, wherein checking whether the entry condition is met includes checking whether a pollutant emission of the motor vehicle exceeds the maximum pollutant emission limit value. Method according to one of the preceding claims, wherein the motor vehicle setting comprises one or more elements selected from the following group of motor vehicle setting parameters: internal combustion engine setting, in particular injection parameters, of an internal combustion engine of the motor vehicle, operating state of an electric motor of the motor vehicle. A method according to any of the preceding claims, wherein, if the result indicates that the entry condition is not met, an operating restriction for a limitation of the operation of the motor vehicle is determined based on the entry condition such that a check based on the operating restriction as to whether the entry condition is met shows that the entry condition is met, wherein the remote control signals include restriction signals which represent the operating restriction in order to remotely restrict the operation of the motor vehicle based on the operating restriction. Method according to claim 13, wherein the operating restriction specifies a maximum motor vehicle speed and / or a maximum motor vehicle acceleration. Method according to one of the preceding claims, wherein one or more method steps, except for the steps of generating and outputting the remote control signals, are carried out internally within the motor vehicle and / or wherein one or more method steps are carried out externally within the motor vehicle, in particular in an infrastructure, preferably in a cloud infrastructure. Method according to one of the preceding claims, wherein one or more method steps are documented, in particular documented in a blockchain. Device (201) which is configured to perform all steps of the method according to any of the preceding claims. Computer program (303), comprising instructions which, when the computer program (303) is executed by a computer, cause it to execute a method according to any one of claims 1 to 16. Machine-readable storage medium (301) on which the computer program (303) according to claim 18 is stored.

Images