System and procedure for evaluating the reliability of an autonomous driving system of a motor vehicle

Abstract

A system for evaluating the reliability of an autonomous driving system (2) is provided, wherein the autonomous driving system comprises at least two channels (3, 4), each comprising a modeling module (6, 10) and a control module (8, 12), wherein the system (1) comprises: - for each combination of a control module (8, 12) and a modeling module (6, 10) of different channels, an evaluator (13, 14, 15, 16) designed to assess the control signal output by the control module in conjunction with the environment model signal output by the modeling module in question and to derive a safety score, and - a selector (19) designed to calculate a reliability probability based on the safety scores for at least each control module. Furthermore, a procedure for assessing the reliability of an autonomous driving system is provided.

Description

TECHNICAL FIELD OF THE INVENTION

[0001] The invention relates to the field of automotive engineering and in particular to the autonomous (or automated) driving of motor vehicles.

[0002] More specifically, the invention relates to a system and a method for evaluating the reliability of an autonomous driving system of a motor vehicle. BACKGROUND INFORMATION AND STATE OF THE ART

[0003] In the above-mentioned technical field, an autonomous driving system (AD system) comprises a channel with various functional modules, such as a set of sensors, a modeling module designed to calculate a model of the vehicle's environment, a planning module designed to determine an appropriate command for the vehicle taking into account the calculated environment of the vehicle, and a control module that provides a control signal (or a control command) for the vehicle according to the decision made by the planning component.

[0004] To ensure safe and reliable operation, some autonomous driving systems incorporate redundant parallel channels comprising homologous modules. These systems implement comparison mechanisms between different components to detect potential component failures. Current systems require a comparison between at least three homologous modules from different redundant channels to detect a fault and identify the failed module. However, the more modules a system includes, the more complex and expensive it becomes. Therefore, there is a need to limit the number of modules in AD systems.

[0005] Furthermore, there is a need for AD activation and deactivation triggers for the human driver. An AD activation trigger is the ability of an AD system to suggest that the driver transfer control and start AD operation if the components in the AD system are deemed reliable while the vehicle is being driven manually. An AD deactivation trigger is the ability of an AD system to warn the human driver, take over control, and stop AD operation if AD operation is deemed unreliable while the vehicle is driving autonomously. Current AD systems cannot determine a component's reliability level and therefore cannot provide AD activation and deactivation triggers for the human driver. SUMMARY OF THE INVENTION

[0006] Therefore, it is an object of the invention to improve the security and reliability of the AD system without excessively increasing its cost and complexity.

[0007] According to one aspect of the invention, a system for evaluating the reliability of an autonomous driving system of a motor vehicle is provided, wherein the autonomous driving system comprises at least two channels, each comprising: - a modeling module designed to output an environment model signal representative of at least one parameter of the vehicle's environment, and - a control module configured to output a control signal for the vehicle based on the environment model signal, characterized in that the system comprises: - for each combination of a control module and a modelling module of different channels, an evaluator designed to evaluate the control signal output by the control module in question in conjunction with the environmental model signal output by the modelling module in question and to derive a safety score, and - a selector designed to calculate a reliability probability based on the safety scores for at least each control module.

[0008] By determining a reliability probability, it is possible to assess the reliability of each AD channel. Therefore, the system according to the invention is fault-tolerant and capable of providing AD activation and deactivation triggers.

[0009] According to one embodiment, the system comprises, for at least one pair of homologous modules from different channels, a comparator configured to compare the signals output by the homologous modules and derive a similarity score, wherein the selector is configured to calculate the reliability probability based on the security score(s) and on the similarity score(s).

[0010] Adding a similarity score to input data for calculating the reliability probability increases the accuracy of the system.

[0011] According to one embodiment, the system comprises a comparator for each pair of homologous modules from different channels.

[0012] According to one embodiment, the control signals and the environment model signals are digital signals, wherein each comparator is adapted to select a sample of each signal output by its associated pair of homologous modules, the samples comprising the same predetermined number of elements, and - to test the equality of the means of the samples and to derive a first score, - to test the equality of the variances of the samples and derive a second score, - to determine the correlation coefficient of the samples, where the similarity score is equal to the lowest value of the first score, the second score and the correlation coefficient.

[0013] According to one embodiment, the predetermined number of elements is at least 30.

[0014] According to one embodiment, each comparator is configured to combine the samples to obtain a data set and to check the normality of the distribution of the data, and if the data conform to a normal distribution, - to test the equality of means using the Welch test, and / or - to test the equality of variances using the Bartlett test, and / or - calculate a Pearson correlation coefficient as the correlation coefficient.

[0015] According to one embodiment, the comparators are designed to combine the samples to obtain a data set and to check the normality of the distribution of the data, and if the data does not correspond to a normal distribution, - test the equality of means using the Wilcoxon signed rank test, and / or - to test the equality of variances using the Brown-Forsythe test, and / or - to calculate a Spearman rank correlation coefficient as the correlation coefficient.

[0016] According to one embodiment, the comparator is configured to check the normality of the data sample using the Shapiro-Wilk test.

[0017] According to one embodiment, each control signal comprises a longitudinal sub-signal and a lateral sub-signal. The comparator is configured, when comparing the signal from two control modules, to perform a first comparison between the longitudinal sub-signals and derive a first similarity sub-score, and to perform a second comparison between the lateral sub-signals and derive a second similarity sub-score. The similarity score is a combination of the first similarity sub-score and the second similarity sub-score, or a selection of one of the sub-scores. For example, the similarity score is the minimum of the first similarity sub-score and the second similarity sub-score.

[0018] According to one embodiment, the system comprises an evaluator for each possible combination of a modeling module with a control module.

[0019] According to one embodiment, the selector is configured to calculate the reliability probabilities using a Bayesian network.

[0020] According to one embodiment, the selector is designed to binarize the scores (i.e., the certainty scores and, where appropriate, the similarity scores) according to a predetermined threshold before calculating the reliability probabilities.

[0021] According to one embodiment, if the vehicle is driven manually by a driver and if all reliability probabilities are above a predetermined safety threshold, the selector is designed to suggest to the driver that the autonomous driving system takes over driving the vehicle.

[0022] According to one embodiment, the selector is configured to warn the driver of an imminent deactivation of the autonomous driving system if the autonomous driving system has taken over driving the vehicle and if all reliability probabilities are below a predetermined danger threshold.

[0023] According to one embodiment, if the autonomous driving system has taken over driving the vehicle, the selector is designed to control the vehicle according to the control signal output by the control module for which the selector has calculated the highest reliability probability.

[0024] According to one embodiment, this highest reliability probability is above a predetermined safety threshold.

[0025] According to another aspect, a method is provided for evaluating the reliability of an autonomous driving system of a motor vehicle, wherein the autonomous driving system comprises at least two channels, each comprising: - a modeling module designed to output an environment model signal representative of at least one parameter of the vehicle's environment, and - a control module configured to output a control signal for the vehicle based on the environment model signal, characterized in that the method comprises: - for each combination of a control module and a modeling module of different channels, a step of assessing the control signal output by the respective control module in conjunction with the environmental model signal output by the respective modeling module and deriving a safety score, and - a step of calculating, at least for each control module, a reliability probability based on the safety scores. DETAILED DESCRIPTION OF AN EXAMPLE (OF EXAMPLES)

[0026] The following description, given with reference to the accompanying drawings, will clarify what the invention consists in and how it can be carried out. The invention is not limited to the embodiments shown in the drawings. Accordingly, it is understood that where features mentioned in the claims are followed by reference numerals, these reference numerals are inserted solely for the purpose of clarifying the claims and in no way limit the scope of the claims.

[0027] The attached drawings show: - Fig. 1 an autonomous driving system comprising a system for evaluating its reliability according to the invention, - Fig. 2 a Bayesian network designed to estimate reliability probabilities for the autonomous driving system of Fig. 1 to provide.

[0028] An evaluation system 1 for evaluating the reliability of an autonomous driving system (AD system) 2 of a motor vehicle is described in Fig. 1 shown schematically.

[0029] The AD system 2 comprises two autonomous driving channels 3, 4, each designed to independently provide a control signal for the vehicle. For this purpose, the two channels 3, 4 are redundant, i.e., they comprise homologous modules. A first channel 3 comprises a first set of sensors 5, a first modeling module 6, a first planning module 7, and a first control module 8. A second channel 4 comprises a second set of sensors 9, a second modeling module 10, a second planning module 11, and a second control module 12.

[0030] The sensors of the sets of sensors 5, 9 are mounted on the motor vehicle and can be of any type. For example, the motor vehicle can be equipped with multiple cameras, multiple radar sensors, lidar sensors, or sonar sensors. The sensors of the two sets of sensors 5, 9 can be of different types, as long as they are designed to capture similar information. For example, the presence of an obstacle can be detected by a camera on the first channel 3 and by a radar on the second channel.

[0031] The modeling modules 6, 10 are designed to output an environment model signal representative of at least one parameter of the vehicle's environment, these parameters being provided by the set of sensors 5, 9. The more parameters there are, the more realistic the calculated representation of the vehicle's environment. For example, the parameters are the vehicle's speed, the vehicle's yaw rate, the position and speed of the most dangerous object in the vehicle's environment, the curvature of the current lane, the lateral offset, and the yaw angle of the vehicle relative to the current lane.

[0032] The planning modules 7, 11 are designed to calculate appropriate behavior for the vehicle with respect to the environmental model signal. For example, the planning modules 7, 11 provide planning signals that are representative of a collision-free vehicle trajectory.

[0033] The control modules 8 and 12 each provide a control signal for the motor vehicle. The control signals are designed to steer the vehicle in accordance with the appropriate behavior calculated by the planning modules.

[0034] Evaluation system 1 is designed to assess the reliability of the AD system. For this purpose, it includes several evaluators 13, 14, 15, 16, a selector 19, a switch 20, and several comparators 17, 18.

[0035] The evaluators are designed to assess the safety level of potential AD system actions—here, the safety level of a control signal—with respect to the vehicle's environment, here, with respect to environmental model signals. Each evaluator is therefore designed to receive two input signals (a control signal and an environmental model signal) and output a safety score representative of the action's safety. For example, the safety score is contained in the range [0;1], where 0 means "unsafe" and 1 means "safe."

[0036] For example, the assessors are model-predictive safety assessors, as described in "Qin, Lei & Benmokhtar, Rachid & Perrotton, Xavier. (2021). Real-Time Model Predictive Safety Assessment for Level 3 Autonomous Driving." Although the assessor described in this publication refers to Level 3 autonomous driving, those skilled in the art will be able to extrapolate this to higher levels of autonomous driving. The levels of autonomous driving are described in the Society of Automotive Engineers (SAE) standard J3016.

[0037] The system 1 comprises one evaluator for each combination of a control module and a modeling module from different channels (cross-evaluator) and preferably (as described here) one evaluator for each possible combination of a modeling module with a control module (from different channels - cross-evaluator, and from the same channel - self-evaluator). Therefore, the evaluation system 1 described here comprises four evaluators 13, 14, 15, 16.

[0038] A first evaluator 13 is designed to assess a safety level of the first control module 8 with respect to the first modeling module 6 and to derive a first safety score Zs1. The first evaluator is a self-evaluator.

[0039] A second evaluator 14 is designed to assess the safety level of the second control module 12 with respect to the first modeling module 6 and to derive a second safety score Zs2. The second evaluator is a cross-evaluator.

[0040] A third evaluator 15 is designed to assess the safety level of the first control module 8 with respect to the second modeling module 10 and to derive a third safety score Zs3. The third evaluator is a cross-evaluator.

[0041] A fourth evaluator 16 is designed to assess a safety level of the second control module 12 with respect to the second modeling module 10 and to derive a fourth safety score Zs4. The fourth evaluator is a self-evaluator.

[0042] To assess the reliability of the AD system 2, the evaluation system 1 here includes several comparators.

[0043] The comparators 17, 18 are designed to evaluate the similarity of signals computed by two homologous components of different channels. Each evaluator is therefore designed to receive two input signals (one from each homologous module, e.g., two environment model signals or two control signals) and output a similarity score representative of the similarity of the two signals. For example, the similarity score is in the range [0;1], where 0 means "dissimilar" and 1 means "similar."

[0044] To calculate the similarity scores, the comparators 17, 18 are designed to perform various statistical hypothesis tests on samples of the input signals.

[0045] The sample should contain a minimum number of elements, for example, 30. For example, the sample corresponds to a predetermined time window, such as one second. If the sampling frequency is too low to obtain 30 elements within the time window, the time window is enlarged accordingly.

[0046] Two signals are considered similar (similarity score of 1) if their means and variances (determined based on the samples) are equal and if their correlation is equal to 1.

[0047] The statistical tests implemented by comparators 17, 18 may depend, in particular, on the normality of the data. Therefore, in this embodiment, comparators 17, 18 are designed to combine the two samples and check the normality of the resulting data before comparing the means and variances and evaluating the correlation.

[0048] Preferably, the comparators 17, 18 are designed to test the normality of the summarized data using the Shapiro-Wilk test. This test is known to those skilled in the art and is described in detail in "Shapiro, SS and Wilk, MB (1965) An Analysis of Variance Test for Normality (Complete Samples). Biometrika, 52, 591-611."

[0049] For example, the comparators 17, 18 are designed to - if the data follow a normal distribution, ◯ to test the equality of means using the Welch test, which is known to those skilled in the art and is described in detail in "WELCH BL. The generalisation of student's problems when several different population variances are involved. Biometrika. 1947;34(1-2):28-35", ◯ to test the equality of variances using the Bartlett test, which is known to those skilled in the art and is described in detail in “G. Maurice S Bartlett. Properties of sufficiency and statistical tests. Proceedings of the Royal Society of London. Series A-Mathematical and Physical Sciences, 160(901):268-282, 1937”, ◯ to calculate a Pearson correlation coefficient as the correlation coefficient, the Pearson correlation coefficient being known to the person skilled in the art and described in detail in “Karl Pearson. Note on regression and inheritance in the case of two parents. Proceedings of the Royal Society of London, 58:240-242, 1895”, - if the data do not follow a normal distribution, ◯ to test the equality of means using the Wilcoxon signed-rank test, which is known to those skilled in the art and is described in detail in “Frank Wilcoxon. Individual comparisons by ranking methods. Biometrics Bulletin, 1(6):80-83, 1945”, ◯ to test the equality of variances using the Brown-Forsythe test, which is known to those skilled in the art and is described in detail in “Morton B. Brown and Alan B. Forsythe. Robust tests for the equality of variances. Journal of the American Statistical Association , 69(346):364-367, 1974”, ◯ to calculate a Spearman rank correlation coefficient as the correlation coefficient, where the Spearman rank correlation coefficient is known to the person skilled in the art and is described in detail in "C. Spearman. The proof and measurement of association between two things. The American Journal of Psychology, 15(1):72-101, 1904."

[0050] Here, the similarity score is the minimum value of the p-value of equality of means test (here, for example, the Welch test or the Wilcoxon rank test), the p-value of the variance test (here, for example, the Bartlett test and the Brown-Forsythe test) and the value of the correlation test.

[0051] The evaluation system 1 comprises a comparator for at least one pair of homologous modules from different channels, and preferably (as described here) a comparator for each pair of homologous modules. Here, the evaluation system comprises two comparators 17, 18.

[0052] A first comparator 17 is designed to compare the control signals from the two channels 3, 4 (output by the control modules 8, 12) and to derive a first similarity score Zc1.

[0053] A second comparator 18 is designed to compare the environment model signal from the two channels 3, 4 (output by the modeling module) and derive a second similarity score Zc2.

[0054] Selector 19 is designed to evaluate the probability that a component is reliable based on the previously calculated scores, here the safety scores and the similarity scores. Selector 19 is therefore designed to receive the previously calculated scores, here four safety scores Zs1, Zs2, Zs3, Zs4 and two similarity scores Zc1, Zc2, as input variables and to evaluate a reliability probability at least for each control module, here for each control module and for each modeling module.

[0055] For example, selector 19 determines a state of the AD system based on the reliability probabilities and makes a decision accordingly. Here, the AD system states are divided into four categories: - Assured reliable states: All safety scores and similarity scores are high (e.g., above a predetermined safety threshold). If the driver is driving the vehicle manually, selector 19 suggests that the driver transfer control of the vehicle and that the AD system 2 assume control. - Deviation-tolerant states: At least one of the similarity scores is low (e.g., below a predetermined danger threshold), but all safety scores are high (above a safety threshold). If the vehicle is driving autonomously, selector 19 decides to continue autonomous driving. - Fault-tolerant states: Some of the safety scores are low (below a danger threshold), but at least one of the control signals receives a high reliability probability (above a safety threshold). If the vehicle is driving autonomously, selector 19 continues autonomous driving and instructs switch 20 to select the control signal with the highest reliability probability. - Failure states: None of the control signals receives a high probability of reliability. In these states, the selector requests that the human driver take over control of the vehicle and warns of an imminent deactivation of autonomous driving.

[0056] For example, selector 19 is designed to derive reliability probabilities by implementing probabilistic graphical models, such as a Bayesian network. Probabilistic graphical models are known to those skilled in the art and are described in "D. Koller and N. Friedman. Probabilistic Graphical Models: Principles and Techniques. Adaptive computation and machine learning. MIT Press, 2009."

[0057] Fig. Figure 2 shows a Bayesian network 21 implemented by the selector 19 for the AD system 2 described here. The Bayesian network 21 comprises ten nodes, here four hidden nodes corresponding to the reliability probabilities, and six evidence nodes corresponding to the certainty scores and similarity scores.

[0058] Here, a first hidden node represents the reliability probability P6 of the first modeling module 6, a second hidden node represents the reliability probability P10 of the second modeling module 10, a third hidden node represents the reliability probability P8 of the first control model 8, and a fourth hidden node represents the reliability probability P12 of the second control model 12.

[0059] Here, a first evidence node represents the first certainty score Zs1, a second evidence node represents the second certainty score Zs2, a third evidence node represents the third certainty score Zs3, a fourth evidence node represents the fourth certainty score Zs4; a fifth evidence node represents the first similarity score Zc1 and a sixth evidence node represents the second similarity score Zc2.

[0060] To derive the reliability probabilities, the Bayesian network is designed to use the following probabilities, which are obtained, for example, from prior knowledge or estimated from historical data. - the probability that the first environment model signal is reliable, - the probability that the second environment model signal is reliable, - the table of conditional probabilities of the first safety score Zs1, - the table of conditional probabilities of the second safety score Zs2, - the table of conditional probabilities of the third safety score Zs3, - the table of conditional probabilities of the fourth safety score Zs4, - the table of conditional probabilities of the first similarity score Zc1, - the table of conditional probabilities of the second similarity score Zc2, - the conditional probability that the first control signal is reliable, given the reliability of the first environment model signal, - the conditional probability that the second control signal is reliable given the reliability of the second environment model signal.

[0061] In this embodiment, the Bayesian network 21 is configured to binarize the certainty scores and the similarity scores using a respective threshold for each score. Therefore, the conditional probability tables of the dependent nodes, which would otherwise have a continuous probability distribution, contain a discrete probability distribution. This simplifies the computation.

[0062] Given that the security scores and similarity scores are binarized, selector 19 is designed to determine 64 states of the AD system corresponding to all possible combinations of the scores. These states are classified, for example, into the four categories mentioned above.

[0063] The invention is not limited to the embodiment described above in connection with the Fig. 1 and Fig. 2 was described.

[0064] For example, in some embodiments, the control signals comprise different sub-signals, for example, a longitudinal sub-signal and a lateral sub-signal. In such a case, the comparator that compares the signal from the control modules is configured to perform a first comparison between the longitudinal sub-signals and derive a first similarity sub-score, perform a second comparison between the lateral sub-signals and derive a second similarity sub-score, and combine the first similarity sub-score and the second similarity sub-score to obtain the similarity score.

[0065] An AD system comprising two channels has been described. However, the system and method for evaluation according to the invention are not limited by the number of channels and can assess the reliability of AD systems comprising more channels, for example, 3 or 4 channels. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited non-patent literature

[0000] Qin, Lei & Benmokhtar, Rachid & Perrotton, Xavier. (2021). Real-Time Model Predictive Safety Assessment for Level 3 Autonomous Driving

[0036] Shapiro, S.S. and Wilk, M.B. (1965) An Analysis of Variance Test for Normality (Complete Samples). Biometrika, 52, 591-611

[0048] WELCH BL. The generalisation of student's problems when several different population variances are involved. Biometrika. 1947;34(1-2):28-35

[0049] G. Maurice S Bartlett. Properties of sufficiency and statistical tests. Proceedings of the Royal Society of London. Series A-Mathematical and Physical Sciences, 160(901):268-282, 1937

[0049] Karl Pearson. Note on regression and inheritance in the case of two parents. Proceedings of the Royal Society of London, 58:240-242, 1895

[0049] Frank Wilcoxon. Individual comparisons by ranking methods. Biometrics Bulletin, 1(6):80-83, 1945

[0049] Morton B. Brown and AlanB. Forsythe. Robust tests for the equality of variances. Journal of the American Statistical Association , 69(346):364-367, 1974

[0049] C. Spearman. The proof and measurement of association between two things. The American Journal of Psychology, 15(1):72-101, 1904

[0049] D. Koller and N. Friedman. Probabilistic Graphical Models: Principles and Techniques. Adaptive computation and machine learning. MIT Press, 2009

[0056]

Claims

[1] System for evaluating the reliability of an autonomous driving system (2) of a motor vehicle, wherein the autonomous driving system (2) comprises at least two channels (3, 4), each comprising: - a modeling module (6, 10) designed to output an environment model signal representative of at least one parameter of the environment of the vehicle, and - a control module (8, 12) designed to output a control signal for the vehicle based on the environment model signal, characterized by that the system (1) comprises: - for each combination of a control module (8, 12) and a modeling module (6, 10) of different channels, an evaluator (13, 14, 15, 16) designed to evaluate the control signal output by the respective control module in conjunction with the environmental model signal output by the respective modeling module and to derive a safety score (Zs1, Zs2, Zs3, Zs4), and - a selector (19) designed to calculate a reliability probability (P6, P10, P8, P12) based on the safety scores (Zs1, Zs2, Zs3, Zs4) for at least each control module (8, 12). [2] System according to claim 1, comprising, for at least one pair of homologous modules from different channels, a comparator (17, 18) adapted to compare the signals output by the homologous modules and derive a similarity score (Zc1, Zc2), wherein the selector (19) is adapted to calculate the reliability probability (P6, P10, P8, P12) based on the security scores (Zs1, Zs2, Zs3, Zs4) and on the similarity scores (Zc1, Zc2). [3] System according to claim 2, comprising a comparator (17, 18) for each pair of homologous modules of different channels. [4] A system according to claim 2 or 3, wherein the control signals and the environment model signals are digital signals, each comparator (17, 18) being adapted to select a sample of each signal output by its associated pair of homologous modules, the samples comprising the same predetermined number of elements, and - to test the equality of the means of the samples and to derive a first score, - to test the equality of the variances of the samples and derive a second score, - to determine the correlation coefficient of the samples, where the similarity score (Zc1, Zc2) is equal to the lowest value of the first score, the second score and the correlation coefficient. [5] The system of claim 4, wherein the predetermined number of elements is at least 30. [6] A system according to any one of claims 2 to 5, wherein each comparator (17, 18) is adapted to combine the samples to obtain a data set and to check the normality of the distribution of the data, and if the data conform to a normal distribution, - to test the equality of means using the Welch test, or - to test the equality of variances using the Bartlett test, or - calculate a Pearson correlation coefficient as the correlation coefficient. [7] System according to one of claims 2 to 6, wherein the comparator (17, 18) is designed to combine the samples to obtain a data set and to check the normality of the distribution of the data, and if the data do not correspond to a normal distribution, - test the equality of means using the Wilcoxon signed rank test, or - to test the equality of variances using the Brown-Forsythe test, or - to calculate a Spearman rank correlation coefficient as the correlation coefficient. [8] A system according to claims 6 or 7, wherein the comparator (17, 18) is arranged to check the normality of the data sample using the Shapiro-Wilk test. [9] System according to one of claims 2 to 8, wherein each control signal comprises a longitudinal sub-signal and a lateral sub-signal, wherein the comparator is designed, when comparing the signal from two control modules (8, 12), to perform a first comparison between the longitudinal sub-signals and derive a first similarity sub-score and to perform a second comparison between the lateral sub-signals and derive a second similarity sub-score, wherein the similarity score is the minimum of the first similarity sub-score and the second similarity sub-score. [10] System according to one of claims 1 to 9, which comprises an evaluator (13, 14, 15, 16) for each possible combination of a modeling module (6, 10) with a control module (8, 12). [11] System according to one of claims 1 to 4, wherein the selector (19) is adapted to calculate the reliability probabilities (P6, P10, P8, P12) using a Bayesian network. [12] System according to one of claims 1 to 5, wherein the selector (19) is designed to binarize the scores according to predetermined thresholds before calculating the reliability probabilities (P6, P10, P8, P12). [13] System according to one of claims 1 to 12, wherein the selector (19) is designed to suggest to the driver that the autonomous driving system (2) takes over driving the vehicle if the vehicle is driven manually by a driver and if all reliability probabilities (P6, P10, P8, P12) are above a predetermined safety threshold. [14] System according to one of claims 1 to 10, wherein the selector (19) is designed to warn the driver of an imminent deactivation of the autonomous driving system if the autonomous driving system (2) has taken over driving the vehicle and if all reliability probabilities (P6, P10, P8, P12) are below a predetermined danger threshold. [15] System according to one of claims 1 to 11, wherein the selector (19) is designed, if the autonomous driving system (2) has taken over driving the vehicle, to control the vehicle according to the control signal output by the control module (8, 12) for which the selector has calculated the highest reliability probability. [16] The system of claim 15, wherein the highest reliability probability is above a predetermined safety threshold. [17] Method for evaluating the reliability of an autonomous driving system (2) of a motor vehicle, wherein the autonomous driving system comprises at least two channels (3, 4), each comprising: - a modeling module (6, 10) designed to output an environment model signal representative of at least one parameter of the environment of the vehicle, and - a control module (8, 12) designed to output a control signal for the vehicle based on the environment model signal, characterized by that the procedure includes: - for each combination of a control module (8, 12) and a modeling module (6, 10) of different channels, a step of assessing the control signal output by the respective control module in conjunction with the environment model signal output by the respective modeling module and deriving a safety score (Zs1, Zs2, Zs3, Zs4), and - a step of calculating, at least for each control module (8, 12), a reliability probability (P6, P10, P8, P12) based on the safety scores.

Images