Method for automatically transferring an autonomously driving vehicle to a safe state in the event of a communication connection being interrupted

Abstract

The invention relates to a method (100), in particular a computer-implemented method, for automatically transferring an autonomously driving vehicle (1) into a safe state in the event of a broken communication connection (6) between the autonomously driving vehicle (1) and a central communication unit (5), wherein the method comprises the following steps: checking the communication connection (6) between the autonomously driving vehicle (1) and the central communication unit (101), if a failure of the communication connection between the autonomously driving vehicle (1) and the central communication unit (5) is detected, generating a command signal which is intended for the autonomous vehicle (1) with the broken communication connection (6), wherein the command signal comprises a driving command for transferring the autonomously driving vehicle (1) into a safe state (102),Providing the created command signal for transmission to at least one vehicle-external infrastructure facility (7), via which an evaluation of the command signal of the autonomously driving vehicle (1) is possible (103).,

Description

[0001] The invention relates to a method, in particular a computer-implemented method, for automatically transferring an autonomously driving vehicle to a safe state in the event of a lost communication connection between the autonomously driving vehicle and a central communication unit. The invention further relates to a central communication unit, a control unit, an external vehicle infrastructure device, a computer program, and a computer program product.

[0002] Autonomy in vehicle control is increasingly being transferred to the vehicle. According to the current SAE (Society of Automotive Engineers) standard, a distinction is made between five levels. SAE Level 4 refers to fully automated driving, in which the driving task is completely transferred to the system within certain boundary conditions. SAE Level 5 refers to autonomous driving, in which the system is capable of completely taking over the driving task without restrictions.

[0003] To perform an automated driving process, a trajectory is typically calculated based on the current vehicle state and information about the vehicle's surroundings, along which the vehicle then moves automatically. Examples of such driving processes include reducing speed when approaching a slower vehicle ahead, overtaking maneuvers, turning maneuvers, obstacles, and many more.

[0004] Vehicle-to-X communication for autonomous vehicles is currently in the standardization, development, and implementation phase. Vehicle-to-X communication is fundamentally intended to enable autonomous vehicles and infrastructure facilities to exchange information with each other. It is known to send vehicle-to-X messages that include, for example, the current position or speed of a vehicle.

[0005] Autonomous driving requires a very high level of safety. This means that an autonomous vehicle must always be able to enter a safe state, for example, through a minimal-risk maneuver (MRM). However, due to the complexity of the systems and their operational design domain (ODD), malfunctions cannot be completely ruled out. One conceivable problem scenario is a loss of communication between an autonomous vehicle and a central server due to a network failure, a receiver malfunction, a software error, or a cyberattack. An autonomous vehicle whose communication connection with the central server is lost is in an emergency state, as the exchange of relevant information and, in particular, centralized monitoring of autonomous driving operations is no longer possible.To counteract this problem, the autonomous vehicle is designed to detect such a situation and execute a so-called minimum risk maneuver to minimize the risk of an accident. If the autonomous vehicle fails to detect the communication interruption, undesirable and potentially dangerous actions cannot be ruled out.

[0006] It is therefore an object of the invention to provide a method and a system which achieves a safe state of an autonomously driving vehicle with a broken vehicle-to-X communication connection.

[0007] This object is achieved by a method according to claim 1, a central communication unit according to claim 8, a control unit according to claim 9, a vehicle-external infrastructure device according to claim 11, a computer program according to claim 13 and a computer program product according to claim 14.

[0008] The invention relates to a method, in particular a computer-implemented method, for automatically transferring an autonomously driving vehicle to a safe state in the event of an interrupted communication connection between the autonomously driving vehicle and a central communication unit. In the context of the invention, a safe state is preferably understood to mean a stationary or parked state. The autonomously driving vehicle is designed in particular with an SAE (Society of Automotive Engineers) automation level 4 or 5. The central communication unit is in particular a central server, also referred to as a backend, which can communicate bidirectionally with a plurality of autonomously driving vehicles via a wireless connection. Accordingly, vehicle communication with a central location takes place. Vehicle communication is possible, for example, in the area of ​​mobile radio networks.According to the invention, a communication connection is terminated if the delivery, in particular the correct delivery and / or reception of messages between the central communication unit and the autonomously driving vehicle is not possible. The method comprises the following steps: The communication connection between the autonomous vehicle and the central communication unit is checked. The purpose of the communication connection is to exchange information, such as traffic information, location information, driving instructions, and / or centralized control of the autonomous vehicles. Communication interruptions are preferably checked by the central communication unit. A communication interruption is detected, for example, if one or more messages between the central communication unit and the autonomous vehicle are not delivered and / or the autonomous vehicle does not respond to remote commands.

[0009] If a failure of the communication link between the autonomously driving vehicle and the central communication unit is detected, a command signal is generated that is intended for the autonomous vehicle with the interrupted communication link. The command signal, in particular an emergency command signal, comprises a driving command to transfer the autonomously driving vehicle to a safe state. In particular, the command signal includes the driving instruction to stop and / or move to a specified destination.

[0010] The generated command signal is provided for transmission to at least one vehicle-external infrastructure facility, via which the autonomously driving vehicle can evaluate the command signal, e.g., using a sensor unit. The provision and, in particular, transmission of the generated command signal is preferably carried out by the central communications unit. The vehicle-external infrastructure facility is, for example, an infrastructure information system for providing information to vehicles.

[0011] The problem underlying the invention is therefore solved by an emergency measure initiated externally within the vehicle. The vehicle-external instruction makes it possible to transfer the autonomously driving vehicle, which is in an emergency state due to the interrupted communication connection, into a safe state. The goal of the emergency measure initiated externally within the vehicle is therefore to provide the autonomously driving vehicle with driving instructions that can be used to quickly avoid critical and dangerous situations. Specifically, the aim is to prevent the autonomously driving vehicle from initiating unfavorable driving maneuvers without centralized monitoring or control or due to a lack of information. This improves the safety of automated driving in road traffic.

[0012] A connection failure between the central communication unit and the autonomous vehicle is detected, for example, if a mobile network failure, a system malfunction, the autonomous vehicle entering an area with poor or no connection status and / or a cyberattack on the autonomous vehicle has been detected.

[0013] According to a preferred embodiment, the generated command signal has an encryption associated with the autonomously driving vehicle, so that the command signal addresses only the autonomously driving vehicle with the detected interrupted communication connection. For example, the chassis number of the autonomously driving vehicle is known to the central communication unit or can be retrieved via an encrypted database, so that the central communication unit can send an encrypted command signal to the vehicle to be addressed using the chassis number. The addressed vehicle, in turn, is configured to decrypt and evaluate the encrypted command signal assigned to it.

[0014] According to a further preferred embodiment, in order to transmit the generated command signal to the autonomously driving vehicle, at least one vehicle-external infrastructure facility located in the vicinity of the autonomously driving vehicle with the interrupted communication connection is determined. In order to determine vehicle-external infrastructure facilities located in the vicinity of the vehicle, a vehicle position and / or planned trajectory and / or a last communicated destination communicated by the autonomously driving vehicle is compared with the location positions of the vehicle-external infrastructure facilities. The determination of the vehicle-external infrastructure facilities located in the vehicle vicinity and / or the assignment of the provided command signal to at least one vehicle-external infrastructure facility preferably takes place via the central communication unit.The problem underlying the invention can be solved efficiently in this way.

[0015] In an advantageous embodiment of the invention, a control command signal is provided for autonomously driving vehicles in a traffic area with a poor or no communications network. Dead zones in certain areas are not uncommon. Furthermore, in tunnels, due to the isolation, usually no or only an inadequate connection can be established between the vehicles and the communications unit. By providing a control command signal, which is output via at least one infrastructure element external to the vehicle, at least one-way communication can be maintained with the autonomously driving vehicles. The control command signal includes, for example, traffic information, a navigation instruction, or a speed limit.

[0016] It is advantageous for the method according to the invention if the autonomously driving vehicle always follows the read command signal. The read command signal containing the driving instruction is thus given the highest priority, regardless of whether a vehicle control unit has evaluated the failed communication connection or planned a different maneuver within the vehicle. This ensures that the vehicle can always be transferred to a safe state, even if it itself does not recognize that it is in an emergency state, for example, due to a cyberattack.

[0017] In a particularly advantageous embodiment, a command signal is provided which requires a combination of multiple sensors for evaluation by the control unit of the autonomously driving vehicle. For example, the command signal for outputting the driving instruction may provide a camera code, a radar reflection sequence, and / or a lidar reflection sequence. Accordingly, a vehicle camera of the autonomously driving vehicle must evaluate the camera code, and / or a radar sensor of the autonomously driving vehicle must evaluate the specific radar reflection, and / or a lidar sensor of the autonomously driving vehicle must evaluate the specific lidar reflection in order to recognize and execute the driving instruction. The combination of multiple sensors prevents the risk of misuse.

[0018] Another subject matter of the invention relates to a central communication unit for communicating with at least one autonomously driving vehicle via a car-to-X communication network. The central communication unit is designed to carry out a method according to the preceding description. The central communication unit preferably comprises a processor, a memory unit, and at least one communication module for communicating with a communication module of the at least one autonomously driving vehicle and / or a receiving unit of the at least one vehicle-external infrastructure facility.

[0019] Another subject matter relates to a control unit of an autonomously driving vehicle, wherein the control unit is configured to evaluate and execute the received command signal. The control unit may, in particular, comprise a microcontroller or microprocessor, a central processing unit (CPU), a graphics processor (GPU), a digital signal processor (DSP), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), and the like, as well as software for performing the corresponding method steps.

[0020] The present invention can thus be implemented in digital electronic circuits, computer hardware, firmware or software.

[0021] Preferably, the control unit is coupled to a sensor unit of the autonomously driving vehicle for receiving sensor data. The sensor unit can comprise any sensor type, for example, one or more ultrasonic sensors, one or more radar sensors, one or more cameras, and / or one or more lidar sensors. The sensor unit is configured to detect the command signal, and the control unit is configured to evaluate the sensor data transmitted by the sensor unit. Furthermore, the control unit is configured to execute a command signal determined from the sensor data.

[0022] Another subject matter of the invention relates to an off-vehicle infrastructure facility, which comprises a receiving unit for receiving a command signal transmitted by the central communication unit and is designed to output the received command signal. The off-vehicle infrastructure facility is designed in particular for outputting information to vehicles. The off-vehicle infrastructure facility comprises at least or exactly one road infrastructure element of the same or a different type. For example, the off-vehicle infrastructure facility comprises dynamic signage, in particular a display, a screen, an analogue print and / or a traffic light circuit, which output the command signal optically and / or with an integrated radio contact. The off-vehicle infrastructure facility can be operated by a public authority or by a commercial provider.

[0023] According to a preferred embodiment, the vehicle-external infrastructure device is designed to output the command signal as a special reflection pattern for evaluation by a radar sensor and / or lidar sensor.

[0024] Alternatively or optionally in addition, the vehicle-external infrastructure device is designed to output the command signal as optical information for evaluation by a camera sensor.

[0025] According to a preferred embodiment, the vehicle-external infrastructure device is configured to output the received command signal as optical information, for example, as a QR code, as an ARUCO code, and / or as a vehicle-specific light signal sequence or comparable emergency sequences that can be detected by the vehicle sensor system. Alternatively, or optionally additionally, the vehicle-external infrastructure device is configured to output the received command signal as a radar frequency signal and / or as a lidar frequency signal.

[0026] Furthermore, the present invention also includes a computer program with instructions which, when the computer program is executed by a computer, cause the computer to carry out the method according to the invention as described above.

[0027] In addition, the present invention comprises a computer program product on which the computer program according to the invention is stored.

[0028] Further developments, advantages, and possible applications of the invention will become apparent from the following description of exemplary embodiments and from the figures. All described and / or illustrated features, individually or in any combination, are fundamentally the subject of the invention, regardless of their summary in the claims or their reference back to them. The content of the claims is also incorporated into the description.

[0029] They show: Fig. 1 a schematic and exemplary representation of an autonomously driving vehicle which is transferred into a safe state by a received command signal due to an interrupted communication connection with a central communication unit; Fig. 2 a flow chart showing the process steps of the method for automatically transferring the Fig. 1 shows how the autonomously driving vehicle is brought into a safe state.

[0030] In the figures, identical elements are always given the same reference symbol.

[0031] Fig. Figure 1 shows an autonomously driving vehicle 1 having a control unit 2. The control unit 2 comprises a processor and a memory unit. The control unit 2 is configured to drive the vehicle 1 autonomously. The autonomously driving vehicle 1 is thus equipped with an automated driving system with SAE Level 4 or 5, which takes over driving independently, i.e., without supervision or even the physical presence of the driver.

[0032] The vehicle 1 has a communication module 4. The communication module 4 enables wireless communication 6 with a central communication unit 5. This means, in particular, that the communication module 4 can send messages, e.g., trip logs, to the central communication unit 5 and / or receive messages, e.g., instructions, in particular, navigation instructions or traffic information, from the central communication unit 5.

[0033] The central communication unit 5 is particularly designed to monitor the communication connection status with autonomously driving vehicles. If the central communication unit 5 determines that the communication connection between the autonomously driving vehicle 1 and the central communication unit 5 has failed, the central communication unit sends a command signal to at least one vehicle-external infrastructure device 7 via a wireless communication connection 6. For example, the central communication unit 5 creates a temporary key and transmits the temporary key to the vehicle-external infrastructure device 7. The command signal comprises a driving instruction for automatically transferring the autonomously driving vehicle 1, which can no longer be controlled via direct car-to-X communication, into a safe state.The received command signal with the driving instruction can trigger a reaction in the autonomously driving vehicle 1, for example an active steering and / or speed change and / or a replanning of the trajectory.

[0034] If a communication interruption is detected, the central communication unit 5 is therefore prompted to initiate an external emergency measure by providing the command signal, by means of which the autonomously driving vehicle is transferred to a safe state. In the context of the invention, a safe state is a stationary, specifically a parked state. The command signal comprises, for example, a navigation instruction with a destination location, e.g., a parking space or hard shoulder, to which the autonomously driving vehicle 1 is to be automatically driven and brought to a stop. If it is known that a driver is in the autonomously driving vehicle 1, a further possible command signal is a request to the driver to take over control of the vehicle 1.

[0035] The Fig. The vehicle-external infrastructure device 7 shown in Figure 1 is illustrated by way of example as a display arranged at the edge of the roadway. As an exemplary alternative, the vehicle-external infrastructure device 7 can be an installed traffic light system that outputs the command signal in the form of a traffic light code. Also conceivable is an autonomously driving follow-me vehicle or a manually driven police vehicle that locates the autonomously driving vehicle 1, e.g., using the most recently transmitted location information, and displays the command signal to the autonomously driving vehicle, e.g., via a display or a sign, prompting it to follow or stop. Transmission of the command signal via radio or Bluetooth is also possible.

[0036] The vehicle 1 comprises a sensor unit 3, which is designed to detect the entire area of ​​the vehicle's surroundings (360° detection) of the vehicle 1. The sensor unit 3 can comprise any sensor type, for example, one or more camera, lidar, radar, and / or ultrasonic sensors. The sensor unit 3 is coupled to the control unit 2 for transmitting the sensor data. The control unit 2 is designed to evaluate a command signal from the transmitted sensor data. The command signal comprises a driving command, e.g., an instruction to stop the vehicle 1, so that the vehicle 1 is transferred to a safe state.

[0037] The command signal can be displayed in a form that is readable by a vehicle camera, for example, as a QR code. It is essential that the command signal is displayed in a form that is readable by the control unit 2 of the autonomously driving vehicle 1. The command signal can be output in such a way that it can be detected by the sensor unit 3 of the vehicle 1 and read by the control unit 2 through the evaluation of the sensor data. It is also possible for the command signal to be transmitted to the control unit 2 via a local wireless connection, e.g., via Bluetooth, or via a radio connection.

[0038] The control unit 2 of the autonomously driving vehicle 1 is designed to determine and execute, i.e. control, the command signal with the driving instruction based on the sensor data on the vehicle environment transmitted and evaluated by the sensor unit 3.

[0039] Fig.2 shows a schematic flow chart illustrating the sequences of the method 100, in particular a computer-implemented method, for automatically transferring the autonomously driving vehicle 1 into a safe state in the event of a broken communication connection 6 between the autonomously driving vehicle 1 and a central communication unit 5.

[0040] According to the method 100 according to the invention, the communication connection 6 between the autonomously driving vehicle 1 and the central communication unit 5 is checked 101. If a failure of the communication connection 6 between the autonomously driving vehicle 1 and the central communication unit 5 has been detected, a command signal is generated 102, which is intended for the autonomous vehicle 1 with the interrupted communication connection 6. The command signal comprises a driving command for transferring the autonomously driving vehicle 1 to a safe state. In a next method step, the generated command signal is provided, in particular transmitted, for transmission to at least one vehicle-external infrastructure device 7, via which an evaluation of the command signal by the control unit 2 of the autonomously driving vehicle 1 is possible 103.The at least one vehicle-external infrastructure device 7 is configured to output the command signal transmitted by the central communication unit 5. The control unit 2 of the autonomously driving vehicle 1, in turn, is configured to evaluate the command signal received via the communication module 4 or the sensor unit 3 and to control the evaluated driving instruction.

[0041] The invention has been described above using exemplary embodiments. It is understood that numerous changes and modifications are possible without departing from the scope of protection defined by the patent claims. List of reference symbols 1 Autonomous vehicle 2 control unit 3 Sensor unit 4 Communication module 5 Central communication unit 6 Communication connection 7 Vehicle-external infrastructure facility

Claims

[1] Method (100), in particular a computer-implemented method, for automatically transferring an autonomously driving vehicle (1) into a safe state in the event of a broken communication connection (6) between the autonomously driving vehicle (1) and a central communication unit (5), the method comprising the following steps: - Checking the communication connection (6) between the autonomously driving vehicle (1) and the central communication unit (101), - in the event of a detected failure of the communication connection between the autonomously driving vehicle (1) and the central communication unit (5), generating a command signal which is intended for the autonomous vehicle (1) with the interrupted communication connection (6), wherein the command signal comprises a driving command for transferring the autonomously driving vehicle (1) into a safe state (102), - Providing the created command signal for transmission to at least one vehicle-external infrastructure facility (7), via which an evaluation of the command signal by the autonomously driving vehicle (1) is possible (103). [2] Method (100) according to claim 1, characterized by that the command signal created has an encryption assigned to the autonomously driving vehicle (1), so that the command signal only addresses the autonomously driving vehicle (1) with the interrupted communication connection (6). [3] Method (100) according to claim 1 or 2, characterized bythat a connection failure between the central communication unit (5) and the autonomously driving vehicle (1) is detected if a mobile network failure, a system malfunction, entry of the autonomously driving vehicle (1) into a traffic area with a poor or no connection status (6) and / or a cyber attack of the autonomously driving vehicle (1) has been detected. [4] Method (100) according to one of the preceding claims, characterized byin that, in order to transmit the created command signal to the autonomously driving vehicle (1), at least one vehicle-external infrastructure facility (7) is determined which is located in the vicinity of the autonomously driving vehicle (1), wherein, in order to determine vehicle-external infrastructure facilities (7) located in the vicinity of the vehicle, the vehicle position and / or planned trajectory and / or the last communicated destination last communicated by the autonomously driving vehicle (1) is compared with the location positions of the vehicle-external infrastructure facilities (7). [5] Method (100) according to one of the preceding claims, characterized by that a control command signal for autonomous vehicles is provided for an area with poor or no communication network. [6] Method (100) according to one of the preceding claims, characterized bythat a command signal is provided which requires a combination of several sensors (3) of the autonomously driving vehicle (1) to evaluate the driving instruction. [7] Method according to claim 6, characterized by that the command signal for transmitting the driving instruction provides a camera code and / or a radar reflection sequence and / or a lidar reflection sequence. [8] Central communication unit (5) for communicating with at least one autonomously driving vehicle (1) via a car-to-X communication network, wherein the central communication unit (5) is designed to carry out a method (100) according to one of the preceding claims. [9] Control unit (2) of an autonomously driving vehicle, wherein the control unit (2) is designed to evaluate and execute the received command signal. [10] Control device (2) according to claim 9, characterized bythat the control unit is coupled to a sensor unit (3) of the vehicle (1), wherein the sensor unit (3) is designed to detect the command signal, wherein the control unit (2) is designed to evaluate the sensor data of the sensor unit (3) of the autonomously driving vehicle (1), wherein the control unit (3) is designed to execute a command signal determined in the sensor data. [11] Vehicle-external infrastructure device (7), which comprises a receiving unit for receiving a command signal transmitted from a central communication unit (5) and is designed to output the received command signal. [12] Vehicle-external infrastructure device (7) according to claim 11, characterized bythat the vehicle-external infrastructure device (7) is designed to output the received command signal as a QR code and / or as an ARUCO code and / or as a vehicle-specific light signal sequence and / or as a radar frequency signal and / or as a lidar frequency signal. [13] A computer program comprising instructions which, when the computer program is executed by a computer, cause the computer to carry out the method according to any one of claims 1 to 7. [14] A computer program product on which a computer program according to claim 13 is stored.

Images